6a646c8353c334c3edb5ddf220d50128d838d5b9854fa45a03f0ddfdb604df76

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 17:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6bc39bbfce714cda7dcdb9f192b4d9d3_JaffaCakes118.html
Size

21KB
MD5

6bc39bbfce714cda7dcdb9f192b4d9d3
SHA1

76906118d003bec7a827e18de9ddf949c2183f42
SHA256

6a646c8353c334c3edb5ddf220d50128d838d5b9854fa45a03f0ddfdb604df76
SHA512

1d06e729dac9231d746755a62cb48ce19dd41f232a5334843b8ee46d098ffc74e6baa1551981289551ae4c8690125f0d8b10f07299b8d7517f848346e6ab243f
SSDEEP

384:KB3xY+miiqQnrwiYPy9BLh1KUdDY6n/IgdBzktslx+:KHY+m1vrwiY69BL1DlwgdOtslx+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422648425"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C7334C51-192C-11EF-A7A3-7A58A1FDD547} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2740	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2740	iexplore.exe
2740	iexplore.exe
1888	IEXPLORE.EXE
1888	IEXPLORE.EXE
1888	IEXPLORE.EXE
1888	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 1888	2740	iexplore.exe	28
PID 2740 wrote to memory of 1888	2740	iexplore.exe	28
PID 2740 wrote to memory of 1888	2740	iexplore.exe	28
PID 2740 wrote to memory of 1888	2740	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6bc39bbfce714cda7dcdb9f192b4d9d3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2740 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75e0b261dfd3ead69fd6a2b830a8df29

SHA1
38fe5c824564e76c01722e8ac1ee2404aacb25d3

SHA256
20b4266c5078f49d7807f081c5d551ca7dc567990c95291e7e7d712b21a7cdd2

SHA512
d2184bdd98ee7de39631beb06be62370106f210bd09dc3c1fbdfbfa2f05e6a4f45360e53e72dbd17a209882d691975cc71a989198e031da7d3233b14d1d19de2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a20cfd9a884dee982d76e85c3c85d3a5

SHA1
109e3399669e4e2fcb6678d0fb7cb16a2527bcb8

SHA256
22c063c16b4945cf86bd2fdd5b8b23cfbc016df910c0d5a9c749371dcecf413c

SHA512
58dc359814b4ee9321670f6254146f5f33432e33702b6b2c4e8d3cbbd0f307c46e722044ead42292c5fc7632793d34b494ff90af2ec139728cbda9e3e8257496

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a9ba0ff9e2e52d04f6ac37c7d9d0e6a

SHA1
4b0061d6820130cceaa714513479d0ba961a0aaf

SHA256
78f5b917fac1593f07ff1efd529e55fa7dccb4f33201159d22c449bc4a14e892

SHA512
c7ead5f9c9235a026619d9f695b065801ae322bbd9ff17f0b2d67982eb868a300b16258777450d4392a88b937d9e7d9fe538b708e3f145ff7eb97d0f715e1ae2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fdbf33280a4d9bc697fec2d5c3d2d5ca

SHA1
00056c6b1d2bf9324987e6bbe7a725c7f42e0ee3

SHA256
2a6efe16725dfb1564428da5e568446379fdfe2dd8fcdc95b83616260c42d048

SHA512
129f551fea35daa31e8979b99d96bdf6e2e11c62f5692cac3ef65808c5e5291305857321624a9ea1f17bc103bea4d35b8718936734a9d930a86bedba87a93c58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8072f9df63d2d71a12d3ea3aa3d60da0

SHA1
4a45ff6357d9e109154a81455b08bb07ddc6d9ed

SHA256
273c29ee0fb656773c18915bd1b3ecc0cf34b680691278eab45aae7cf16897d1

SHA512
18cae5edbd840b54d635f451f724fd55c45e3ea851b8389042f661b706c41aac033ac201874a0ca5e26aa97e60311566e8bed7b92bde6c7623be7537a42b7958

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7ee6ab9c58e50a37b0819cd457d96b3

SHA1
3d099aaf173c8fc430a568bd41ceec5482714647

SHA256
92b15cd7a76b2ea62e627847ae671f871dae09501fef4e72a80621748d16adf7

SHA512
7f09c4e7e03adfbf8c727fd92703b1fbc20b38b669bfafd0a46d3dccbc9f8bbd005a599f026b06cbee9b1b1c38eff8a0b24c98072bacc1a9cdf550c98513a388

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4751a2eede3a3705f823ce7a542df16b

SHA1
3017c44d3d0088a07783e7822aebbf0ef780662f

SHA256
11dad73a4aa8743f43ac92e0461daa3706a1ae32205efa670b86617b421c2d78

SHA512
8d286eec1184468c738d3e19dad3614295deec575023e3ed2b9e28e19e80608646ae47c5b817c1c766bdd1a039af0152e7105fe4c62ee9b19819d99f59d0bbfc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17066ce5c443a74971a23e31c06b9816

SHA1
66193cbb7aa08caff48a20488f11df9c9bb63278

SHA256
744d51c1169347d3824c2cf0f5548229389e3376e62c1b53fbacb365a3ba8d6d

SHA512
20178a5e6944a6624988707b2c9c35f48ebe446a314c3813a7f5ef767e17883dfe090bd40eb8cadbb690c3107215734e95c26ee1b31e20e9318eaf7978d00407

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75d4a16db93387114911f4d6a0a2c759

SHA1
2da1a6ded986a17ccfe25dbe94ab155606929973

SHA256
a5ed30c1e963bb3b3ae97d3b47538ca277377a0206937bd881be73cc08fdc2d6

SHA512
fe61a9a01894f19bb9cbaa38239c9bd92f3c3f92a2dbc6620d23c5c0e09902d73ddbe79a30c0f78dff35d875010e16a8f0a70886daac45b6b527cf2b7b5aff8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88da931341123d38e7791df3f820f36c

SHA1
430a6cc217e3e92d291a871f6af2d858809963bc

SHA256
2dfff7568c22b7990612c7a73fee160512e5e18641c836de9f361620fc9064f0

SHA512
d2e12832206edd05e1045003cdd78fb9a1df586d9d264fd3a42ef9f95cc418b7c6a177b41a9853f42f52b3907f1cfd9ab3843f6b4562cd2b366d72a7b0c65183

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
afc3ce08b4e9875a672a3f6559362ac4

SHA1
ad74b994d7cb683a5d6d495005def089c29aff22

SHA256
c19f0d8e918d80c5633db6f83210989b6aaa97073dcdfc6bf5c0fdfdd34fc22a

SHA512
caa2411e2370990ba84791cd7f1248b3b1d63e0482a4fecc886067bbdb9cac116056e7b0ae6329f5521c0af9448a5f26608fff83188d479b9a952e54881745a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ce7044c37092f8c337aa4a256e083fe

SHA1
26fc645fc2a087562ce58f0104cb736a29a6347a

SHA256
2d9ea335091d8757985148c66bf34804929b69a449fb0306e59b7e164c02b328

SHA512
d7c87234b22ca5f6ceadcd5e6b0719c31f1874c8e569eeb3ef8aaa3e80134980a4cf89d622f80764910b38ea48ae28bf6387e38334a71f58cb6cb0fe43a30115

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF7C.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFFD.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit