1b981e70c789293bd993287d63ae641705adb29be95b1f42bc13a4a3a5f9a687

Analysis

max time kernel
131s
max time network
147s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 16:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6b9f93251d26bb9979a59f7cfcb60bc8_JaffaCakes118.html
Size

19KB
MD5

6b9f93251d26bb9979a59f7cfcb60bc8
SHA1

da8f889e87f42c62cdffb5293ff4f18fee24f10b
SHA256

1b981e70c789293bd993287d63ae641705adb29be95b1f42bc13a4a3a5f9a687
SHA512

5bb0bb42cd619a683a153bab1d934c0c4d1d01bd045d23f1ce583a270da24bc2ec04171f15f4d81662136381c6c31cf32703e51d3a1fd038528060296e4e98c1
SSDEEP

192:uwL9b5ndlnQjxn5Q/InQiejNnenQOkEntMunQTbnRnQmSgHMBDqnYnQ5yNnlnQVB:MQ/Vq6Nn

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422645084"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FE40E6B1-1924-11EF-8D50-4A4F109F65B0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2236	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2236	iexplore.exe
2236	iexplore.exe
2392	IEXPLORE.EXE
2392	IEXPLORE.EXE
2392	IEXPLORE.EXE
2392	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2392	2236	iexplore.exe	30
PID 2236 wrote to memory of 2392	2236	iexplore.exe	30
PID 2236 wrote to memory of 2392	2236	iexplore.exe	30
PID 2236 wrote to memory of 2392	2236	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6b9f93251d26bb9979a59f7cfcb60bc8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2236 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03521fca3ec8925958e29206aa7672e6

SHA1
7780dfeb5bfa3e04517ab94cc80225d63827fa35

SHA256
0dd00e0056874179bc60291810d113c2cc2e1686ddf4e7a71b78eeb5711c977c

SHA512
a9cf9d2b59c5881c8d398c70fb3e5243bd54cf95be94ce4fb46dff4fa247837ea902992e52bb79d52783bbc15276e5a786f10ed57e35dd639ef17f9b7f4f7aa4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3fa5cf4284a8625d1fd28ca11af3ab07

SHA1
4c56e95c60f9c7b8c67e3f8a71775a81000aacf9

SHA256
5528b5b441fc7a2e2757ea8c64120c8013f710be8ba542292a21e90b2edb047f

SHA512
624f00ae26ba4e6436775db13a5d7f2868d5433d1833b3af3176c9274ff274ed1dc52c9a75df3c0d53e6ffb98e0dd1e90ab3a82cbf338d1d44dbb701f63d4ba4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42941ededd8a52d26df6da41192515d7

SHA1
abebe11d087fe8c0d65ec854de21bb9025fc6caa

SHA256
8027947e38a095a3c42dc4ce6de6d07c9d710ed428f34b2d973cf4b5517af66e

SHA512
48884c575522d1f3c219c0fc925d8b1eead69fad31618a48efe2d34d27b880962a4c5ac518660536c38fc81ad4e51593859c7b3bd25deffee26491516ae8258f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f216a0d21bf02fd1279863cda2e8276

SHA1
14ded626b8c265fc60866a399b1a57a03999b870

SHA256
05fe4792c2103a80315efd8efcbe5bb5aa11f923736c1ed5e0e36f70c0c9cdc7

SHA512
135df8a2769ca0ba4c7872a49360e3cf1b636ae8950742e8ff88eae35ddad74f61097207da4e7b622910245b1ab1038f746f2b11aa55adc08d41d0252a29da91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5587acdedb6140b4e2a486b7badd2753

SHA1
3b66f520d2c5ee7e7db058d4bad8423c5246aea9

SHA256
cb35d5d4cc7c4ec68737e68cd7c3249fbb87e8ee79289db8f5a740d7675fedd4

SHA512
98cfef59a330f0c0641bdc6ae93babb5f3ce8bc63b95910d1bae2e73319280f79a964a66ef0095b8c34bf7e1409b7212c207b6a01291fc21773696228575fee4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb7868e1aeddf3716a9f9cc91a465b42

SHA1
9d1b304c62f6e580ce2b8525936f4856d7e14a62

SHA256
97a1b266343d4c6f9fdd4e1a95e75513f8bfdfa747c727558443e6fa549345ba

SHA512
6e5f41ac4862a3281b44f7efffcc0dd9702fbe7a363a08acae4fe8d6e73d294fe4a9a5f347408b98b81dd9731179459b5417b726d92ea7a335480c66da0bd760

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e51939d5c56bcbcc395d12f8947181e

SHA1
cb83fff2c0397e805a0f3d8d98bb5a714c0d790c

SHA256
a671eac3ff0331035727db8f0b74b1d163e581168ea15c528333c053b699a595

SHA512
88cbb362c3a1a6d181094ecfb3c5b85f02734688625aae7aab8941475fcc35970377f06c0e5c2f8d64b95e8634ecd5f83316faa3e8226cce6ac8269d9852bd68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d3e508370afda4ad86c15f92f5272bf2

SHA1
3fe69953e8fa52fe658477688eff7e9c302cf716

SHA256
c18159d08397813d291dd35c7535c3081944d6141ca11dc046c69bd55bf63f35

SHA512
0ffbad7f739ce779413a58bf88326f5b0ea44fc7c4a115c5a54eb5572b68d0a4d43c0f34843c7944b0e895d508ba83c44c8c407ad3011c761a1715eaffa94f8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25f6dd0a5863ffc92b93755b7086be8b

SHA1
bfde3cba0d49904e28e30ba159dddafe2e0d834f

SHA256
73f9fbbb3b10ea4ee5a003635221c62ce1a9468fe7dbe8fa16b9009e595c7e9a

SHA512
178aed17c3da7159879c3d7a1b4c93c959f5a05289db1f0e95602791ef566063750f2c8abe463be945faa823fce361073c293a81924794be805cc0be24391b80

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5726.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5814.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5866.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit