d17a0f4e5e4912ef4a6946df7778cc8eef99a6895f82a40fcaf241aaeabf138e

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 18:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6bd90b0d5577b6358394c974497673ec_JaffaCakes118.html
Size

23KB
MD5

6bd90b0d5577b6358394c974497673ec
SHA1

a7e5493a04aa16ff1e5ff0a267caa98f4a10f2c0
SHA256

d17a0f4e5e4912ef4a6946df7778cc8eef99a6895f82a40fcaf241aaeabf138e
SHA512

40f8b829d64302013c0e4140fc5077f66e152dfdc0fc1d5c12a8f44ffc49ed95dcbf2571f0afff23c2fe2d6f15ef704715f7a235c6ac553aa8f6593c4dabe79f
SSDEEP

192:uwjAb5nmunQjxn5Q/ZnQie8NnrnQOkEntfLnQTbnRnQXGLnLnQtaqMBcqnYnQ7tl:/Q/TGHm0

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422650348"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{41669321-1931-11EF-A759-F637117826CF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2012 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2012 iexplore.exe
2012 iexplore.exe
2860 IEXPLORE.EXE
2860 IEXPLORE.EXE
2860 IEXPLORE.EXE
2860 IEXPLORE.EXE

pid	process
2012	iexplore.exe

pid	process
2012	iexplore.exe
2012	iexplore.exe
2860	IEXPLORE.EXE
2860	IEXPLORE.EXE
2860	IEXPLORE.EXE
2860	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2012 wrote to memory of 2860	2012	iexplore.exe	IEXPLORE.EXE
PID 2012 wrote to memory of 2860	2012	iexplore.exe	IEXPLORE.EXE
PID 2012 wrote to memory of 2860	2012	iexplore.exe	IEXPLORE.EXE
PID 2012 wrote to memory of 2860	2012	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6bd90b0d5577b6358394c974497673ec_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2012 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2860

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
bd2f6723bd2cfd599324d497418f74e6

SHA1
f2b8d6ad32cf8e22fd2f2b0bd242b00f85dcec96

SHA256
52cc9583b45f3f6e0f45c77e9a1a2d8a9181f7da61aca30c30830bc3bc1ad042

SHA512
2a64f01608e68cb19e4d3ef40b793039830e52c27b6556a67d62ef0383f2c5ae0543725614a299674ea768f53b3e253d412f242011ee1fa70424849441e8a41f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
eb47a67801413ace965a7e6c49c1bb8a

SHA1
bbb8bb46a988dea3c0df3d8972623a3379305972

SHA256
a818d8c3ea3f96ac35ed212804f52d7d8bb964dfe09a57e9149188a60432c754

SHA512
cdc3fc9ebc09722564d21f21463ec962e611aac68d001f5fc6a78b9db2cad00fbcf2e37db045284889665cac6293f8e8f0fa8b83b49d290b271ab379277de30e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
d38416622b4b6069beec7b37b6d85b50

SHA1
fd76a4b16ed004bad1593ddc3cd8c6b98b60bbdf

SHA256
2d542cc96e2bbfd7128a8d5182f92bb95ed57073a01f43efb778172f39ebb07e

SHA512
f355937ece02dff62e0683c730e853a45b86237b1e0ff9cbc9ac2b3a27fcbfbda50e897c1f132c65a19869d99fc4b1b872c34eb39a0f6716c2d233295a003b48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
81754484ccd237b2900e4cf58859d043

SHA1
116d184293f5520097f2d00026c2c04418fce663

SHA256
d180671889db83c96170affc212997aaf4702c74cb92e2853969ca8e46d25cb0

SHA512
af54928b46288903dc7a86c5dd80eb2a4cff5d90c91ab96cc0a657cc150bf4582d99a142ec9ddb0eb12d17f476233acbd9a3633c41bc995830a4c8fc99c461cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
a14369377f9baaeca190102a20805a80

SHA1
f1cfda23731d95884b27c6e227510cdaf7c72601

SHA256
f16c9f8d1bb2d829afc9579767a7fb9a2423de8e0e1ab4906439bc55ecfccd49

SHA512
62b395394b659d95c43edf0a243e412f2b9ab616ef9c966999a8caf2685df81727baf047ef629ae138652c41360700e2cbe4789617970020222d1af66c649213

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
1ac017412d32bdb853e86986edd03d9d

SHA1
93ff68c3cc2d1fce2ff70b9d81c09399b31a26d6

SHA256
0175bf12634e87ca2f796dce1d07e7dd99b703392400b53cbd289eb2f3d6dfb0

SHA512
59e3128b1e03ac92459aceb6d6c4d8160e5aee59f8f32520fc89c46c851f7a55809ce9be3cc057a7f2b092dfdc8b86c2ba904c66342cafcb9b03793af8b4c1a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
f161bea7155089e63d12d8fb48a4b72a

SHA1
79212e6532a51d950930f8e8f09449ebcb3a9f66

SHA256
be4e155c6d5985dab42b2fc8a6fb9c4552904bb8e28fec066a05c268c170ca35

SHA512
cc8894cdce1b3eb9b2517bea6341dbf1f228a68068a8aedcb49a36b12e0c8eb639fa8bc786df0c038c4427db0f0bb64deb0e1b8a8813dc42a36328e870129814

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
016d0e781bfe5e55c56b644e07155653

SHA1
3a291d1bdcb7424339bbcec9802c875a93b19206

SHA256
fbf581d8a4415cb79d9e36925b2330cdb8c40dfbe90ec98ece5f478ed6ae9394

SHA512
bcbeac280cc78657a7dab9d9f99ebb31e167407f617ab39e6e3f0682511ec81f7a8c7cab3b56e3b53b57989f2f0f99a635a0d93930983c2d4d1b7e1ebe3187d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
1bd01d91475addbde854bd79b52a42a5

SHA1
b8a1f1987b37805bc85a22c064813d3390514eb1

SHA256
cff21f92e8b262e3d7fcf9a32c2343c27a3b0deda80455c8e72b111efc368773

SHA512
df44e984b61edabed5362054904f0b67b2058a0b926d5977225a1115327db68d3cfc1a898f8ae44921498f9c3054ba78f830351810a14cef33f01275be1945cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC90.tmp
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCF1.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit