0124765cf01bf53762bfe686e74a229a6a8be1e44082340c7db9f9fc7ad88920

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 10:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6a92c4307cb4a1c83fc1b2c9da4681ec_JaffaCakes118.html
Size

27KB
MD5

6a92c4307cb4a1c83fc1b2c9da4681ec
SHA1

25a57a9f876bee4e644f9ec5617e75c3e54c35e4
SHA256

0124765cf01bf53762bfe686e74a229a6a8be1e44082340c7db9f9fc7ad88920
SHA512

9593881443793f3f460f611a5ac683c33bbad37bcd59065907609fa4de3f75fc88449159c8d05447519e11ff89fff1277f8c1bc8b9fa17cb4abd77670042a584
SSDEEP

192:uwLUb5nGtknQjxn5Q/BnQie0NnDnQOkEntPznQTbnxnQ9ei4m601waQl7MBUqnY2:hpQ/RfgSw9Se5O

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422620287"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{431324E1-18EB-11EF-A965-CAFA5A0A62FD} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2868	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2868	iexplore.exe
2868	iexplore.exe
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2080	2868	iexplore.exe	28
PID 2868 wrote to memory of 2080	2868	iexplore.exe	28
PID 2868 wrote to memory of 2080	2868	iexplore.exe	28
PID 2868 wrote to memory of 2080	2868	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6a92c4307cb4a1c83fc1b2c9da4681ec_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2868 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ebd292bb30c49e984d0f32f36c25a9b7

SHA1
8ac5f8b4496fc9ffd7d4f82940d2a5295e8fe047

SHA256
0326ed51565eb8b965e0a5217ae66ff456bd9e701d4b60dbddaba587b060efee

SHA512
9a5f0eca1e857098db17f3c4319bb2f8ac7018836275550433f70f5befabb1da4822471be22431faf53e9090b9be772daed4d812eeae7b6784b5f9289784dcde

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
418758775bb14f9d8524a03b1f452989

SHA1
cd53417795b1059e060fa59aa616cdeef58e3802

SHA256
b11b5ab72947d1a0115da10c187fae3f28ecaa31537954a51152b1d98962cde8

SHA512
fbb2cd8222e4935627f870ec51d32d63088dc2196b37fffa064e2b2cb9e037248c782a5021e0786bb4c381406c2eb5554d3b4867fd44a664d04ee7270afadb2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ac68560d21f0043eb3a45563520fe78

SHA1
0517de66e3f296ff5ab7d108f06ca02d2e0f4dbf

SHA256
f30f477a108dce5e4c5feb505cc3d95226394db430dbeaa0906bed180994dd46

SHA512
1934e832c2889d173ef8b4f66d6acc3c7259c9db5edce506ba69cc28e76d739cc87d9d374dd811af89c8213d21398a899bfb77218d93604a137a8fd9aab67ff8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b91c6e49cb9f4206edd9332a36aec6bd

SHA1
884afed55d883a4b727f9a78718faca9f4aabe79

SHA256
7ad814b88d973cf2a0415c256ffebbe6685f304c089579c6899d17275ab316f9

SHA512
e90c37c40b90b9547d433553b66b15f44376e0e6a74074e21fdf41803a06ffafc2301dba5ca8ed39eba66a5a4bd82bc60eb6c7c605f91b6eba7ff5099152c027

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7b0762850397d99842da4a6a1a2b232

SHA1
73efdfce00d2cfe246736232744dc554fac7a8c0

SHA256
fc1909039f9584ba186190095a8c3494cedef4da3154f180aff442b229f8d551

SHA512
1a5673cf904effb337ac6849dac8b029d2e608ede0df3565e69519b049e246f67f6c181815d527ee3f5eac044f87ea0070cfda49ee8e7112f4a98fc297a7f4b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c37df49a52615a5a154eed6d2aa978f7

SHA1
22ec17207690cb1445be1c659191670950d8a8ab

SHA256
bee91fcad631caa26c649c6ec25e229963867a7a74a06bb442ffa517398d1fc1

SHA512
fc74d6f2f85631895c32911cbbca07c4174ba2a6bea1e0c5fa46ca86170863da0d4954eb12d056363f81bf48e438c2958f82fbc6606cdec33cefc5f52aca27d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
309fb90bdfbb6149abb3b9ab32f58606

SHA1
569e5b392bbb0e6e1d7f2ce3212253c373411603

SHA256
80a497e534411a7c4443ff22df5a03503f25b72fcc8aa840d96ce363b3938af4

SHA512
bb4e74d10cc323ca8f6be3516874c69c2a0a356f3f708598f2e5e60470a9dc0aba06f32d9f4679672765b68d0060f4e69847fe1bb845f5cf1e98d075d635ffed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
410ad6cbc852670ecbd95595e7f04208

SHA1
808f3c3478b8c8729f270e47d2ecf96660076e20

SHA256
825d82dfc08d8121f3dcce51d3761de79619164be476a5b7053963b1b832c14d

SHA512
bc3278607515bdf887c6574aa6158cdc093de120417f257d02f5dd79762eb2f12996b97cab8380be77491cda64cf718b2386e86575c3a8fa5209650c31c908da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b37ee316656a20c161f50ef469313b5f

SHA1
e366d090158fe79666277a6a3d1bc420fd1c01a9

SHA256
764c8f7d61f19bc88afb1d630610abc9dfd5f5288327bcabcb0bb76334b7b908

SHA512
04cc47f6525719cf834dfb2c3f584e81ff84f49d0d6a85c377ed828fd05b6c8023cf4ea16d631a23de5a8b2e390cda15b70c19c69c39a3a983f6d6af349beed9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab17D6.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar18C7.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit