55eff068d7c0230e31a6b6a73ab44319af3344d027da711f4b065074b0517cfb

Analysis

max time kernel
134s
max time network
127s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
24/05/2024, 07:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6db709380cf3705de558036933dfb5ed_JaffaCakes118.html
Size

12KB
MD5

6db709380cf3705de558036933dfb5ed
SHA1

32f372257955a5067f93111196632c1801a896c1
SHA256

55eff068d7c0230e31a6b6a73ab44319af3344d027da711f4b065074b0517cfb
SHA512

5d5c747bc5bd4dd1770d5cdd68608f9945b2b70b1780f13114e2276705c6bb8edadf656c7edf028ec95e1ff144e77548ac82a35e20b7356e075ef202a53bf924
SSDEEP

192:FXzCllIRJq2xgP/ttjifrR7YywM+GV5kCJKwhEwswBw:tIIRJq2xgP/e7nwMRV5k0jhtFa

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{891FCFD1-199D-11EF-ACD5-DECBF2EBC4E5} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422696855"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2468	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2468	iexplore.exe
2468	iexplore.exe
2620	IEXPLORE.EXE
2620	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 2620	2468	iexplore.exe	28
PID 2468 wrote to memory of 2620	2468	iexplore.exe	28
PID 2468 wrote to memory of 2620	2468	iexplore.exe	28
PID 2468 wrote to memory of 2620	2468	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6db709380cf3705de558036933dfb5ed_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2468 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
980f8e019c43d1d29478c16eaa997ca9

SHA1
766d8bc34dfddc644427bab8123777275864ca2e

SHA256
e2db84f7a8353f8d4fa97f681b72b4758d0676873d80476f5be9c9f77255d61d

SHA512
8bdfa11325a98b9a18ee16d82f0d7da14a77ff993f64678caed7c8af474dbc293993972530b59644c0e34ff91a8707dc18e914815f3d93347b86b735cba41f56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b12f9ef59aaee56eafe02748df0c89e7

SHA1
822710fdf7acf1fa5f662f45037cda786ec69f8f

SHA256
e2b643b30e709e1dfd7abfa7fbc98782ab2fe12eafdb5a402be71db5ae5ee274

SHA512
3abe514f9fd51b22f2df54a5f157bf63818cf7474d3fd909242ebfa5187f75ecd7e22d11ffe30d48e8d4b889c8a58e84804921d2964044c2c7a28136a9eb2731

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9850efed8ded5002f2f77f2050c376a2

SHA1
c210f70b1f6b070d4ae4483b582635241b9f92f1

SHA256
e279d8c521370ef616d7934ec85db4ea24e05bcced6487786bf052fb998992c5

SHA512
fe0d514be01c8ee04888c79361b1ec93689c363faa61670f42213bdf1c63da1c87d25da5a3820eba05091f7387c92d544951d9f1edce69faf77f59be8df89d63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c0b69cd1b4d42dcc6d8fa6afb64695c

SHA1
a632cb285f75c940c23b4dccf8f7be82c1087fac

SHA256
74e40fb1f6aa319c499a6314f970edb449c8a5fb6da185bbfdfd0705ea06d352

SHA512
cd4f8671ec83fe05afef0b79e25039f3d5b30cf30b9d80912d1f4ee791e505ba9c5e6fe1601e2bb1b46f76741fbb81fa1fceb3bec46e6f449ba39890ff2915c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
622280d08e3cc13e8ea75b3053d7e376

SHA1
f8b6b503faf9077de315d8590e99394084a83785

SHA256
3ec5be1be60550c9074af0823cdba57af8503bed1d6607d8accfc7753d6b0827

SHA512
a61281b7098fcb67efb0af1af5d5ce91aa53db9f972c40833ee514543a8a3ac5249dbe364a7344560ce2113c161a57bd0407a5aca8920e4d5cf8976159769f86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56e100d308b4831ff0dd3b32ebad6e45

SHA1
afd65a9543c3ad0e5b2a7edcf53e10305f62594a

SHA256
d907478a2a9a01a74a548ec8c129dc17bb6eabd9ecc2f7fc5db902a576b694c7

SHA512
d48df2754385cdbf391ac27b7c6d46ffdefc0dd291051c1f46570258cb81b7c54b6b97f95c23f054fd265a8c6943f6a24fb360a199198230e02c23c17133255e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf000c3f637d4b680921ce849332fc98

SHA1
c5eb691bdee852aacb1764d7387655a8720e78a2

SHA256
afe3eecad792b1a16eb89b220dd2f3207b689ccdc804ce228b085d7e5ef41a3f

SHA512
5aa27d2d42d3dcbd58a9256adbc83404866ab12191225a825472bef16e33b374b508abe7fb276ce482675656cb20846c76dc0d1c12d36fe21479b052e6eb88b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f2e0d02dc768a2842f0589b0f10bc2f

SHA1
e6c4d5c443ff8ef8c33a9dfc51c5748bb1f43a19

SHA256
3f5f3ce85cb501429d7b22730f077bbe59475b8a20c54fd12f15e7867e9bcf64

SHA512
85b0770e0b2460ff678d726484bff40b8728d6cb654b701df5d03481cc42c9cfa68c3443b5e1e449737d7f3491ffda3a492055ed23e5a46a73c6cdec957b257a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bce1ed94fd4f24397ca6f3cad3144d30

SHA1
4e50926753d04c1dbee18bc961a495c0bd0ec78a

SHA256
5845b47daf754164cf96112abcafbc5edc6e26416fe077b399995507c00fffcb

SHA512
04f8ba23e2d08c512fd93d591e5bbb2eb613f3cd23412e58c1f16c8a409df3433ffaea2764041a0c13da19cd2877708b0abc84528592b87718d7a01607883fb9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab15E1.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1644.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit