5913f43e71a4a1fb3f97dc984e65e6a4e952874ef71049da35d5c968a31e83c3

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/05/2024, 00:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6cce197cc1df9e48014a559cfb40b783_JaffaCakes118.html
Size

34KB
MD5

6cce197cc1df9e48014a559cfb40b783
SHA1

937acfb913980bfb6fe2b9c53210e1033bf2894c
SHA256

5913f43e71a4a1fb3f97dc984e65e6a4e952874ef71049da35d5c968a31e83c3
SHA512

7aaf84d14fae58d8a8a1b13bbeaa2deedd5efa2c045a391652f18a951ed6976ec404621a1f6e9296e67cee48466253ee15523587d1858c832262520d0a1f763f
SSDEEP

192:uwneb5nCmnQjxn5Q/xnQiesNnrnQOkEntjbnQTbnBnQOgBcwqYQcwqYMcwqYQmw+:9Q/O5g65mw0n0uzp17+i

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D71493C1-1965-11EF-A304-E60682B688C9} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422672934"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2320	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2320	iexplore.exe
2320	iexplore.exe
2552	IEXPLORE.EXE
2552	IEXPLORE.EXE
2552	IEXPLORE.EXE
2552	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2552	2320	iexplore.exe	28
PID 2320 wrote to memory of 2552	2320	iexplore.exe	28
PID 2320 wrote to memory of 2552	2320	iexplore.exe	28
PID 2320 wrote to memory of 2552	2320	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6cce197cc1df9e48014a559cfb40b783_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2320 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3e1c382b49cedfe2d4d858cfec50e85

SHA1
5c8517e0add7bebf5168e06864815f9a60df03b5

SHA256
a540ea77ff52808abb7b5905d864dd4e0852aa89a1749187bc348853f8787651

SHA512
2f06a5ac73a71eb54d340fb0859962f10fd16e133b11baa2068b1d135db3965518d28d3a3ebc013a1bc05614b39161a438622d1dcf016a50c732ef797fa7e39a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1afba7b27f66cbeb52131dc20ece0fe2

SHA1
d6bdb957ff91d782be5af273008049e31fb91375

SHA256
c471dbb92a8d232903812ab07df30bd95313f193f2e9593f660ce3fa11670074

SHA512
99fa861c95c407c597dff600f6ca58b459ec7938e676e9339940d0e57de9d97d2d13bdcc464e46e1255d023e72f00a48e59d7064e1f2b935640688241a911435

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2cb190883b8357aa84bb72b97edaf5e0

SHA1
5680b8385de1907c43632823c435d38aae12eb47

SHA256
2b9670892e1fb6caaddf792d6c6c1ce62d38eae0dc47b5b907f9caec8f0b9049

SHA512
8fe37946d9f8962cf7d23a3119f7160a189b56e01a17fd26b2b988efb4c5e4aca3a684da9ac7e8f2d7271e33c9909f636972f64d28bb9326dd5cb1392ca236ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44b699db7ee5b57b8937ffd45b4e2c68

SHA1
6a23e68d60d0a742dbaa2156922a79b1c4e215bb

SHA256
ae9a5d23c2909896fb12eed9c6d19cca824833282691c40b8648980a11d811f8

SHA512
68676e79f4e346d27ed02acda906a27581bfb60043ccbee69df43b532d318882aa524a93c4217bf1768520035e3be8d18c54f91d5931a7229443f03eeea7289a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
511ac012626623af32f956ede14f125f

SHA1
1c87c50752254daab290bb3ae1644b6bf3785828

SHA256
c19ba53924b29e488abfaf79b53a9fb82bf6d847f27e966887c9d248d6e522e0

SHA512
fc64765cb1e5fb3d3048426cd887dc5342fb063d30854308ec818ab1cf21c48ac58225da3851a30a77f3bd8290aafb72becca551fff66159048bebf4bfb2db95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51578ca12461d5a9b5fae2ab43f38634

SHA1
ca8bd3400027014d4a82820756daaeec24cb7b7a

SHA256
fcc0c80fb47c0670ed54397da7db6b56c8c10b3d2c5fa393275049fff5119b05

SHA512
ccb7af060b2f862450539c337e32f7da8c98bc0ec5c2d35f8318c776215f48ebc41e44302daedef82b26ca286c8a68d477392a193cb442fc7aeab6e6521adec2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4afedcf1ef9164d325eb578f80e9bbe0

SHA1
c8660d3cc1c39faff7fee1eac8d1053b68440fa0

SHA256
aa295920a40210965620bd8fa89bfb2151f0b6272c7ebf75bd3a0d623cfc1103

SHA512
a76bc5a74c3907dbc50c66be341872b5e46462adae36266c961a159bca082493a97d32cfec9f95d02d71c7b3cddffa8064159cce519dacb6b791231736538c64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
471e006095772c5b338e9f5c19fcb244

SHA1
d688f56384e6ec9c0cdca3fa84045d246851860e

SHA256
a72c645abd464194188782e59b389905a36fa1d9e7cc08e82646a988633499a1

SHA512
16298647dfb8892b4704afc52677309aad450bc882d26a9f5f492042447fc795c8a09e30f603797de2dc8ebe28bbe57ad2a46c7b55fba780d8affc25038c8a6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
397a9e9181a4420f5e39111e2a6fbe19

SHA1
06924777e25c5595d67b1395bc1e48d05ac4d2e3

SHA256
81afe9b0256df1473d0b1296cc96d4b107822646f992d16acd2c0f2fda5154c8

SHA512
9a75e1568d4feaf64e2a42096a95639f018b3d91fa7a4805601ab9ba0f0eebc1625cdb2de6a69d9910bdd30a96c0ad801e7dc87454f94cb980e79c964b6432d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab148A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar156D.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit