ccccaa18152b5bd7003446865ba432976526887b0d188e476c16e296cde412a3

Analysis

max time kernel
148s
max time network
140s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6941dba05b95cfefdc875fc0c3959dd6_JaffaCakes118.html
Size

121KB
MD5

6941dba05b95cfefdc875fc0c3959dd6
SHA1

7a3ce237f1f5e810ba4bc8107673602b311cc9b1
SHA256

ccccaa18152b5bd7003446865ba432976526887b0d188e476c16e296cde412a3
SHA512

de100592d1d5935dd63df0e64109fdcb6297abd27955a730fbffa4e6427701f866cf6553d7eb8ca926faabe054fa7e424072d597b6085f107e344b30eec5dfc0
SSDEEP

1536:S8ausTkf0c/5jyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJruH:StzpI5jyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEiexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0A905B41-18A2-11EF-9ED8-52FE85537310} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422588839"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1720 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1720 iexplore.exe
1720 iexplore.exe
3016 IEXPLORE.EXE
3016 IEXPLORE.EXE
3016 IEXPLORE.EXE
3016 IEXPLORE.EXE

pid	process
1720	iexplore.exe

pid	process
1720	iexplore.exe
1720	iexplore.exe
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1720 wrote to memory of 3016	1720	iexplore.exe	IEXPLORE.EXE
PID 1720 wrote to memory of 3016	1720	iexplore.exe	IEXPLORE.EXE
PID 1720 wrote to memory of 3016	1720	iexplore.exe	IEXPLORE.EXE
PID 1720 wrote to memory of 3016	1720	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6941dba05b95cfefdc875fc0c3959dd6_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1720

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1720 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a7010e02df3944219dbd574f48c3c71e

SHA1
534c185300146b96013e79461ce0ae73f7febe23

SHA256
57b2df208c8f535a24687b0e3f601106ff0230500fa34092fe265471e718cae8

SHA512
1bf82fbe8231ceff9331674a1b3f5f4fe7e44dfb83791d1a54f09ce15dcce0e3593e4e7afcbd54fa48c95db0979abd4e0e6d8fb5abfef5b79d6af548963da6f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c33265d42ab32a6e8e9335f47bdbb881

SHA1
54a1ebfbcd76808d9ca20a2e446af3a895dc267e

SHA256
9cebd2594d234df91c63dd2c9d8059202466c64014a776e5550a90ccf1e13bd4

SHA512
0c75c5e1ab77e5f1c527585e1aec48857b1aa77e165c98fe18f9c772dd2b2731ab81a2547aeca926bcdf3e48e5c431af1a46e3f491e2d09fbccc5002cebdef3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
572b35370dcf2dd010e5bf22bb2edccd

SHA1
26252844bf0b79ae6a98b712c8b0b74dce46e7fd

SHA256
f283762b9cc867f8a169cba80930fc95c2dce652590bc819ff6308d447da528c

SHA512
df017bba9b7fcb4605e45868cee0a08d37aa7f551c3c712a23da16067e39a10b912f6e886cd05a8eb5b58e4f4f5a6de88ad95226e3e7dbc0b6d26c8f2e157b57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3756c30e8a422ab03f49f07f3114b934

SHA1
5a7d0ff1d513c977edc8e504ebcac5a8e69c1894

SHA256
c2de898920df5f4d899becd81485cfc30200dff0a342c9f628578a95b3eabad6

SHA512
c9f5140d127421071b7cb6d91d3f370a168afb5a4bfe5f0f3dda9c6db3a0fd8343c02f79a66c197491d5893fdbf030f8eb22d4a18398167ad5c799cf66eb1bf8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
500c3103a4316472540008d226598d9b

SHA1
af188c7fe923d858cdc5cfb3e3ce9fd207979d7a

SHA256
dbd4802ef914e6b77a261e7a22356c301d8f1041eb5ba141502637790cbbd183

SHA512
a3d7cebca822c04c821beb713980b28987e7f486d2a08f9baab1f22f1a68997f51c3aa792f21a8a42688dfe3ee86154ba2fc592bbeaa0f8246395c2bf514e5fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d25e4ad082a2d0d415d0a7673480a47a

SHA1
71b340d8f4b2118e4c5138661578403fe49dbe11

SHA256
3134e2f2ce8e1329ea87859992f09ac96b5b9e9bf678d0e86f62c404940dd61f

SHA512
3d121e8fba3df69dcb4ab740d4a864824114ee033f609ea1590f5f136e8285dc62673fd06b37e0946d282516f7bb54807e74afd20850dc8eb91b9fb2f28c39ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
099f52f10020f08aa234f3256c2e3590

SHA1
ef852af85fce299eab4a0366cb35d0338575298e

SHA256
dd09664600efc9c23b1bd43931284eb1863d57de789c6b6767ea7c2da75d9b3f

SHA512
68b6f73998cff9efbbaf3c0586f2059efd5832c31ccaa0bf8b5bae3fb1a1eb3773347cbe598b5370cad11e16f14a3e774d1d6fb78d43f83ad2b5ac85e2c10e6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
301262218084d9d39eaea01b7e0b1ecc

SHA1
ad1ad8d33b2dafe6288da4b5582fa4df2c2fdbf8

SHA256
5f0ff2f35f83fa30203b226a98f361c712c109e826330755c4a221d4075431b9

SHA512
de3088de532e95f443414f2c4da959c55605eca71011eaf3144e3cbeb2d28f16c7f8416d50457661ef0cf907aeb375220efdd422f0f208b9af9894105c296b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2483.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2593.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit