67f285b0d58ed3635c08a6b7d70d93afc2b252f2eb95ee73c7afa4448406d8f8

Analysis

max time kernel
137s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
24/05/2024, 11:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6e6b3a2608d1d0543b7b7d631ce68bde_JaffaCakes118.html
Size

47KB
MD5

6e6b3a2608d1d0543b7b7d631ce68bde
SHA1

26c526151a2e3c5d64407e0a2422b794bbd19687
SHA256

67f285b0d58ed3635c08a6b7d70d93afc2b252f2eb95ee73c7afa4448406d8f8
SHA512

2e9046987942fe7cdd8d1ec110370348966f6f87782dbece864040c2d1e97dac96373c61da752cc6ac1ce9143c28b3524ed53bf24ac91715cb4015c7804c66af
SSDEEP

768:SDbS3NXSluhu40Nuhu46eYyf8//qB9EiYGfASaEaBX0EnB1wijeFZ4e1kMHcclgG:SfS9Ux/SB9EiYGfASTaBX0EnB1wijeFB

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5D67E0E1-19C4-11EF-AF73-469E18234AA3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aaeb65a22028c499ba988ff4f84dadc00000000020000000000106600000001000020000000c2d6a3df926ab281b1ac456d7f8e16e8d57103b73a5db07220677bfb9ff609be000000000e800000000200002000000008c825a39b74c6f96ac6abdb8305530db0c9b18729e3a91cbead5798fc1e9bf420000000d0a838a073283414ecaf125a68f616da2f7d5ad30c694f95d07a018c40f04bc6400000000388c376fdc71c55539b5bdb048345baf74c559c5fc41bba9b15ad3cb4a464ffc78bdaf2c1067462479416dd9a34a2e1b7ecfe3b06788d1ed4cae993edef7c18	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422713533"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10ea9c71d1adda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aaeb65a22028c499ba988ff4f84dadc00000000020000000000106600000001000020000000560c73e35fbddb7489eaa24c7146fa9ba594df4a90ccd99c8e4bd8067ee7147e000000000e8000000002000020000000c7b32629a7319f99a87e6894a3210d29963634f35c788f5c0af37b813b8b470190000000e2f9b349473651375b433dd3d0f87b758e968046b3e7747c9c7cd891a3a88b505d4bf4fdcab3f6dd69fa03fd61b8c525b82565c95bd568d02dbc948515b9708aa1605c4e265c780c443e6537f707cf9d451dd919e4fbb37f0391574717d8ed6eeb4b70e8ed27d2d517b41c68f90359c49cb8054ee1c00585c1714d9f540fd6c570d2c80d72b3f2fb427c35433e5efeb340000000315d2f4a003a3de05577909feaad3f0ce9d2bef2fb8c8582d37a5e6ec80438aa819bfcdec58306c879d129ce8ec1cf631a4bd69326ccee6108ab7d3568b91914	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1200	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1200	iexplore.exe
1200	iexplore.exe
2636	IEXPLORE.EXE
2636	IEXPLORE.EXE
2636	IEXPLORE.EXE
2636	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 2636	1200	iexplore.exe	28
PID 1200 wrote to memory of 2636	1200	iexplore.exe	28
PID 1200 wrote to memory of 2636	1200	iexplore.exe	28
PID 1200 wrote to memory of 2636	1200	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6e6b3a2608d1d0543b7b7d631ce68bde_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1200 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
728f3513e9f573c6f167db4555090036

SHA1
9eeec384ef7bf8cce7e3548bd19a9beded28eb10

SHA256
dd370c4ad9f1b6b9cdf34d21f0dcc4bb2d7d85e8007ffaa62b563f96387b3eef

SHA512
b06cb819fb5ac130986bfb1ffb11663a933cb3f7276e2db2708c38953736e0b6adb02244c67159bab9b8359d7eea56337788785222bacb7142ef9448e4505797

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b16f515c0a7af322a6ff813e69db387a

SHA1
23bbe35ebf60922d4d86c1043011138921238e2e

SHA256
6c96a6f8d046c852f76cdecd5c7ad7372f8edc39c017db3ee14a62c0939f8153

SHA512
691f8e5a7308b730a63042540fc7139debba785fba1f3006b19f69b0c706640110767342250ed757f3f90dc72197957755f478c91a97bf86129c174421f90bcd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
872270856b87ae83078884455d0f5821

SHA1
6efe0b23c0bc7ef419f941ad6b5ddcec4cc7800d

SHA256
d3f3b2be7353659ca2bb489e545c77b2915ad4f5b265e3aa5d4204a85a318535

SHA512
1f34d4afed3d5f298a83eaa8d4dbb2ed8583c937e725eca87c869b27290c1b5499962f095a81354a22f46613f94f6b22713b2e086b30658906f63ae36cb9fa7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80261c738e64a0771936c6d2c2d414b3

SHA1
7e7242404b7b1f1bfad7449dc468ce374c0b96a3

SHA256
3e1e74afccb212ac46a3c4e69580962e1abceee4b17557ffc2619e055d70b353

SHA512
39994f226e06f6a3563d332ec6c820ec4dfb8fd2737ca3c20ac051ed5291993a6a02ab2feb1f4633d7fb784e819060126cb7fbc257a2d1d66b0bca16542bcdf7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b0c4b11ac24a9683277ababceee7ed1

SHA1
5a6f828640e7ba4fa90c8feffe378d9cd321f236

SHA256
0b127bc7449425bcb5a74c347a440e693ac727cbe7dfa2b5bcf567d16558992f

SHA512
d6b3fe181f0295cd5afac238db4e2b9519e3ae3d683c14f949779a1c68db173282d7019015bf10821e2d23356939a99c4c084ca5dd7700d95e45db2bf33c3b5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a264b72017830065c50446743d87c8cf

SHA1
99c2490eff19f1e678ff2031f9283f60419fd5dc

SHA256
6343849227e330f9149ae6b6b30f1aa170b08c3484593f91c49619a5d2ec2a7d

SHA512
8dc197488f401187e9e8cf23849773f8c4ea1bb6f2f274c350bd81ea057436023d07d15bec75d4614bd1463d3bb08e9b26e96a3e01025482c41f8bd0ab83ab62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac47e58cec4f902321fa6ccfc542af0c

SHA1
160e99802b929cb66890e00b360fde20adbef1e2

SHA256
34e6237013918ac9b588e823c316db163a85cf13780695d07de85114a7a1ca5d

SHA512
5fb0c16ba5a99a302a2ce12217176686121f54f9e9761d85bbd2b1009becf0fff602ff0ff8dd0d0029e617c1b8a73ab32d6b771710be6422a851816a3473c5be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5d12fa9ef4c9d83e563ae67969c5ea0

SHA1
f7b8cb9a8c3fb6b908132e64bb5493f151df8bca

SHA256
163ca8db167a4c918e47b15eefc08b8d272649a2ff6cc12f7579c53b02681af9

SHA512
fdc55be19991fa052ecbf32d2d55cab44d88e2847fe2995839ebfcb044a9c18bf63c61e18f57b95611373b67ffed46f31e8877a2172fc829efce2d928b150fdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1335.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar14A3.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit