b5bdc1233d9a0998269915c8b6b1b5286896bb008b97d43f32dfc97d521e3757

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 08:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6a4b2d4bd1abc484b45c934b4a3a93a2_JaffaCakes118.html
Size

60KB
MD5

6a4b2d4bd1abc484b45c934b4a3a93a2
SHA1

33643810304466c46855f32fa423367bed93904f
SHA256

b5bdc1233d9a0998269915c8b6b1b5286896bb008b97d43f32dfc97d521e3757
SHA512

ca5e517ed4fbbd0c12522d84d6955d1a4589e0f252d2a14e7d6c7b65a4ea25148f475477cfbe910834a6ad72489bc8c32ac195ee904f258578d3a372b068ee80
SSDEEP

1536:CsQIwxcYsag9X/KLnwaH0yC+HV5uUWl4ASkeyueySe3yS5eyTeyieyIehDeS8J1o:P8cnvKcaUL+19RJ1Px15Btu

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{95E40D71-18DB-11EF-B804-569FD5A164C1} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422613554"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2308	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2308	iexplore.exe
2308	iexplore.exe
1728	IEXPLORE.EXE
1728	IEXPLORE.EXE
1728	IEXPLORE.EXE
1728	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 1728	2308	iexplore.exe	28
PID 2308 wrote to memory of 1728	2308	iexplore.exe	28
PID 2308 wrote to memory of 1728	2308	iexplore.exe	28
PID 2308 wrote to memory of 1728	2308	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6a4b2d4bd1abc484b45c934b4a3a93a2_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2308 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0393900974c57b46bfd8ebb836ebd8cb

SHA1
fb94f07acbf15ae11fc2e7e6e4c432c868cdcdc4

SHA256
8e690e628ab98f8a5966ab4578bbf22f2c6c0efa03700ad3350278cb2e26fb68

SHA512
625c90dd445d583eb03b29f78577762d1c49480a248f9f4bcf50dec5c06da27a85118c7a402ab6f018f0006f32e8a3f07dcce0d653375a20a4712958c9f7bf66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cef64854d723d2e50869ec1d023a7a15

SHA1
895905bbd41648307d24381b3e5d7a7dde9032ad

SHA256
977277b07b73a12bb4db679f99e129e1e471a5dca3957caffff04757148239b1

SHA512
7e78882187514e6cbf14bf01431a4f151bf3cc6c1d88d74d49d3abf1aff2628d0a272f403b16167e1723dbfa2687d35cc820587be8f987db6462c7f3a52eb8c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c95629ce8dc366bb6f698a545d80406f

SHA1
ff684bfb0d975cf90e6394e43f0a96c661faa99c

SHA256
a9716362d7291c3591b701ecc444c3c840b28b37731b0d0119ca6113b9189fba

SHA512
18b83d7409cc254a5ab03f988850651793e6b5df38e9c6cec56173f8ee67f56b9cabadd1de54a126c54bd466e6e302ebfc61141156509d180e70545df1000a56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
254adad8f9800bd592fa3001dc926c7e

SHA1
f6e6748b26223d2ff9585f6c703891fb4d9c2810

SHA256
a62d368c9639b6f5bf3abc1970c93763d2ba435df226572b53a25cd62d3d560e

SHA512
2e5f68ad139a6354bd5804a935a13b62fe1d629939b4ee8540f7c9ebf6caf483cebe28769a0be97e6fdce0086d8c9cd5d7a2aca0eeacb85f0ce5d58cd2f89a12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
994dab493366c9d573f33021e22ede46

SHA1
b72eeb90258872b57e9513602af05d06447f03cf

SHA256
c7b184533ef5bbf9cf664ee1b85b60e1c420c8c763476eda2b949601ac3dacbf

SHA512
2531082167827615743c94ef447a50498ae03a37354c473eac94fbbc599b67382ebbec237dee42d29f937acc6445b7f61bd0cbba40f077fc14aa86a94352cd93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86913bbd5e8a100912f0210af2de3544

SHA1
3e5b7bdf91560e8db9b65eb84e05011e73884f98

SHA256
a2a734c27a8360b06d9d1b84a904167b816ec9bff7a44908b0a481b08f151243

SHA512
2ce058ae182ad3396caf7600f0fde4db2f80e61fbf977c8d844ebf0c0b5857c7ba70c315f1cfe2effba8ea7c1b6d443e6996d380caaf6c0f914b89eac0c044b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a621912a301139c3514128054b1c8988

SHA1
7b087b074b3febb88e03329674968cc7cc6a48d3

SHA256
9120d014b48e366de51aa1f0063c0ec10c84ab45af102cb2815a0720cc08ce5a

SHA512
f8a842eca4c84ef436aea329476747731fca1513321ae0cd410cd54aa51c49b47319dcacce1da4c689e23f147029f146ef327fdfe1beb4a8c8741ff193de5951

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22da37adf8b0b549514fee4558b51bbd

SHA1
6419518d4e1bbd07bc9dc6d39733a973067ab2d7

SHA256
b801e90f3c159fdb0f6e0609337454593990cfa62c8a4b8c6b9a309eda6446a9

SHA512
982d8142fb1428d790d759642f7be60a7807899808b61f49c1103aad6ae9eae20218bd4a13cf364e55665a0be32927f4b809975df5c691052d4026da665dce6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e73c2203250319580ed9ad931f48a4ba

SHA1
e0882db397a08a01f3a62c5fffad9508cc315c62

SHA256
34cfbb424036c30d8fb1b0c073705e72cd52ca44eb050a3893ceec964f53bf7d

SHA512
ba6a2a97101bf4c586b90f0d4ee980c4538af6ec6dca58209db15f49eb0ac776cdd348650e5d9957f80b5d365e0d74cfaf1d5a6544a5cfbffdd3ad3b8c93eb4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2230.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2343.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit