c1a571cea787eba4ade3537ab41bcfcc803264df3bdbab02a2f033951d4be26b

Analysis

max time kernel
150s
max time network
156s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 14:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6b2d12a681ba0e682852540f0a5e0393_JaffaCakes118.html
Size

22KB
MD5

6b2d12a681ba0e682852540f0a5e0393
SHA1

9cca344a0c061198ea91a257df982e8cad4f723d
SHA256

c1a571cea787eba4ade3537ab41bcfcc803264df3bdbab02a2f033951d4be26b
SHA512

cb7b83df4a20d8fffe0d62ab96978018a015b4ee435f254ec7e17f859d1b30c20d874a7a967280d783390905f94dfe54e36a8ba149d2f528d23cebcc5df903d4
SSDEEP

192:uwDLb5nYz6BnQjxn5Q/SnQieJNnx6InQOkEntOwnQTbn9nQmSaxL5xHMBpqnYnQ7:6Q/nCFxqm03C

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422634888"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{412C4BD1-190D-11EF-9FA2-EA483E0BCDAF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2348	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2348	iexplore.exe
2348	iexplore.exe
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2700	2348	iexplore.exe	28
PID 2348 wrote to memory of 2700	2348	iexplore.exe	28
PID 2348 wrote to memory of 2700	2348	iexplore.exe	28
PID 2348 wrote to memory of 2700	2348	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6b2d12a681ba0e682852540f0a5e0393_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2348 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c5ac7241ac25a6b04629631aff00461

SHA1
8c15d467e337c8202468b39d037d902d73367728

SHA256
51c00ad3fef577aeff63f43a7ba129d17a57b26bdf233ab9c65f5330c50279e0

SHA512
ebed5bbd5c2d7e01e8f2ef4730ab30a592ed1bce2f81a36e26dd0b262c4acc2f87d63f7856a271a3c74e5a9c61d8f8da299ce705ea87dd9db89b430a5ae8d499

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
380d21ebfb7a9fbc9f26b80623ff9730

SHA1
55f310380d716629f45b43bbab7e59c32343a8bf

SHA256
3b6222506edd30d3f07299f33251779458188aad7ab15f7d7f250f1d9a6e3677

SHA512
b7bfe64170f1e789febc6f1624924fa05879eedee89ad5a632f9f108934babdfb1f94ad4893c1f30b1a455f28b927f8693cf2ceb0faf4387c8a618857ba35b74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6729058f5d2f586ffc9e826392ec5183

SHA1
914c50dcaa02c3a83cc9a10ce6fc74cc20e5c0f9

SHA256
0a430f9d80ce6fec283ba449b2ec659a7085781d89b1b61e3d41874dec387cea

SHA512
606b33bfe02c37adcba4c82e65f908d2dddc9c6227c4d6367793038b707f16c29a428723b971f59a4407f5a186e731667ef074d346b8aa3f20c1194c26798d6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f33c11053405a531eeb1885cfc919fa9

SHA1
61e20d137514cb26bee2e7afce8090847b467bf8

SHA256
2f17fbd5d6c852899e603dc5746790a5db48fcb9a2bb6c8995209c39ce5eee9e

SHA512
21a4ed165daf75c088b34eb6e3e3816554400a22a97e0b23400453d9e92d1b7e47d160126d9b895409e0ad08170280118153dc73bd0c93b0a438984a1bd1c1f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d479ab1c2808c7443196bdc8426651fb

SHA1
dcbe3124df3312f87bece7900dd049fc5010f505

SHA256
63d996c7be267f8e3be6b63deddc992b77ecc1f460601e1be4780f62fb5c9704

SHA512
b6a10bfc12672e318ae2437e27a77bd69aaa9a8f3dc98165d8815ab93405592632a3912b1185ef6a6128d20a5c8229a1cf1e7801c39892284d6ed0bd5b1093a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e157b7440aa274a973a637cad4b65fe7

SHA1
4b23a8750738713d5648e99ccc0a4679db1cc24d

SHA256
cbed45f8931f44d5e4304d582f9f4059e04bb566c1d2b5f6924c9cf2b6d429b2

SHA512
e3a34ea14a5603c9476a66910b770691b3519abd49581d98dc3bb45b952011e0b31616855b69c0fe6d08ad11e29734573588ac3b72f6e926bc3257bbe77fd407

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d1acb6152aee8ff0c4601e771644492

SHA1
1b4c8a79cfabd244b798b9f9fb979cdf3923f49f

SHA256
264b8484603a8d2616477c75a3cc075676a5a2b83afa4a3cfb4e83ed96c0b2bf

SHA512
cdb4b75a754992ad4cb390075cb54dfc0fcc1cc9daf469fdfcd0ae1176a72e83537f293e6effca176cafe50b8e0bfebf957cbe750c57bb50dbf6efc5801ea49c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4458c9db511d4d2eef64e49777cec0b5

SHA1
471f861b83c98ee968ed639b47ae97445fd4242c

SHA256
bb08c17cb83dcd6d7b99d358a8ed4cb2faceb9fa0c507e4ce24a733b6d14d55a

SHA512
50f2e4e24bf1381defa04d1fe772172edfbdf754280fec5dbc1ef0e5c2c48a0e342a46118302192cedace9de1fc6ccf59857aaece111c4bffbb692e46aa232aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e3d0f350afce6a88e96e67517ef5acd

SHA1
47c6bcf86a344ddafcd88616f7262452ec86bc77

SHA256
621ecbcc8c8d5e1b46edaee03e7caf601cd5d781c432a5330ea607dece07d23b

SHA512
4a471a155a64cff6d5860c4a91d5e5fe85125033e69f66bdeef73ddd5b11e9f80692a07814b7359eab9ea7f7d1e5014f3162e2963a2638cfee2f663ded4d334b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8C79.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8D7A.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit