c1864372e038be51bc8d9a692a5bbe9671082335ed1f4170bb53c94ad5f7b0a0

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 05:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6d6fbef23a81ea6f17d8947703e4f4d4_JaffaCakes118.html
Size

23KB
MD5

6d6fbef23a81ea6f17d8947703e4f4d4
SHA1

58e67ee35706b3dc1f8da768df35f6e13674342c
SHA256

c1864372e038be51bc8d9a692a5bbe9671082335ed1f4170bb53c94ad5f7b0a0
SHA512

b77b8999118db74991191c11408d54fa7421396dbfe6cd66beda22a946f24cb7a9651c4e4f52491bd417c82127735564f34e1ecba251dccfdea6374091e53f49
SSDEEP

192:uWH8b5nz+nQjxn5Q/anQiepNnynQOkEntWknQTbnxnQ/CnQttwMBJqnYnQ7tnkYs:KQ/CDV

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422689415"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{35E9F681-198C-11EF-9FA2-EA483E0BCDAF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1440	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1440	iexplore.exe
1440	iexplore.exe
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 2744	1440	iexplore.exe	28
PID 1440 wrote to memory of 2744	1440	iexplore.exe	28
PID 1440 wrote to memory of 2744	1440	iexplore.exe	28
PID 1440 wrote to memory of 2744	1440	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6d6fbef23a81ea6f17d8947703e4f4d4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1440 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b808a42ddf4789f76f373264c231b219

SHA1
3089c22466b3dd8abfd0cab22e975379b31c13f6

SHA256
17feb1e414bc6b8fba85c70454ac00292d5f7635807b5b0e825de59d8b761997

SHA512
01faa458aa52e034ca3ce21c07f526612f5e7ce9b6c99e85f645c34d8b48b02021a1831d5fc1c96a096a1a9cfae9e45451a0be1a746c792ec4438de60eed0bcc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
630a2c0031a0a78f74335fe52601eca4

SHA1
0b4b31376da0bae839b486d328f50e5ca8172d80

SHA256
f441af030c5d7b9ac4b5e8b3ee2344c4b62472a2ca1c82925f920904f5d613cf

SHA512
fb7fed1a36b006cacfef37e025fddfac85759121e9602a75e81c3c9d5e3ca50f47fda2bd4407d80ff0e295982fe53589a3977e3191a225b2aced3dc8c3fa8fb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b26cfd0315a927231e2af11eb8f90807

SHA1
6d7cacf46ef2750f9fb3ce7e97ae61c81a12dc8e

SHA256
94aacf52bd4a102a75f99c84d0ae50e2dfa729016e28e0e14dfa2a191d5843b7

SHA512
d7b3dda5c686b31faa0824cf342e9c2757ec17dfdf1eb25d46bc7f63881e555ac64d11d8d03595294b7cd49b12d26213ce8e6d4980a43f971ca24d12b1c81db7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c2c9b147c86bfc7d56a45b552036ca9

SHA1
1b390621d6eb2fcdae06579ce070f7694813feec

SHA256
d34275e75ca3a94bc1c2c5ce6eb1bdf544eef84347b58ce710114afefd5c1787

SHA512
84ccaa2d7506c9438a12f65f362af8210c33b2d7097f3f138410ead0ad05e7d3354c58d20dfe2f270f6184b928eee4610143683ef843fae98866e033144fb305

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b49707572f5f1926783c6bbd923cfd9b

SHA1
bdc446269cf23bfb3d1d0b34a6afa8a59a4ed55f

SHA256
68b7ae5e7ae43e5fcf84d0a23f1eb260d164f31efa6a96a82dbc57d5c5e4effa

SHA512
91dd56ea7324b9f6eda950ad36fb15620751e8ace852659f98f29160b45b49b376e03093d3b2a72c678a70eb4419f8e621e26f233ce27e71ff9435716e469b19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37f378356a4b928a23f4aad03f11c564

SHA1
3377123c6ac587500600eb32defc903e119d7c5a

SHA256
f3c522933532cc77fa81b6282c2b78526502ebc03398813e4a68143e012abfc2

SHA512
83d4fe6b635a62c1fedd15d229c887be90b17125401a6124bfa05f44e86905c40dd1bd658bbc30b10846c9c6b411992fd7844dd687166e474c92a1d5677f22e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed000d360b89bb5756158f288e3fddfe

SHA1
70ccb0d9bc4fc7536205a5b7d4cb6cfe61918025

SHA256
acbfc7ffef4c25f216fcdaac9e7a97c4ef28bd6c241f18a39c94e75e9fc5ef24

SHA512
992c6c9edfa1725d7c745923524cf8705e89572040aba119b355256b798bac57d1e347a89176288ed7efbb4ed4faa4484fc5ba3ee336eb6cd12a2e65dc3376e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef338be23b5a7c04e7c700e5e3688ed0

SHA1
b5e9f306879a09b7deb30bb0e5ee95268292351b

SHA256
702e0b43eab2bc3d563427c0bc08b69089b6cf9a263b1ab4480f2c4f4ec53cc3

SHA512
b1dbfdd27e87c312d3e267cb885d5260203ba47d89ba354704cb5a256004046b54580f556690fb31dcc2c9eb8e0222c1561ee4ad271b1f2bd8839187cea841e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77a47b5c164af46aea38c95ecc98c85b

SHA1
186f35ace79d5a478b451678ed60526488b9dfc1

SHA256
c60024b11cee8a3b25c73aa25e59b415819d155f6f67462c6772ee57271a41b9

SHA512
010c87df2565f33cb8569b9bd290a71daff83f2482cf126fa0ffecdb07e6b57bdeaf7b615c690031c96807b7add8e890aba9c3708e99b8d516726c9a8a41c900

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9002.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab90EE.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9131.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit