2083bb98fda9295c00aeb4c583730966b5385ab3bcd3222d43550814176fb091

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 20:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6c24c16786f6ebda395da9f8492eba36_JaffaCakes118.html
Size

17KB
MD5

6c24c16786f6ebda395da9f8492eba36
SHA1

f8394f22311c5c8ef09e1597166a4bcc232c05b8
SHA256

2083bb98fda9295c00aeb4c583730966b5385ab3bcd3222d43550814176fb091
SHA512

3465bf255e118e471e5c8eb1e10c34b6987042454d5e7d96985356d9dbde5899e568897ddee4b878bccc6acba2c7ce70304b8d0a2f9de24c672f9479acf22f39
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIf49zUnjBhfR82qDB8:SIMd0I5nvHtsvfaxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422657680"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{530D3871-1942-11EF-9001-CA5596DD87F4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2316	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2316	iexplore.exe
2316	iexplore.exe
2532	IEXPLORE.EXE
2532	IEXPLORE.EXE
2532	IEXPLORE.EXE
2532	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 2532	2316	iexplore.exe	28
PID 2316 wrote to memory of 2532	2316	iexplore.exe	28
PID 2316 wrote to memory of 2532	2316	iexplore.exe	28
PID 2316 wrote to memory of 2532	2316	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6c24c16786f6ebda395da9f8492eba36_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2316 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a244129d4ec9e462d73f551b940df33c

SHA1
4b2a5b6218bbbd280328ca7ab0d8c4deaa59ae37

SHA256
5035ac77468b2e640c77b8633f2bc7570248731175b6fd9f5dc485aa99c05185

SHA512
d78c93d09a32fe5e927bae7646bd703b4638ac975531ae4184f042cdb3b8c6dac20d66335114eaacf78c2a154f2e7e23b984a03e4fe372b3dcf6b521453c0f7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3fb15552ba872fc4d080382c9e1cbc1

SHA1
f9fa1faef941bb693e9ef95d278e17745dcb3de3

SHA256
b555eb851ffd9a7aa50ccd983728f9a4d3009fab9d60cde4d8675127a9fc5294

SHA512
e475e8996e079abe5cae15f22c6ab6894b0e7edcd1132d8a131720a3ee99d80f8d7000d1afe52104e9cb706b2961fcd24531024abf84f14b8bb61053154070f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c1401a9b4f5e84aca706db910a66114

SHA1
5cd5157dbfc8e8ce499bbe0856bcbff1232a7ee1

SHA256
fd25407699055cf196f7be0e940420e5a723050efef0e8d9692ff98c65ebdc0c

SHA512
c7b953344953948fecaa9a07569879ee5e34e242c57b9e4e9571d7795920764877a6b2739746da9a1742b3836a0ca52597536a10a14dcc56e56c63f7ced24622

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c3f1fa6bb4747e484e7bae5fece6781

SHA1
21afa42db730f0c9bcfc73a5f2663f4d6b7c19f3

SHA256
db291da479a87f0b8da26d0da0919f68a666479c4a45bbb740d497b69f4515c7

SHA512
2e6d31bf0d4dc7e3e468f3117b736d59653e6d6b9314b861694e0e5051044329e1614bab3f117c6a64a63c1ceff3f4a40d14e0dcc824ef53e7001a034c2df5dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff0e98c2f84c9900357e6f72f15a87ce

SHA1
ec50fceaf7c1cfcbc57a58bcf17299628caf11bc

SHA256
9a39054f03f93798aadd9af56252319154142065221c8fc38f4cf384921f0a4b

SHA512
6e9ce42af78f9ec29ee42276ff305fe170796090b87a2c8b3476068555a5ebb6bc09a525382b541399af0dda6383400d09832aa6373c06f7002ac45162189dbd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e91d5998b691fd12374aaa94e2581878

SHA1
10d3ff61f2b47b6464291801eec87feb1794d2da

SHA256
c5b05b5de964b7e60268c7110fbf7f78d5451652d6176cc9744ebb93d6bdd2d8

SHA512
d6357a892b1917c697af9896145eae7eaa8e0b4b3d835432616bf9f3b368e345f274a40ed8624889e553c6c70291bd41614af5dd0b3d7d6cfca70b71ac529ea7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dfabde1cbee7e2189cc78d37ef799d8a

SHA1
cd29875d5be020680286d1891cfa0246efd0239b

SHA256
cb71546f4c3a0c5106d477e2a516ffb760c9d16efb744d26cf39bb4f1f31796a

SHA512
6e34b624a46e705a66f03fa07248365a90ac59e68cd78baf07f824a064db9a68553b933532b5c48751880a5bf75a35e5d63f4185442546426ba883a7f2158a11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d62ce838e24c3a65e40c745ae49eab9f

SHA1
a7e5985c6b2cd313cb31d3dc808a9caad160ee20

SHA256
a90d2af40f5d441d0fefbccf57b4c936a872cb26416676e9b47329dfd582fa3c

SHA512
603836246fcbb3f4f5f645831da7d017355d257d7ec764da756e06e596eb1bd55edccb11fa2bb9592c7d10f074fa2e246c2c00f6c117f935be4c6c3843a82005

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db7c69dcf67ff7e068e973380fd917aa

SHA1
a58961d9b7b5c5009dbcc2824b97bec4761f9ceb

SHA256
377d366780b5cfef3b07245abde0368f747ef691e4950c76aef491487494bf00

SHA512
100a15722f8a4f30861d8bbd867c6a65fd78e8113a58ed698eff608a3a28c6b206e5b87909f0163bc1bf7597b7931720874b0ab72451c42e50f1931652f0ce68

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2424.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab24F2.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2507.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit