4612f01f8cdf09668448fbff7ba2160d610f68fe45f42fae0a6dfbd92d5d6bf8

Analysis

max time kernel
148s
max time network
147s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 23:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6c8e722ad03fcec63961ca6b161dbc3d_JaffaCakes118.html
Size

18KB
MD5

6c8e722ad03fcec63961ca6b161dbc3d
SHA1

4bc3c83af7e053b0215025710b50fc2a99b20f6b
SHA256

4612f01f8cdf09668448fbff7ba2160d610f68fe45f42fae0a6dfbd92d5d6bf8
SHA512

42201d26b5aed7e39af1475bdc162dc203805c2818f5a48c284bfeab8939f32b024d3d2586ffc15b532538943970c8be4e9c070b40c6ebc4da38dd201fb0eb54
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIH4VzUnjBhHJ82qDB8:SIMd0I5nvH9svHixDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422667270"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A7B6C421-1958-11EF-BAE0-E64BF8A7A69F} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2284	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2284	iexplore.exe
2284	iexplore.exe
2304	IEXPLORE.EXE
2304	IEXPLORE.EXE
2304	IEXPLORE.EXE
2304	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 2304	2284	iexplore.exe	28
PID 2284 wrote to memory of 2304	2284	iexplore.exe	28
PID 2284 wrote to memory of 2304	2284	iexplore.exe	28
PID 2284 wrote to memory of 2304	2284	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6c8e722ad03fcec63961ca6b161dbc3d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2284 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e2c753b206ef560c3df22508cff7683

SHA1
c72412ff2e080cdf54ad7662b13114c5827e6d62

SHA256
9a61a0be13e25a841924f1e29e84557c400abd84583d8ce5f1ba29c0f4747cda

SHA512
69fc993caa45174be9da8cbf64e799c425d02a1af56a3d8c9b34d2eba13e5a481a25e1c14626c8d025279df72ca70bb3103d5c7caa0441c6763a83d9d0023eef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e520d5596696fb177ad3ca3c14a7bcfc

SHA1
b5bb3cf4c2bce2fcca1eb7f905cffcda094d2803

SHA256
2f5b39afc6f1b13dba724281c6ecf982df0144c5733cf6f5c8a3a1b2ff6afe3e

SHA512
b4fe1d82003918e06bbcf523a7f3844634c262b4db8ae9a7ffcdcbd5e20041b91a21824e0d3d50fa3012a1735ba319a8264954e5118ad4fbc9474614f87d3894

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e71d27c0df76ab445ab10c93337b9e4a

SHA1
86b748d3c1bd50ec3cc889d9de464229bfebfb71

SHA256
f288e5344d7ad7b1a542ee7aa5aad55432df90dbbfe5950f8d177ded2b9a3ab7

SHA512
5a4ed07f5fe47f541e5f02fc0e6b26d5f1030e8229a34ea8eed6dc5de1b0f50953834e295b6e3ef94c1ff5ff07aec8090d6aab76024fb369cfb18f1ad3fb40c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
338fc35273b684d0a857c965072513c9

SHA1
2d7886fc5fc490e54db5ed27518098752f540d3f

SHA256
cdc987d5bf39483ddf092d1f960582e5dff3025396e821587636cf7e80bf1588

SHA512
625113727062f8307929aadca84b4f8c0fee9de9941ebdd8eb9ee001738861cd6557ca600c71a24b74907bc91d87e0d84de981a4d36216ac4d211526f132134c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d63eb31b460671b09fda2b4751fd906

SHA1
c14033fa8ec1a785708ea7650e2ee76503dadf80

SHA256
c90dcd052cde3deef01e054fa884e0e72d530148f0ae178b1ab581569fb04281

SHA512
807fd06045d5f2edd7a81db8e86b98bf89f7a92a59e9dbd979b3b2de5b35aa358ff85530387402f7bf3f4bed304fb5ab2ef07a2170d6fb66a07e2f37aff347e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2c4b2fdd758d17f126f1f52a1c18a1d

SHA1
589dc9cd83c465248f56c71cc7512ed429acb5ad

SHA256
b61869730fb3f36098b249134b66c9120793804e03c0c9ee0aef39c85807bc0a

SHA512
a33b35866d7599b4dd05f1ca3c04de27291c89fc4cd77fde0309ffd8317008ae7171051bf542d48f5343d6d615371e3821fd6fa9494c178e43bd028163a2c7e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e116e6549268e3ff2a7c9966a906e87b

SHA1
9a2e1755ee5900587c02b62ff4a2dbda3934a2b7

SHA256
ab4006960e503fe88575d3a157ed712e68d598b516471f4720b3e7639c056b44

SHA512
3070a72dd56de876ff72b1a73b46a3faf8c96944e2f091caa7b6fa932d97b0823ff5d17e7922d74e248645d7148cefe6042dc0c2c5df32aa3caec39f3a92d979

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ee569d416cae09444c148ee0bd8877b

SHA1
32b9f030b963b27830856a0e9415911855fa1632

SHA256
ff697beb123257a69e1fd2241ebe68072856eb41e0ee01181c9f1e238f13cce2

SHA512
31f35ca28d060bb8ddd604b028551765ff99617ad27549f3e3be8e1fa97b998b57f14080ba5fcf7a05e47d6c6ec6e235802f7305ea6634bda3743ea9d92d377e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ef14bfda4c445a819382fe34e3d1133

SHA1
aa29a5b723cd6bf85671178df7068f455527f294

SHA256
6c757c99366bbd263eb1e1a2675e7a024788e3c6a757917b4df01f7eebe77912

SHA512
8b54a9af693e3524ca30a37fcd174153e27835d48cfc34a2ba66c60596da44bf8a44af4367ec8a86b78c5bdfd50b47e5a2c82eb970e6b6ec12240fdc245f1415

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2da0d0fb110e76c52eb2125e45be3a08

SHA1
4378b954a4f2a0031aa503cca984de9db4ed0525

SHA256
a1c5b324de99100b269289ed63d001b30fb0f5bd06689504a00a6a9a40b6cbcb

SHA512
18485bc3895f5fcaadc372883b94ce3a3bf00734cb4977794c386e3bd4d60ba6f8abb4b8e20b4200e6cba7585dfe0e563a4b28904806105c8257f088a966f2d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab907.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar959.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit