99228cfc6ccecc1e3d9894c5c56b85de77a6ece615024fb869bff90a1c2b627e

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 21:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6fe06289ea99c4ae66d1882c35508ef9_JaffaCakes118.html
Size

22KB
MD5

6fe06289ea99c4ae66d1882c35508ef9
SHA1

3653cea9b110bc1a22a2e417f566f23cbbeea05d
SHA256

99228cfc6ccecc1e3d9894c5c56b85de77a6ece615024fb869bff90a1c2b627e
SHA512

638e69945c92df345bec58e86255646f2c1d129364eecc621e2eb838bc411f361d75ce533276d555831e216a2a52c743f63b03ffb17bea83adf3aa97457e3533
SSDEEP

384:LfMspovXdKXrcR+HOMrWT6LSDbuQ/UTNEJWyCUQPovFX/7NxinWFxCgz:LfTpovXdKXrcR+HOMrWT6LSDb4TNEJ33

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{566B25C1-1A16-11EF-A759-F637117826CF} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422748738"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1936	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1936	iexplore.exe
1936	iexplore.exe
2016	IEXPLORE.EXE
2016	IEXPLORE.EXE
2016	IEXPLORE.EXE
2016	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 2016	1936	iexplore.exe	28
PID 1936 wrote to memory of 2016	1936	iexplore.exe	28
PID 1936 wrote to memory of 2016	1936	iexplore.exe	28
PID 1936 wrote to memory of 2016	1936	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6fe06289ea99c4ae66d1882c35508ef9_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1936 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a54b121a975101aa4984c142867705b5

SHA1
b1371ae6ba2b22cfac568df1e19164dc85ff895a

SHA256
a47a8ff41a939a1464c0ec6e7c7453fd12303cc197cdae9cf7d0e5f58b28c76a

SHA512
3123345572171117b189e382e715c1f267c086948229165bda64e6de2730180ea844025ab633f1aae3ca3d7c7834087d36ac74b227aea2b417f52ce33989fb9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ca9f6c2c8961d94fc71eaa1486e2f2d

SHA1
4640ec7e8ca300eda15f21fbf67fa3527fb20f74

SHA256
a5ce3eb0ebc3656de12b609a847603718d653816f0beb71437ca3f666388c4dd

SHA512
f8ca426544654cadb7ec79b9d071f6a1bf1e605304761a63b6f08207e743e447fafc079f8fcedfc4809011990baed61cda6344d5d0efaf43b33f6c81ddea822c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05ff0d50b005263ea1a16358388245b4

SHA1
005a52488eeb752d38fc78c926ceff2e1a21f5cd

SHA256
c9e1b45a41c9130b6fd245fab2a41df194beee973e3ff721071dac0bb54e2665

SHA512
dc8060348bf4639606edf1017dd9dd834a6520965f5c11446e1cc3bd6f26cf2a5297f01de9c5da82e169330d8bbfe2468740c6686f121768ffa24e12cf7ba8a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb5dc7a13c5b680300704289a0eb5cba

SHA1
1a92433bb526e4ea0e66347faa0d76f9c50d7230

SHA256
e53563b165eb30566f8460b8acbf2a4ee97f686400a619577560b1966351088f

SHA512
8dd83d54b12e30d7e793e7ca91f184aaede636c9c5ff03b98954925eff59e3a20732b359c02db6a8843a89c811ad1a9fb7dc2d215e09550b7cf2b945ed43e3a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8876210b5b561fa02e6b0899b4902841

SHA1
ef8e4a4befe6ca3862c329f84d5b87e8aaa90ce3

SHA256
98b66a936765ca88b98a523b6f1924cc636f565e44b7fb87164fc6f0e65464ff

SHA512
bd1c435ab23e1eccb10c68a372a5a47eda278d40626ed1a19346f05d5e60628d7bc036b7719d00c18b681d97899a0560449ef9541cb4961116318fe7d345b6bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3378d119a37cfdf5e8f4aa8d573ad7d

SHA1
c6618b755b34d8e1c1013b6de0bc87c008bb878e

SHA256
0fad767c6aa8cc7f7d2f101db4cb441b63b23b855fd2d9a17ba39feab3e3d7f1

SHA512
839c6e155f0aab99474e11ef1fa01c966ee28d67b863f2e78e66487734b9fcb02192b1d8a9ba42393ddf5f41d93091a21515da7780faf26b972bcc08f164564b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae78d2f27f83b702f411b593eeef888d

SHA1
cfd0f304e9293c2e1af94f8757f7c650b2eecc18

SHA256
5fd59cda0f691ed6baa27058ee70733031e72843f1fcfb6668a870986e09ba10

SHA512
926e64b495ec98aca83b38388bd8f26d87e41fc78180fbed2634284d977e311252a4d349276a716f9b2a82173d0db867f5433433b080acad67950dfbb3e1363a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6cc2cca8b4554d8d011c7237e38bc9bc

SHA1
d0e51f845bdad575914808451160303ca4249287

SHA256
964bbaa02d4bc86646d90c3bdec96f29d82ada5a274078bb554578cc637cae7a

SHA512
bdf0056b58ac9864e0db695b0f8872cdc3a75b2c8a9b9a34359714028e8b683c8c1ab24d3c8a5f7004ff0e53e5633adc431e213b5dfcc3af86d59d9f3d419a83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7aba23343fd35ac571b86e727326593f

SHA1
283184de71364d6dd5c940bb29e844549525f08c

SHA256
c227560e68d58f29225ba7cd178a1cfd1d44b07323b4364e5001158e8fd229cf

SHA512
7d90ec5fb8c7171e6d2f0859b4106a4063fa795a89559d9ba0c117964e50ddd83fcf65b290d7b0c47bb7558515352d703835c62463b3babf653bb9b12dbc5509

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC80.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCD2.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit