dde446cccbcb5f2f1e8268bb19289c6bf41da418591e22a8d7218b08a886b0ac

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 22:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6ff2b933f900aeab7695d9d770609fb5_JaffaCakes118.html
Size

40KB
MD5

6ff2b933f900aeab7695d9d770609fb5
SHA1

5af1ad6f98a32ac13c67207b41585f2696aa8db2
SHA256

dde446cccbcb5f2f1e8268bb19289c6bf41da418591e22a8d7218b08a886b0ac
SHA512

2294f73acd57b5a85c83cbab961f17a9a8afc4e532279bbdcb8d630cfe3587e53752239bfd408a05600f8dc7a866d32681fcb450cf237bd64c3315d628a73dbc
SSDEEP

768:yBvkU6b0CHodHdBinfWx4kXi2WhEiZRIWhvM96gbKg4ct/DptiL0lX7JLRiwAKsB:yBvkU6b0CHodHdBinfWx4kXi2WhEiZRD

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422750387"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2CB94551-1A1A-11EF-99EB-F2F7F00EEB0D} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2964	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2964	iexplore.exe
2964	iexplore.exe
2420	IEXPLORE.EXE
2420	IEXPLORE.EXE
2420	IEXPLORE.EXE
2420	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 2420	2964	iexplore.exe	28
PID 2964 wrote to memory of 2420	2964	iexplore.exe	28
PID 2964 wrote to memory of 2420	2964	iexplore.exe	28
PID 2964 wrote to memory of 2420	2964	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6ff2b933f900aeab7695d9d770609fb5_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2964 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4dfa845ae421386e3e4e66ce781b352

SHA1
3d06fcc8b092544226f8608fcf0b8480dfc5eec9

SHA256
4372618a011e2a05bbbc77d2f372827a74a507587f04c0442f37b98c8d8b1d30

SHA512
f6f0e78b89699888b5fcffd1497fc4c0637c5d1312ed0c737403bc58df9727460a4f9cc99bf2618454e6dbc39115d52db6849c24af988a8997f2aaf24cfd2e3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
09243f1ee6a2f1bf5fa96ed748910da0

SHA1
d838014f253cfe44c1e6e96500357d77e5e5a439

SHA256
6284233a0ac8a0c5e94da5d54e79a3e2bfa6ff9d1f62aad563fd8875b41513d9

SHA512
9401538d27dc986ba29f454e09d8310d391b919249b25ab7f35b65ea173ed42cfc6bfb80b2d492db19aadf4c1ad84580c2152cb62bf51e98a045b2f8bc721f3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
392d4538e4aafdf4a7941627bb690dd9

SHA1
0271450421fc0e3e6bcee219086a7d92fffc724c

SHA256
0f499e23dfd6de8066a3dbb128f30c26b61eeaba4b5ec20ab7ff676ecdfec39e

SHA512
e7f22e33bd5c884777f992315256a0826f03219238cc7fd718c29ec3078f063e36dca281ac66d4519e05ace7859e62629bef5157a46ec1fa3fc111dc834cb135

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
045c3ec4c00d28c160640b5c849af8d3

SHA1
2597ba8661b353f66ddd0ada8d26e68d65300b7f

SHA256
a620ff1ce726154a530db386d63b1c901705b19719bbc804aa51317e41038417

SHA512
f2ee1bf3df9eeec22970211be9f871ff1c364036a0156e5e7ae358b23abda3b58334f02dacd31db7d345b6a5f0dcd0e8e2ebbbafe9749a5f6443a3c0448bf85c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
262dd46ec91d331ae994f7578b86464e

SHA1
bd1024de165c5ea2abacb852462fba216e2780d7

SHA256
2a12fc186549c52c165db2c7e8abf8786a6a48ec9fc3cdc8f7911ce7c408b3b0

SHA512
5b3440728290bb4c1dd8a4060a26d974f4c0e9850495ce576337c14003e74ff2f7e02a664b417a4487108588090f5aa86e6c2de5e276c6970eec35153fb63355

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c03fa9859f0386281837d51a5225a6dd

SHA1
1a203b517e4134f34dd2fc87ca477d7708e22671

SHA256
f2362ade67f67094e4e1ae52ca3ceb28c22b18fc355b8f49b93391af2823b433

SHA512
b192a2a2e36cb54355c822ac38464f10ab96fdf37547b6bded956af0dda6f85b98394ea4e72b6d1658cdcb991932c202a831bd4bff7ad10d355753b85d23bb0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc72e42d72ed164223b1a0e496d041d0

SHA1
950f54ce0ef449f6f2bbe51c46a9b455f1fbd41a

SHA256
b9219b07464d64637d63981c542e316699ade18f0b6fb4bf692fda9898616460

SHA512
06c897dec8c2d476b1487cae5d44ffd0c2b5293bc2764e984c36c8631d132b2477d9fa21031cd0ba1559ef17dfe8faabd056c465b6057c7a191111d34daf76fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
293a996371b2323b41b53145bb729662

SHA1
59ae7924b908cd1951a33e81a5d2ca407af4fc02

SHA256
21ff94efdc4db48e7b2be44dbf8e088f02409015992597cdd2dc8323f26e8c0d

SHA512
fd8cdbb2e0c9b10662201737581298e993fb4fcb117a287ec48ee1b1e1340ff46bea5da08cfbf3febd7d634a2613573b4d353029e93aee8440b0ad31d34e7dc3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e8ba1e130d866057ce0b655b29e6781

SHA1
e4afb9c66038014e441f9f1317dc0535148e3458

SHA256
1cfa9d281d390875626122a6db682b1be739597e89536a7ee1024cc9e26b0dfe

SHA512
fd6613c3648a96f339a73804209e8d2bab64b4baaea43c71de99253b67840846d5f768ac3eb6a9ca464ded0e6caaf752c20c218a71f5a7080e75a5f887abfbd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab23B6.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2419.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit