807d8656fb6f77ac22b0953a91dbde6ef153287cabcba5566bf7a3aa3cd00822

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 13:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6b07fde1b916caae79b348dfce31cafb_JaffaCakes118.html
Size

27KB
MD5

6b07fde1b916caae79b348dfce31cafb
SHA1

cb9bd866d0c7e029e146c972cfba8bbe4a5e4e04
SHA256

807d8656fb6f77ac22b0953a91dbde6ef153287cabcba5566bf7a3aa3cd00822
SHA512

d62491ef2abe6f0f9234c45e39a07e9e2305a1735b7ad9f502cbacbb54709eab28405409a9dd481f7d3b1dbe3403e56da06a296d3b294e7260258db78d9f32ca
SSDEEP

192:uwrAb5nbynQjxn5Q/qnQieJNnjnQOkEntGwnQTbndnQ9eBtm6unTVQl7MBpqnYn2:+Q/HsXaTUSvwn

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{09DEC521-1905-11EF-B195-DEECE6B0C1A4} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422631358"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
620	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
620	iexplore.exe
620	iexplore.exe
1964	IEXPLORE.EXE
1964	IEXPLORE.EXE
1964	IEXPLORE.EXE
1964	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 620 wrote to memory of 1964	620	iexplore.exe	28
PID 620 wrote to memory of 1964	620	iexplore.exe	28
PID 620 wrote to memory of 1964	620	iexplore.exe	28
PID 620 wrote to memory of 1964	620	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6b07fde1b916caae79b348dfce31cafb_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:620
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:620 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00f8be10a114f9a7b6c168f9ab6613f1

SHA1
d6346d40730dbfb26020a1025278e7cba3daf131

SHA256
8c55b1b4ae163c48f9acaae1b0472b60b559376ac568524afd4df77c654747bd

SHA512
f02963ac9b54b5af419c2f634c43cdc2f27d5cfad51690aed347f1692779a3ef0ee1765c555c41954345216169883653ebaff2cd20fde03659319ae96d174ea0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4ad3e011175c95f1ad6818d7c48f3d0

SHA1
68aea345ecce4dd1d8c878612da77c712f5f4260

SHA256
9ad0dd9b60e99c9eadb9d09bd032091074b74481df899d580fd21bb195ff5b91

SHA512
41f2760e363b8d30bc70b9662a15589a088172b88f24b3c49ed32d592b203300ff3f8cc147392ee06734a5417a1dedd0041833edb4aa2bf3a93e6c9a26c4a990

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64d0912a68a406a9653da9386c9dca1b

SHA1
5bc75f654a43f726395007ca09f9e429ab3df827

SHA256
bbc0e4b789a77c7f2cc4305059518501da743b607fef7c24f96338322d7e9b77

SHA512
fc503fc4f02b3caef9ccb654193c196126a11219db42a461f015da42c5ebe69354bc81fc6c4591554aedb3fb2664afc2dbe635ccfca128c80aa5d9d9e970e885

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d8def93942def499f1ec6000cdd82cca

SHA1
fbfa2dfd98001edc4a919119a5e903ffcf838e8e

SHA256
806cfe8fa3839944596e8bfc92b17e46cf5bc6c8fc0d1f006a01b4f89804d370

SHA512
da331275eac4a6a4fbe6ebf9df4a31ef70621c8437b61ee9f161d0844f49b79424b911946dc976fa415678f78994c8f4e3d4aa71388c63fea74735daf0078e9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22dfedd892bc7a18473d28c1b7482fd5

SHA1
10a0ec613340fc493e6c88b8a1a6610ac4f45357

SHA256
cec515251bf2335df1b0aa3f8d0b48e78200cae18006073e8e3ae64d70488efb

SHA512
7b8170422e17103c8ed2ac106cbb32f201e53a30672bc9883a917d8e8db7115ca8d03d3c040659888849326f1680b6b2cc6a77edd63c1176406716bd592b454c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
824ff1e05d8246aa9a0ca7dae59e5f47

SHA1
b280e4489fa6748227ee96959ccce4e6c9132805

SHA256
24e331fc1cf9ae11cb0f58cea170cb7dc76ea52553f10c9ccca55f23c4a3ffd7

SHA512
52bdc50103d7bb42a35c34482d770873398ffa3d50af60a1bd6d66deec5fbf1dc03ba03b22a92e36c2a05676fe5b68449dc928d7bad281ba6c422cbb939ee3ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6cbd911dd61ac51baa50dac833b076b4

SHA1
ac7ed95bc4a5575db8a7767c6af82f42a2196481

SHA256
c3596546a1d466b93b76e5c9b1aed82a0073d4dcb817f3934372f64a8622dbfc

SHA512
920ea5ae05383478b372b4656b659714d219656e752b38a6d01a6d37cbad6ec0a1fd3981e60c8b7c7954659d396ebd76c88163d721806c20be62618cb971c157

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a4bea93baf667b7b9afa86cd2292312

SHA1
fe1c7f53633ab0348d5f533653f1185311ecb85c

SHA256
4b0de016f6c44b5b5c1676cc04d1dede1ab6e94644a322770d3aad67d84ffcbc

SHA512
472dd8db6b024f3887785644366698b9ae474e7bbba2349bcb13a117686fcac2852e3da44584450d793a5810cc1d29a10afdad85d1f893f20819e2c441f947be

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab233C.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar237D.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit