d3af9a5bd6f3481008cb23349fa1c2050c3f6467d0172ea0171ca73bf292e1e6

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
24/05/2024, 06:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6d9dc4422d384285552054b94c43a282_JaffaCakes118.html
Size

43KB
MD5

6d9dc4422d384285552054b94c43a282
SHA1

6c0e3535068227ba723691a18ade8c92156e7887
SHA256

d3af9a5bd6f3481008cb23349fa1c2050c3f6467d0172ea0171ca73bf292e1e6
SHA512

ff6eec2d0c0f73cb02541d9f9762c818c72ed598ed7649e6aa602921b5554c3dc7afcf1818fb09228834f7a1ddf70249f94d65b05ae699b70c91f75778ae42b5
SSDEEP

192:uwfib5n2eynQjxn5Q/lnQieoNnWnQOkEntHfnQTbnRnQmSnx3DWPljQelkPK2QsU:MbQ/HGxYqRhCL3j6v9gNmRDAz1

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422694385"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C8DEDEA1-1997-11EF-9BF8-4A0EF18FE26D} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2276	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2276	iexplore.exe
2276	iexplore.exe
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 3012	2276	iexplore.exe	28
PID 2276 wrote to memory of 3012	2276	iexplore.exe	28
PID 2276 wrote to memory of 3012	2276	iexplore.exe	28
PID 2276 wrote to memory of 3012	2276	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6d9dc4422d384285552054b94c43a282_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2276 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
efe03b14a737ee166f813b9a078a1c53

SHA1
13b03768046cf3a94b8304fde35682b1311d5d06

SHA256
e5a37597efd68dbd5da6d26745cc27176c2b9cc4960ffb1fab7a3ece0b123b3a

SHA512
8e66cc4a23219b1fd02c8804f989bd8d264d80aeee3d66f4cc77e9b1307a1b6db38cb5abb7dca8ed7a29d9c7dfde8fbbec5b66dee342017b883ec8c4ac8e286e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bde8c5333f1031de70dfd6a014e25114

SHA1
1608c240dbbf01a07d15e658752ece645a580218

SHA256
1cf07b32201176bafd43551b33842e9377d60f458800b769536c7f7e401604ed

SHA512
2686dbbf989845f7b93682609a17e177c4478cf9ed94ddee186f79ecf5677b1908eb5d83cdb354fd8efb3934f440ed96a0d393375cad1d6b450fe4862e1b4b8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71cb577917b7614e611d5f97cd6e8e0e

SHA1
e61be9c71316fa8076d8a9c64a31c878b00f0482

SHA256
ba994db82a3108dbc5f0e35fec6e3a0f7945d384205bfb192ca96e38b03a36c1

SHA512
50b4da337199f612d6e208b33f8c24a86b7e269f062513071ede7da89115f873d9ad59bc8656286a5d20d93acb857ac791f1576c3b2a3bfbb89d3ac1d44a5811

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32a9d588b616b1109494906eeea380e5

SHA1
4b0a9d5ff8168cf2161c60778409721cbddd284e

SHA256
2c71f407bf42386638ad06d5f440351852744a91076bef962274954c88eb7ebe

SHA512
602235a817ef1716075f86c62ce1554318549badbac59063c4573b51e668c3b76d1b19deb06e0a93076613565d7c8913e6440b19194fa528dabe9cea607abf3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b1a0574e0f88bb65b17428d466af66e1

SHA1
16d27590709283c38b9cd1a08142d4eb73ce8b91

SHA256
68dec7a15fd75904852e714342c7072fe36ac995d5d6dae58a570a6ff4805f9c

SHA512
2c458b017ab6b0878cea17fbf20094c4f342bd44427626ea40701ec353c84659a3801361f4b66041235588a5ca866794292b3584f7a1ddb45540c5120b999403

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b184e407750ebb01a587080f3dad264f

SHA1
bb627b8157b9938a9b72c9b503303a65b8fe198d

SHA256
0cfcdd00534416543e709b8c669a6b92fb22be42074bdf9eed65e406e069ab61

SHA512
bec46b5fe4a00043c9b0d9fcc05a8faf9485ae3922161cd409b6e1bb21a0206235a328d26d645215ff7bfae6d47ed187b1fae307952a4fbdf564f7b819df860d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2436c367975ecc002b73bc9dfb0538b2

SHA1
54b311e845bb5f44a122b5c82737ee2517b195ba

SHA256
556318e5ad75e482ce0e49b25f0dda3ba46d6be939d1d9fc326a985a0333f4c3

SHA512
05bce038170b1c29e1c2a021b7bbe0f2a08822c66ff1a30d7dc17f30bb854c8fbdfe1eb534f0103ac05d5f43f67d41492ed629ca121457820296c6c09deeab83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f179dd06182e1a48407bdd20edcbda11

SHA1
da57b903ca0ac7d99509e8b382bf015f31ed3794

SHA256
bbeaf00eb3ddeac9393d8ef0eaa6e7d9576544397f62f4343faf6a76c797998d

SHA512
c88685f717563e550055e0a6d3d2f3b02d80c07a93b51bd7aca727fcb6744ebdc93a8e857dcc9d101ed91b3a3b969454b3c86bb0985eed69ac7c6f6b1ef5e0ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab956.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA37.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit