2ff8e7146f31d3952c313aa7af8877c999495467ae37b57c8a258b908e00df3b

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 22:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6c87ad4ac638e3749d53c34ec078da93_JaffaCakes118.html
Size

42KB
MD5

6c87ad4ac638e3749d53c34ec078da93
SHA1

b6a6f716b223647c7bfba8b60d4c1d6233253fbd
SHA256

2ff8e7146f31d3952c313aa7af8877c999495467ae37b57c8a258b908e00df3b
SHA512

6b274a1edabf071faa3dcebfd1848d1e6dfa1d20ff8d5c58a9d0ef52fa4c4ce85d0f22468e2063ebb1bbb414a16eef2da0b12c578bce8d0f09bf3cecf707dc7c
SSDEEP

384:PQ/I1x9pHJ602T7djCrh+kaYc0nm0ZKwTMnMv7z2CNxN:yydmyi0D

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422666705"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{56F5B0B1-1957-11EF-AE43-7A4B76010719} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1852	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1852	iexplore.exe
1852	iexplore.exe
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 2780	1852	iexplore.exe	28
PID 1852 wrote to memory of 2780	1852	iexplore.exe	28
PID 1852 wrote to memory of 2780	1852	iexplore.exe	28
PID 1852 wrote to memory of 2780	1852	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6c87ad4ac638e3749d53c34ec078da93_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1852 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ec495c600a62694cbc5c5d60bcd6580

SHA1
7231e4ebb25eb377807c22e51e26a1046d1ce2e8

SHA256
b53bf1c5d1b1c6f965de1ce44662eca16c4f7aec5f04d7bc869a67973d46f77e

SHA512
3da9b1f9cf48553e49c73cf3c48fce2dac32196c31e96ecc8b4e99f7d42ca59dee3247fd04ef1dd8b1cc71994d24ff346bb002a53a621080548cc842f27399a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b1383178c4cecbcc9a3eede8880f0ecf

SHA1
b1246873cf9f7e07028a4ec76979fb8004cb53db

SHA256
5b0c1366193ef87324f5e57f764b5c1ed509fed5a18243e90e132621bd59e62f

SHA512
7b4a8c071801717831b01d701e897e2a24509a22452666caa0e149592d8b49b4d7448c91bebee4999f13cd5ddbf5bfba090a7332aa8f97ca1fd09d36d7ce1f3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
61f7b43c68402f2835f9b0e62e0664c8

SHA1
19ae63149f3df40178fa989a4aa352471ff9abba

SHA256
36c86dd8e090f22f7e98781613f3f2a0a0f90d16da96da8115b79303953d110d

SHA512
aafd8c646de2ad5aaffccf4e9d3f05ca91b1829936ca416e298afd772dc479bf868c77959f29ca1a6d597b1bca921f408002f8e45dd9464e1e25b9f2d0d38fc3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58120b236213d50e84acc2b49822e289

SHA1
8d59de4c7b5983932975b737da6c5817d5d65824

SHA256
772c14b345723c32b027dce45ae62ae4fdf417090c54f86f6a95c661c28c685b

SHA512
05958cdcedeff202e9e5dd868ec38652eac1bbd3303ba21374661eac7a5ece80b639fcd11e976a7c3c08d99d99cae11f182cdca9aade99928e30bc8df81609ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49ba2bb8838bcfa967d41288cba6bdc2

SHA1
1dfe41c29823cedf45d33e17e7d1a8774ed447cb

SHA256
08c3a37fae03a6caa0cc9509727d9efbbc78b3c82ef633fd47304c4ae1e77aca

SHA512
ece8458e74c2ed9a6871fb52cdfe3cd5ded5bfe543b00904eb955b97e79301b794022387ce530dfd778f6edc01fb56084a9106035e63468095d1866914dc2138

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83c22dcbf0584a7677491e727eee3765

SHA1
cedb5938cf3774f4f106b207a7769b371d180917

SHA256
9224e0ad4feff5957ba5b1e7d0efb17e605260a94c124c1fb43e7374802d7528

SHA512
319730f75e4d738beb73c65198429bcf78d3581fd1eb4d35653c7089d750b129b6468c13bc545a48f39fcde2addc663939b4744755e8ccc220d60af80beec431

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15d29e1dbba86306b1e0215f720d92a9

SHA1
28faae455d0c1c8c9a60398f094d181f47116d77

SHA256
c0436781c852c31379846a960ec79476d2aef3faa26917ce28843948e3a43387

SHA512
8858071bbc90caf59b1dc4475cf936eb08f4ba8e957d8f402bb85bbf1e828104b47c09a8a5db55c30b5d25e5ac61b14dc187c21a3650081e06e4df30f4d6d910

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
97845aecaf95fad4ffbc734bdc579502

SHA1
36607a20eb80d41e2f28fe0d97c5aa53d8ede725

SHA256
a1567749f6a5c98d1b5c9a4b9e5678fbc088fa693b815b96bc8eea9e87e1a86a

SHA512
715a39d4110136752373e05638d3b0f5dc31455012ff60dd03b5ff2ef76f518764751069cfaff8bb7c3c50b6f1239e64dab0043a4636ed85a6d2aa678db8932c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb10dc6685e4577259029f2f52dce56e

SHA1
6a5a38c197eb2be4f75e5307b1fe7a2f4f9e570e

SHA256
d647bf5a66923f5bb72fdf4a74df876fb622edab81af27c414d9eb8a946bcdfd

SHA512
6e21031b18ab61b18f90c8d6f6d2c39c56d8efc41f98ba34c6766f5e6cda8e217277759a5fc322ce2c9be6c0bba0096ede56d09eaa532779e1a1ae7a224d97c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1A46.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1AB7.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit