850b876b510d9d9e6501f9e47d3134e10ba750610c2b50246207440e6f922ac3

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 18:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6bcbaa624a291d0246a9e23cd0082ddf_JaffaCakes118.html
Size

28KB
MD5

6bcbaa624a291d0246a9e23cd0082ddf
SHA1

885ff2e88d1656d322cd1e300ab870d69dbabad5
SHA256

850b876b510d9d9e6501f9e47d3134e10ba750610c2b50246207440e6f922ac3
SHA512

c391050ddda993c7e51ff4ff462476b764e4b463b253561be1aeb74aa959e8a54f96d9853c32e68adc60712e29dfa87d51aa2c103d0d6d86f75a549367da8765
SSDEEP

192:uw/Qb5nOBQqnQjxn5Q/QnQiebNnCnQOkEntYOnQTbnZnQ9eHrm63fLWkRQl7MB7K:eQ/wu9vLWpSGrL

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422649253"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B2E9C6F1-192E-11EF-9201-6EAD7206CC74} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1524	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1524	iexplore.exe
1524	iexplore.exe
2940	IEXPLORE.EXE
2940	IEXPLORE.EXE
2940	IEXPLORE.EXE
2940	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1524 wrote to memory of 2940	1524	iexplore.exe	28
PID 1524 wrote to memory of 2940	1524	iexplore.exe	28
PID 1524 wrote to memory of 2940	1524	iexplore.exe	28
PID 1524 wrote to memory of 2940	1524	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6bcbaa624a291d0246a9e23cd0082ddf_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1524 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7a081e6d67c86c9b4572ed728995131

SHA1
cf68fe21fb2739eab5aa98f2900072b17ac089f0

SHA256
e727f44400110d83ed1b04120c1f04d9aea99fdb7852edf8c4603df2f9072272

SHA512
cc2dc5134ff45353c6df5bae7d57e29111a165861a7602a2b1a7d706a6934261ae2b4d07e1e0beed53a3a9f2012159ac0a9741608d040be4fb0d25ee70e2633d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
48bcc93e86d133d5fbd0e4604c38ef32

SHA1
ca55571e8ebaad8e5aee1e48cd25c5b6ffcd0db2

SHA256
1415b32a1b60cadd6d7d4511fabed47e96098ffb3c1037e6e089ae9f3dc0436e

SHA512
f234b84a6dc9e9fe01d2db7964f910de61ff56936e74a819fdc44991397234a156901941ee070f8e004c0e00326b0d0b0532f45bc27c332885ea1a41b09a98e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7becd77c84433b53b0d26f195445a149

SHA1
ca8768caed042061e18a6d56f024471598e55a7f

SHA256
a96482597e28eee7dcd61997d87a87a4f14d3e91775abea83f6c4a043a99b671

SHA512
8e3eb27ac4efc98f35e49a660ba745cfa219b0f9966c90d5399cff0eedbfd409b6f59c3e69b10e4aa21883e3e1469333a818fc174db6cb812fe337288baa7fb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3cb032465a9b4b6907c3b92d305f6f80

SHA1
6ab645fdc7a40238895cf3cc275b77ac2ed7f148

SHA256
b54c8c1c7ea4391b19cd33a6b2fe8ea25c1c47fb4345ea9b7492c12d5f63f3ae

SHA512
d3d426c6ae8f617a2f473882bab1b582f17c6ebd2632c8859dd0df49e297b776a9e087d726d9a4fe8f74d668e76cdfc9cc6577c3adf3cd98e0a25e3da4d54491

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4381b752530824d93e02e65707760339

SHA1
1216d39fa268eb83b2df5c7597b127f46fb2f1e3

SHA256
71a49963717013fe8bbf31cb98b674ac70403cb763a8585d2e4c172ac04f6d52

SHA512
65e86c04ab5ebdfde5afb672b810a8f77061fab2ed08cf4240b3b95d94a75aafe48608cca2d18194e890324a0c0785d6f4ccf6c6c7e627a0868ebd96e848eb82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
94017ce424d94d448e769d6cccf2aef0

SHA1
cf4a1068a6525cb3b21c4fb39c8cb6089348eb6c

SHA256
e8aae4463c355d49bc0c8a86ce64705284d8fae392426112fc7b0a99e652a469

SHA512
8cacee8d222bd743ba01f06cc2a43cb6875f63597eecf9fb046a704ddd890185f3587d28b71afd27b8b5dcd4e69f3cf71be651c147a785601ab3b0ff5d6e8268

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
548fb01e0fe939de982d9e048cf2e61b

SHA1
5461d606305242f495b31c8305a654df201f1808

SHA256
da1bd1c8507c8ba336a4fc666c5ae9d386efb1b296ebe6ce770ad6fd8c5bf250

SHA512
c76893110df80b09edd35b8f71a7c9a616c962a4e6f1372091c977a9e39eac184aed2e062eecb2b575e0585e9c71b8167f7477cd69205044bbc5a4c6f6c6b8b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
92139dc0da6057319d8aa6a718ed14ae

SHA1
7208bb94a27e3ecb775ad065b4cf2bbf36f6e7b2

SHA256
4e688ee2c39416d0a53a2f87e48e0255448b30796fae890b1167d25a105d2112

SHA512
6c2829414c287c416bf7f42b3987b5d365a92d1bb9ee0ed83ce035e2ee678dd0cdcb859a828ded1d5856e07f7ef868af36929705e965098adc0ed04cf9fd933e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab68B2.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar69D4.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit