05d325034f48099e0473e37b7e49e4096f7f6bfcbab394a11e7da38835622f77

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 06:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6a0d14547313b6672529c9d7e828a5c4_JaffaCakes118.html
Size

15KB
MD5

6a0d14547313b6672529c9d7e828a5c4
SHA1

37ddb99a62c83e3c9dbf053c529ea028c6d15b0e
SHA256

05d325034f48099e0473e37b7e49e4096f7f6bfcbab394a11e7da38835622f77
SHA512

533d8c98ccc3ad69c3e0d3c942aad53aba2a4bd6ba27942700e7d98a6a6a7f6f177987df5a0d17989237d9bbb3476f48889dfcd03784ba5e33c5684b2b0e059e
SSDEEP

384:SzHAe/o5DTBSH4PbrzXQuK/XUhIzkMLFIzucD5oWdCfu:S2VSH4Pb3KtBclCfu

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{843F6721-18CE-11EF-BD10-4A4F109F65B0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422607941"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1948	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1948	iexplore.exe
1948	iexplore.exe
2664	IEXPLORE.EXE
2664	IEXPLORE.EXE
2664	IEXPLORE.EXE
2664	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 2664	1948	iexplore.exe	28
PID 1948 wrote to memory of 2664	1948	iexplore.exe	28
PID 1948 wrote to memory of 2664	1948	iexplore.exe	28
PID 1948 wrote to memory of 2664	1948	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6a0d14547313b6672529c9d7e828a5c4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1948 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
775e27ec160c8d551d0f89fae6fac523

SHA1
7626eecefb2825cdbfe9c64493cfbae16cf19940

SHA256
117505ed0303cf4dba738adb516239b0cd8a9ae13784a67b388aaebfd2926be2

SHA512
2f929fcddf575ca061e158024e8c65cdcb0647793aa72f4ea441b2b733ceee574babd9cfa87c864cad144a502f3c75a6b3ba23d6a8b0b7098e1a18c0d127b564

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c91c93cd78d82bf5e962614bf0cdb30

SHA1
ef1327d3df11f342c90636de795046ac3ca160b6

SHA256
131e077c224e1f5252eee36c9ed02f5a50373c197bf7f6dc890faffd3b84ef82

SHA512
059aaf64af3b4019dc4b567456aafec3b2f3d190a227867c05c7617171789377e419e3dbf84dbdffaa7eb67720d1e4cbe0ddfb7299dee871cf7f1b1a835b5f98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea26b742268feca579eda855f8afc6cd

SHA1
c6159b5d087eb8ed7f011bf807613cdc0f2fc4b9

SHA256
9d6057dad5825c77340f5b70cc567bc246560545781df8e26495ba9976a92c8f

SHA512
55f8b6d46fe2482e4a07c20933c60d31b91f9e0d4731410ac75e020d9b8da8ad123e51067bb3a8796e8d2544c71a131b8358df41f0b77bf5956467fd0b31cdff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c9a145e725700639013f42533b7e678

SHA1
0ba67e6cd7493615de3c48abf44fd6782a8a44f7

SHA256
c850e8b8c32485b492ce25516e04b5165e3ba9ce34e96f1543aa8dbf7570cfac

SHA512
34d42ce7b1c87f48a454a310bbfbc1e0978c09bb30c104643c25cd90431776430d57c8b5bde42a3bf6420a14b3551e6bb9595a76dc19955107e753c3463fced5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d11559098a120929355cd91b8d51afb

SHA1
b8745704748ff1cb109a27be2d63e564e00f130a

SHA256
9610528042abaefcb07d4013824d836a034d8587fec45bdb59bbfad80bc1e799

SHA512
f21caa10a2be5698d4c12b2e89770b7f5d273b3a866a90f08b726b544c6d797fe9876d924c602a51e71612c6b602f2d5ee79811b8d9934fed5ad014910bea866

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9cf6339adc1ff86b7c7c0802810cc2e0

SHA1
f790bba8af6fce8cc84b4ff378f6cded79709e4f

SHA256
20b7c598c9a9a3980439320d848ea62e7ec8c61d46ac622c489b040d3f74ab3c

SHA512
3e1938878156bd1ce0f6ab35e98293c16f41d1ed3678eeda30bc8205d4b9a5c2b3635a06202d3e72dbc746115ced1ee7f3b643200d6999c6cfe268d41f04c766

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
323f16acc1d3d0cf3752b4c7ac506664

SHA1
5adb895aac2791098b23b06a9a103bd703dc89f1

SHA256
6d5a8232ab35cc81e07de3f2b9523f8dfde1ab874b7e0efbae84af46ddcb36f9

SHA512
e533cadac88c0c7d4e2286e1d3aebeaf78d229eab67234a85dc2b21b99341293811a4b79d98d4a6a03e48fe7cf376f8328ae8d426e4487c8850f8ac2da9124ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb02160d4d31e39c25248771ef5b21e3

SHA1
57d93e776d1369759f25e33216219c73262d9099

SHA256
4010c8e1963ef57be98e2dc0444254872da46f32496d68b93a98064b731603c9

SHA512
b26a46953155ed409fbc1ac90bf7966435a816a2fc5b0f80001bd809d6a1ed93b65de9bfcd7e191964b810639590fac799642466949dbfca1b5f1734580e5b00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a066823896ec6e85b340d92e000ab9a2

SHA1
1f53247131bb07b9a7aceaef98415d13257eb50a

SHA256
9015a3bc848d7354b9d1872165322766af3e54d8538dda16d7f626867a6a1ca7

SHA512
55819b74266d75a65163bd4bcc09b2d03ef8a68d054b59eabb52bba14c85fc48eae33b5bf489a34dcbcda69fbffe25870d8ea35838e9567f4cad792db5d46235

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab115F.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar12A0.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit