53b78b64057a5352554b45f28b3305653ff3eb9d8361d48e08e41cf38f2e09f6

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 22:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6c6c341f0602c6c329decd331bd87eab_JaffaCakes118.html
Size

34KB
MD5

6c6c341f0602c6c329decd331bd87eab
SHA1

bf824bdb8013c3c8cd88120cd62afcbd37cca38b
SHA256

53b78b64057a5352554b45f28b3305653ff3eb9d8361d48e08e41cf38f2e09f6
SHA512

d6d2945daf2f801edd42f7644cfb2bcaaf79710ac7d5acb635e1f32c6ea14ee4351a10e9e834f1b5c7096d4e129c874ed9fc9af091369a45f9f5b809081052ca
SSDEEP

192:uwbfb5nRGnQjxn5Q/MnQieXNnXnQOkEntASnQTbnBnQOgecwqYjcwqYLcwqYQvhp:rQ/kqfJ5vhxYdjoCePhb

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422664208"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{869C1CB1-1951-11EF-90CD-4A18CE615B84} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1632	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1632	iexplore.exe
1632	iexplore.exe
2628	IEXPLORE.EXE
2628	IEXPLORE.EXE
2628	IEXPLORE.EXE
2628	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 2628	1632	iexplore.exe	28
PID 1632 wrote to memory of 2628	1632	iexplore.exe	28
PID 1632 wrote to memory of 2628	1632	iexplore.exe	28
PID 1632 wrote to memory of 2628	1632	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6c6c341f0602c6c329decd331bd87eab_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1632 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1796b74ca174f96fd42a9e27fe58c6c

SHA1
8c51e6772c4caa39acca5ba14ccb8e197c61aac9

SHA256
fdef8f4920129cad70d6fc082a8e6d4bc12572b74fd7c148223810c221f47ecf

SHA512
c22e977a1594b9e64b1cc506c2f4c51a6953f983aaee27aacce331803f541c50d0dbee49fecd80e8b822d4c0be3bec1f9973a41810a835ef89690c82e884bad7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
accb98529e325c465b1ba4cb817e25b6

SHA1
0d59f391906b5123477f8010075fcbcc2d6a4e7b

SHA256
6932fa39108629337b2dd34f831aa5011e694eb9f76895cd042cf99bf9f701be

SHA512
03fb5a174f9f34e765b1ec69c811ea046edae2fbec5c102a015f726de619d56c4606ab63e5c75b1658c73765c6d941bdd26872c148eac504bccbe526cc90068a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ccfae0dd0638950f9d8928d7c7458d1

SHA1
aa4cefce8b33fdcbd1146b36467ce1518ac583d8

SHA256
e07503d3219764f33faade2f476adc2d2b139c3054b415efb95ff2fa57076209

SHA512
cccc5d220e3f178d207b824b383d89853f877111166b7c167cfbee38d8bb1e8b60cae94125cb6ef4eb812ffa229f76099c670ee128d4f63ad9e3ed3c678b0431

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5dbe27b7b8ce58f987d93ec6eff6d799

SHA1
db5a95422e913ec90d5f79b30508528b4145c5f9

SHA256
e87d495386ddec3329e37871fab3776315e67d83d2e23f6366e3ac8e8df6905f

SHA512
7a8528b28aadb17f8a7984802a0177542aff5255d08cb5465bd4c651b3ae3bcfe1e164eee7063957f6e3e5eb698b351004f3711dcadad2b0d53a4391a58166fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
31428a536246fd46af3931509b402efd

SHA1
b15ed4ede8dccca05b726813acc0a7dbb8b9ff84

SHA256
3f86ac252df23acda1f3d6ee73caaf69638424e4a8b79a4861f5a49afaae4b20

SHA512
8cf23907c8228bc8625cf38ca83c03b05f2560de8a99bd701d52feb8e77468be48d715652a9d2d802143b039c75ba2d1675321dd66a4ec83d1cdc7a2d185a22e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a14a260697d31d5124b4c075886efae0

SHA1
29fcc102824db0aee07c61aadc541595b7611d0d

SHA256
53dc855fbf193d6469c34e30990e28ee493dfe697cda467e4ee72082a535bc45

SHA512
c2f6c4673fdcc52a91151d57207a90be4eb969defa0e701d83213c5fcbc4d04cd43e8bfe5c433d65aaf91e84951375881c73639163f003a33668ef418d99e474

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d90cc63ce7d9f5c363a726680650beee

SHA1
54bd61b4a49bd4bfd4bc484eb2be457c3a2d498f

SHA256
dfce8fbb6f602c1f2a185388f75046c93e793b17244f5e8a2eaa70730d288003

SHA512
14cf2affa14436497a961630a657bf0617b54c231cc7e0e1d23dabd34f7e51e0d9958d565f22c731444325e990f47659c202649ac49a419b849b6faff496b696

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
99398580c707eb3932124cdbdb55ff94

SHA1
9452664612d6e929dba05dbe712f0e0f4cc5a46a

SHA256
4c6caec810bbc2a4639e89db7f5239125f2ecd93c607e1fe9d1e7ba2e0600f16

SHA512
83c475fb3e3d8e75847f062d2be803aa46fbfee74a36ea254b1d9ac082e988dcc53cec01d62be2bb602645dc9e669f544f0ba4c04da8d510f29d0d9f6ca11a21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c30c410a1833b72a5c1ed97e8e0e7d08

SHA1
69cb44ed59e8eacd3ea2f0ab7725537db79dd173

SHA256
be2409e2a3c980434c838853921730dadc464fd9dad503a252e7f2c24b144532

SHA512
0ca43119c7689460c04527b46e30e7e6f4fd1d0ce439f37e45d7c25685550d412284739f74d78e66396d5d43a24b49c6d3acd98a221082fe55c3b3f5e0a2b363

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB39.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB8A.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit