823c7bb24374becd2cab40ac438ee8b768977ed95e1fa916543ffd1acd26c7ad

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 18:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6bf239ff107b65b3eab2b0ed486222cf_JaffaCakes118.html
Size

23KB
MD5

6bf239ff107b65b3eab2b0ed486222cf
SHA1

ef7b05025097a323a98c6ee38dfaee543685a21a
SHA256

823c7bb24374becd2cab40ac438ee8b768977ed95e1fa916543ffd1acd26c7ad
SHA512

d323834741743fd57acdf5f9bbb51bf999ac7d7fac82af9f169bae3d1cafe80b8402c157cb4956059f5962e8bbdbb44b71fa52cc210773de2f14fe1b2e58fec4
SSDEEP

192:uWfQb5nl+nQjxn5Q/EnQie3NnPnQOkEntMqnQTbnBnQlCnQtHwMBXqnYnQ7tnEYd:wQ/xBu3

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422652509"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4972B7B1-1936-11EF-BE4D-CE57F181EBEB} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2036	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2036	iexplore.exe
2036	iexplore.exe
1752	IEXPLORE.EXE
1752	IEXPLORE.EXE
1752	IEXPLORE.EXE
1752	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 1752	2036	iexplore.exe	28
PID 2036 wrote to memory of 1752	2036	iexplore.exe	28
PID 2036 wrote to memory of 1752	2036	iexplore.exe	28
PID 2036 wrote to memory of 1752	2036	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6bf239ff107b65b3eab2b0ed486222cf_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2036 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
87b4119ccd82f6f5226680d005ddf77c

SHA1
871b7faf2b6f44efaa68b6e4bd217dd1359723cc

SHA256
367033ca03ac212ae8bbd4a026093042f882e455f62c467304d6613550050bb9

SHA512
ae2cb46f9d7c13e33b6d7568ded26b4a7f02689eb7ca03aaf53bc9edb579f05dae6dc1671ef1f6742d8e8be94f52e2d20d4ef4992f95f33f351b058aedc7e435

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36d0d457d3350b9e06bceb109b0e2ca9

SHA1
16e387e8ab53a0470a0968369e9b6033361714ef

SHA256
17fab1a7622c1af4271a511f1461804d37f120ae50aff629b51148bf808dde9c

SHA512
c285f4b02d7efa3f59a2b499652023829aa4f2bd55585a7d5455594190405f241cef93bef958ed6c2b40c81984ce0ba64782d4b44b35fc83d9692e509c603a32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2104a987d59ac007804f6975c390b6d9

SHA1
b60f47c84e626df180d8a2a3c218bf137307553f

SHA256
30275d581bcc331d4af7a3e0512e0a52267aefe74d5609ddb9a3cf260e1f3fa8

SHA512
9747f47ac7229e0234b531efbfb42d591c41e1a8ee61fb027f16b7cd7d9f6633272450d24d45aa3601af1daeca2472d15824539d83e76233e5cfb132735e85d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b407abb492c393608c114e7ee881aa53

SHA1
a09a7ca8b24dcb154700d48426e804ed7b404955

SHA256
5f8a752fd52d258d27578b2a5df9b5bd8fc71a75d4c271803cb737df13261af3

SHA512
4d5417c3bd1488b97b6adf12664422ef06e2715a7e8a9491c62f64ca8531e2295746eec4b723d52e6bdbc2ab0e4028696d27afef9ef77a11e005aefaa241d378

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e85040927408256c51c61de18bf39900

SHA1
a89457143f2fd7fac5a1ec479478c0960347a453

SHA256
f62d0c4b649ac6f007298465539ae55c5ed071207474d80d23dea5aeb0080142

SHA512
11f5a4d533f2e31d3dd5ae430fa58f9abfb528a7c449b945d74c54aee57947ce0fe62db7eb92330387ada3885931170edc40a545ec09c3d251f2a1d995d8167c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
efed8862be90b461492e34c691a9805b

SHA1
ce18b6a4f480bf1f455af9305304fc1e1c79666f

SHA256
88d583f491a78a3c9269047019d74593fbea5aaf28a0bcd1490538c593c9ed6e

SHA512
1f9b2340b0bd1659ce5735914f29ff7d689152a860cae2ceba44d5810da90551bfb74f0d60262fd815df4462707059eac11a7163cdf09f362cb16976e80c2c69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75a5be22ff6366e07003470f4d000168

SHA1
38b35d298ebd994a0b5d3533d48a8714d943fec6

SHA256
63d31ba0fe3e4401cf007eccb17b8edcfcf42c2d670e9a17859aad41002a517a

SHA512
a721fe48e0ad7604491da87e22f09fedf4e73332044d16a0ef18eadd1b8153a05ea8ac22229bdeec7ceba792e1c2a5fd056dd62e6520784aa4c20ff4c4a907ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21c8ded0c6e7b21579afabd8beed6d18

SHA1
e7ec3782b26633e20d213872d2a0e2ec48d2c92d

SHA256
0b66cc3b9b8f173930621658f71ebb679e86ddabc1aed01561ef440c5ed9a917

SHA512
85c35fcb94d70b434321b7e2c0886e73753c6f6f36bef56bf6d7b77db9b4a8c77dcfb53ded1ca6419448bd1aad6227e614af3f8bcf7d4e25e0336fe54a554f6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f64cf5c49328a29cd7dc19c21b420fb

SHA1
b36e6e266a7ba8960ab29d27525efea9adf47f59

SHA256
1a26a5d46394e375548aa4dccb78008c888704d687c38bf5411cf6f4441df95d

SHA512
ed16f1742a1f5a65fad3ad5e92f256c49c97eb861d0513a4a6c4526c537473e004058b0a0c0ac355fedb2725f630d13adf31568dee5645c77883d121b638be35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0bb1183fceb3aae2a5149a3e505b792c

SHA1
25265b1376be40b3d91a36c72c5422d7eac334ec

SHA256
46f39cb25a1041dfda72b1c890d517d44616c571c05ec565f5e4eca1169a4251

SHA512
472c49ac585cd0eb3ee6af3eea9e5c3093c77e334497944e203f2c341d7c4aa8ba80d3d2f3532bddc522967aff7418024c2f1ce6f44b1fb2ed72568cc83f17a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3cd588db918a8ac01ecb828b6ab42ef7

SHA1
8ea1b95ccd5c873a4d8865355a0ff4b897f66927

SHA256
d3a86600e28e93eae56dea1a724c6c14bed01a8f150b6bdee23e200bbf919569

SHA512
630ed77320762d064d777dd2f04073684e14e19a83940cdb7c57adedb0d7e441fb92bc097911bfc3b49f3c04cf1c856b3bb42372c7fddda1af3d15d8e9da9253

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1D24.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1D84.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit