24ad73fe16a805d7eb5289ac7607d4bc9ae3fed7aba3d7c4535a3e1ca9d18115

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 09:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6a7a4294b988ca903b771d01e0c9f227_JaffaCakes118.html
Size

214KB
MD5

6a7a4294b988ca903b771d01e0c9f227
SHA1

0dafda32b00837f9186087bbb2e70d55f8946ac9
SHA256

24ad73fe16a805d7eb5289ac7607d4bc9ae3fed7aba3d7c4535a3e1ca9d18115
SHA512

2ca05b589d1e20e6e24ed519c429a104d8aaea0992655b355d77833603c869ffba7ad7c7a4aa809e3a8e04b5a581e3154fcd70384bfbe964ec07e0821a1a52e9
SSDEEP

3072:/rhB9CyHxX7Be7iAvtLPbAwuBNKifXTJM:Tz9VxLY7iAVLTBQJlM

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422618138"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{422B3F91-18E6-11EF-B804-569FD5A164C1} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2120	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2120	iexplore.exe
2120	iexplore.exe
2340	IEXPLORE.EXE
2340	IEXPLORE.EXE
2340	IEXPLORE.EXE
2340	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 2340	2120	iexplore.exe	28
PID 2120 wrote to memory of 2340	2120	iexplore.exe	28
PID 2120 wrote to memory of 2340	2120	iexplore.exe	28
PID 2120 wrote to memory of 2340	2120	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6a7a4294b988ca903b771d01e0c9f227_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2120 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4aeb46d45500b23b2cb1abab748dc62

SHA1
c5dfc46295af86263b8a658cf67a01efbad6e1d7

SHA256
2d6e8ef5fc91dd73543f6148e1ef4068048781cd52ee7acca353458ff34420a7

SHA512
854e96ed6f6a8c5b16dfbea211588b1ef9cef0effea5b9508999f7be3700cc0bff3d7f820b59996fc7ae87cbb71d12daeddc8f36a451ec846a46984cce7aec6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e41243923afc709ac2c483e916b1e1f7

SHA1
dbb79b5dfc87432b55ab7aff44631e21dda55b71

SHA256
b015f9fdd94ea857b62c06a19dbd199c4207e99246445dd61cea408fdd5c9247

SHA512
e9d6cd56114b565328959d04fb7b97b09b9d01aad2f048e2c4fae2fd14d4a7305798212a407ee5676584352aea1226c9f14fdb1e50cf4cabd3222fa1ef757015

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f36f2d865fdb5b435bf473eab3647596

SHA1
589ad03997ffe76ff6969dc14248f4f631b5b9f4

SHA256
f1bdd57d30e972ab8a2451afb0a9b7eb1ccad252a4235997237560c927762b64

SHA512
c7d1da87b924012ea1e7799a021cff40919e937651487066725003cc3973b653e6c6d2539a8c0de6301c8bd7a0d14e00819f2a258782228b5a067221365fe3a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0cc060a3ee6f1178a0f854c5d21818be

SHA1
f2ed8b9fff98d66dd949dabd69cbca049517bfbb

SHA256
88ab3ae17f6a537418db0d0e43a363e0f4a21072641e0dcbd543ee9fe225c2a5

SHA512
f5ae3d399fe488f68eed2b0c34713699dff198ed080966c0e882b9d3dc5abead29f6ab946d4992ff74d2c013079da7406a4dd1412e69ba2e84ebffde857ca961

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d082f83288d3d4460fa105b18d53bed

SHA1
e03c8426d9c8e1479c1b598741770cf6d127db1f

SHA256
b6b92e5cc2021195dc75eec90b6bfa1deb060be5c8d6f4f8ab97fa734cf5a372

SHA512
fa91445ed394f4eea3799dc31946f52f93ed2318eab9fb9aabac619179321ad30b2b4ef16ac23acb234491a559ba96bc27d6d6aa2e110fcb48b8fa403818b903

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e442a4c157552d4045e9659b056d316f

SHA1
182daeb8b575183e9319ace3431e8df6ee0e695b

SHA256
e365d36fe99a20592142c84100c5948a7f2374ec2333f0eaf9ac5200e30d93d9

SHA512
3a9601a99bf26c8e9de555d5f6ab9e00709ac957424704d3bdc1767de4e00529c0f4b630986fb6f75a8afea478e800ff4810ac21f3527e3e70d91f53c73da86e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c4c7fc445c177dcf4a892563e36bef4

SHA1
3e5da1d567611e68b3910678f26c1a170cdf821b

SHA256
ffe926c7b41829fea90139ae372fb96b8672b41c0a2b95ff60ec945d7682adb6

SHA512
711aa237f004e0c4842f5e70aa0eaef88cc6fcf9dad804b49f921b98d5be369ae05d374d2c892568107fe71e25d2702fc59a2e28b4ebc59740eb76d2cce0eb01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b869dea5b2f0f62f1bf154ed227d4ce9

SHA1
99cb18af3745a593d53137d1cec16ec018cccf1e

SHA256
1ca510638b74f3f542e531ec3d052e8b953e4335f003185c143b5346aeb0b0b3

SHA512
aefb5c5159853d70c5e1e09d4ee21eff8f5b14f7c5fd5715b7701be33ca08f7f5286c84bedbdd45983093832096da727bacb2066f60747ec48fc686cb8cbcc9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5602f80bd949f83f70ea2d34b8e7e46

SHA1
b12d2929ebe63c8536f13ad41b7d0180057fe879

SHA256
1546a047c7aa85901677ae4730975a94c50e661d641ac898bbed99b44f4318a2

SHA512
e195bb9afb8c3aa26b75c9a6b6243c637b92f62e5e20504e1d3e884c85babc59279eb3978bf30808c58e3e1325bd1a67180219d1818c53dfbad779191dbcf588

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab238A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar246B.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit