87efdce476ee2275144f8449a137db951ac58889d8beb4edc8e8d69a2b82d2fe

Analysis

max time kernel
149s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/05/2024, 05:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6d7a0592fa3761d9b2de231383d196a8_JaffaCakes118.html
Size

122KB
MD5

6d7a0592fa3761d9b2de231383d196a8
SHA1

e00c63b883487b7100712e1674bbb3f2483a8944
SHA256

87efdce476ee2275144f8449a137db951ac58889d8beb4edc8e8d69a2b82d2fe
SHA512

43b896a9f82a71dc9ae24fe840268854fa683d16c51bd08c0cdfe5b901b942a19031d32982e3c0675bc7bd8fd942d107fb7f2676992c15288bb874247d8ebebb
SSDEEP

1536:JOB8q6qicpiyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBw:JOB8GcyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422690540"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D472ABB1-198E-11EF-8D50-4A4F109F65B0} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2336	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2336	iexplore.exe
2336	iexplore.exe
2344	IEXPLORE.EXE
2344	IEXPLORE.EXE
2344	IEXPLORE.EXE
2344	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 2344	2336	iexplore.exe	30
PID 2336 wrote to memory of 2344	2336	iexplore.exe	30
PID 2336 wrote to memory of 2344	2336	iexplore.exe	30
PID 2336 wrote to memory of 2344	2336	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6d7a0592fa3761d9b2de231383d196a8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2336 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6146724915fd5e9d76bcc45a7f7bb34d

SHA1
32c3aef92640dbbcd87e07817386e99fe651bb92

SHA256
a7670e1527ac2581667abb3187b8467086cd52efbee7d3ca2b3d13f06d276f38

SHA512
f7b04646da52ef10742507ba4ecb25bd6b895c14f6b791bf7bca6245d2327413d6663b4ae94228cb3e61afe7f0c245e5631d9038b6dd23e28421dc8783720c37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7707e08a4c141755e4635f19c63c168c

SHA1
ec5f5157bc7b7185b44bcb6435a89fceca85ef92

SHA256
1d70490199e95e579af2de330c542b18c2778537f7efcceb2111802c1ce3eae3

SHA512
9ae801e3a25c785f872734b10790a5c6ed0e51f9e5de519b0058139b5dc168985bcc927484817f5ae40518602a1e5c1a167706f69be2e6024c02eb6ab6540caf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f233c71c825ca625bd0908979d163851

SHA1
03e85ab92de11eb95f97e8160e64831abe66c817

SHA256
e43db3ef3b18a39ebb2f2977f53b5530b935ba005511bfca9ab72260dfeb6107

SHA512
0d308ad3122915d7181769c0ce6b53f79369d60791e0c17643e4c022803bfe1e9a43474e9c839719e03eca88687a1261b581c95ec688c43e7f900ddd6647d4e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3abe1e92583e134963ff3dd15adab683

SHA1
f34e17766fdf2c3d3a3d3f31698c9fb2d9cd39f1

SHA256
41714d715c889269aa1cc97f0c9ea8739b9284e84949f0eb3637cb10bbb8ed7d

SHA512
c364ac376c8194837dbc349591b4bef864552b5f919aee4620d03e6f3849b8960dda1cd5903ac0d4bd162bb2d6d0cd29e8fa58504b35263f02cca09687999074

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
922a9514f0ea28efe29c8eeb5e022bc0

SHA1
9b7fd60338ea1356c02c4e062488a5c5535a4187

SHA256
3c1fad909d3762a63b9124f67422da824d89c07490e66f74a8b5189973df4723

SHA512
607c4c0eb9c1be0f4fd5ce4c0ef53072df9f9196b55fbb85733ba06d4cce4d14c1c83a6c5394b73c102ecbb1dec219cd14ba90b09b8c509c8c2c48d31a77851b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a2be533cce97bc1e59ef271af71048f

SHA1
02130cf8f61ca3183906ebc8eb0ad005181f2e80

SHA256
ea8e6fef734b286c87c24dea74fc0802656321c454400b89a67048a323243058

SHA512
77b6ca032a5285fb6c29c803319b8fcd5cd44f1ef9b7815f6251cd450be155e89a0847aba4c33692f71a998f9fc87d60da1883f827ffa033a0162a722413ee3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec2cd9f94f6b218c811823b9fb86ea38

SHA1
a341302dfabf5d35ca905f80dc0d36d30d79bb79

SHA256
4267d6cdc4abc57bd2038e12230f4f7e14b31905bbee2f76e18f0d1ba44f26bd

SHA512
4ec3838252e46359c127ba8ca70369ec6d7998d41fb33bf1cfc5c18f1f001fa4625a45f3531d142123aebf3d64dabe90d88b7e74fc0b9fce7b050bbfe100c748

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5be677b3c3d5b475a78e9c87bfdaee42

SHA1
8a17aa4d9d09560ea6caa328f67fac1f7079bfb5

SHA256
4ef33fd654fa415bdd479b3b90f2a52008ca65cc9a931a0b822e314c75a6cc86

SHA512
1ab7a4b822d97819e75f65309029f3dc0113ee4039b5ce24d63775d36d0c636e446660f62c41dbbfd333cc51ef404b343bc224da130c35e051615b69607b76c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d118478ce0cf1b488470f53d40b8bfb5

SHA1
cc56c991883050bfb0bd3ede42aa044182eec8b6

SHA256
2edece553e1216eeccdaacdfc825b843649269207a5ec208a6b4d5f0bfbc5de7

SHA512
fcd7324f765f857104e9ecdc97c5a3111acc9d3790d5abdb2ee48fd84b8e210b5be5df288f5d38d448cb02696643afea127fb3539b072d256ba458f43a693f47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
31abb50e5382001b51924b07d38f4794

SHA1
fb4a83f66bc9446504871cc5106532b5f78b26d6

SHA256
10b17093c532f84a397505f1fa2a773d93b70748ef56e0f4767c825901ffb92c

SHA512
7325ab3b2d613d95cd990dab94225ecc02866c4dce152a2ce00f2c35cc90d981506c082e3a724b0948f23baaf86a914289f8840a8adf93f72a4da9f40d385af4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e312ff6e8aab81e15df799a38925260d

SHA1
7b326b510449702dd70665994799c568af24ddbf

SHA256
dd9c29ea12dee46abe13e5831924a02587bca823f17c9bd37332376eb69da696

SHA512
f27ceb3bd28f314a5b4051ebb24ed2f2a9eeecf96f4a1cbebec76c2b4bea88b19d30fcc6ebaa0dc60bc1ddc1e8bdd4954082cc123071a6f842ea164ddd3ea9ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b6ebd78421d7a33cddd548ed2ded84f

SHA1
2d94734ce640323e33527fde2a6bb43252ca2c46

SHA256
3a2e22c4e7ecd3bacac41842c660826e82fcc800441351d079814faa345a44d3

SHA512
f4c2497400f403ad3583b9e268ce43d6e48cabbd474da960e0217ebdc638457bbf7b27441866bdf4c782d8ee7e6296bfafd6693dd8cbbd91f4d1a366852f7ee8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5247.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5328.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit