7b8101255c2860f5165560e180a69ac45646bb540c6f554df61fa5b6b30d7a23

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 19:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6c06d851d0d6875193cc8969ae4c0d3d_JaffaCakes118.html
Size

23KB
MD5

6c06d851d0d6875193cc8969ae4c0d3d
SHA1

c618152343d677e7cbe46db7042081c07661c97c
SHA256

7b8101255c2860f5165560e180a69ac45646bb540c6f554df61fa5b6b30d7a23
SHA512

e86f059377e63592633fb93b3d3ea4bc58e8fa072c22da6f8bbf96fed648a22bed2f469ef5269bc0e24d67831bd7b6412618eb765a93d2349fde6f7e0c5fcf91
SSDEEP

192:uWrcb5n/inQjxn5Q/2nQielNnanQOkEntmQnQTbnFnQvCnQtxwMBFqnYnQ7tnkYJ:KQ/Kb2

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BB590E21-193A-11EF-9966-EA483E0BCDAF} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422654419"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1644	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1644	iexplore.exe
1644	iexplore.exe
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 3016	1644	iexplore.exe	28
PID 1644 wrote to memory of 3016	1644	iexplore.exe	28
PID 1644 wrote to memory of 3016	1644	iexplore.exe	28
PID 1644 wrote to memory of 3016	1644	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6c06d851d0d6875193cc8969ae4c0d3d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1644 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c48e3929f57b7ff001e252f3d4fc8ec0

SHA1
7ac114fccab172b60741f25c6bd47bb9f8f65f16

SHA256
15489936e19e0035c6daba5a82338eec67096b3dfad779d79bff9d819e857f66

SHA512
ec6bd021532c8daa0513757f2173e1e594771c4b21fda74f6cfce8b66e68446eaaa035298fbc7dfccce138addd06ef25d0728169f0d7a37456623034079599f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c991817c7549e371aa5ecbd79dff75a

SHA1
6ab960f6098a8fb3ded12fec55d564a2e02908a9

SHA256
18123f5766b75e97d192d7af49526dc844d5a7d6b3868bf4cd3caf159d548030

SHA512
b677d29f6462cfee36b6621e5ff582cec6ff1ec54ad3ec5115a11aa35988b7f4ffa265a5788ba00d18682b663223eb592935d0ca17a93c51e48434f76e269b98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6fbc7a207683981fba9265395407301d

SHA1
d4282620d247adb520557a220d4d275df2a5d58b

SHA256
3e517af01093d764aa0aa58d8724bdfe2d8c9ccfb671f04ca7c59f4b3a2fb8f1

SHA512
bceee2d4e8d6f49ef406c4f9c392e95ca3d8f47953e54a878bfa81cfac546fdb4b655398ad802f50c1b7c5316ffdb65d3b64f5a94023dc11280579947766efb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58214d0cdb1c593d4ded8f7e11a8efa3

SHA1
8be3294c1396dce0a4ad473cc99703692603de15

SHA256
8b40a00ae9a08272d9afd4bc0a9f031dfe68251fa7dc02f98e919f8d823367dd

SHA512
d46eb280b14303e5d4aa6593e7acbfb5856da2aa648e41ddc6808d9c4ab67a3b2e6ea1b3d88e1b069673def3628af557291f8bba67c5c28d167bb979c3af5860

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a86fb92a0c0dd7dcf2c988914d8b1dee

SHA1
b1d74ce0d42ab793bd5e2fdfb953280fbfdaa454

SHA256
37633b4781092a5cca4bc80f44760610a59a8b1e2e39aff6c7606b417269ce65

SHA512
5b2c48579443fc5878af0827b7e8ad076b2bf4c977ec27177d6a576fdb4f853a4e95d7de06cd47c817c83089cd59016d8a6a6dcbcbff7017f3f596d22b13c947

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5694c36f9ef98b33757a7bb2013911d5

SHA1
2981ed9c9c99e7e4399f560e2583a15040e8a09f

SHA256
20a4f7c8a656affe77f655104e30945a9703ae6bf0eb20f88f9706827d24788f

SHA512
00b5835bb3c486b0fbd684d9b463312fd205f93d70a322d136ee4a9d97881e1286b66b4f195820c90e2448b503a077164cdb92588babf1fbfbf4e287270fb3f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ae29538a38c81d0ed0e1e9dea079048

SHA1
c4fad63d083cc367f68193b20d03421d7ac5cc4b

SHA256
bb769c2a13a2c016a85cf6a1f3d380ee5810fd0667c5bb88b4be809ec7fb5166

SHA512
2cfd5b5964aeaaf8a19c5991c219e734525f5642380cf9832be82073ec2f88a317b2cb7374ec5414a6acc2812dd8c38d1af10979119eedf5c6746fde87b6c844

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80d4eea8ab667a8c53d51dacbde0fcba

SHA1
e67d6e5a262e1b6e57af3eb13574a2cac8f81391

SHA256
67232208119af6707adcff1460d19439a737ba81a8d2472c6a90c0ae735b2bc1

SHA512
3554c18c7592fa374eb3411e20fc19952851f96ea38d2f374dde735b222075f608bd753f738a1be18821a07d47e4ce065d35b90eaf226c7bbae3538edec82bf9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df21ba6d5c760b8101e4af2ba15b2b43

SHA1
640baac3669b0fbd88c33b1546676d2b6b0d7344

SHA256
5c98d4213a49469c501e4f2169395afc3c01468b03c71ee729f02cfc79d612cb

SHA512
d4c921bbdd565a34db830ff73b4468f87c2a441329cb7daf1b9974108820e0ddaf6901fcc8bb98f749e265d670253ea167b0d039148d701bdfe9662b4b1c1841

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab23A9.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar246B.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit