eeabd72448598fb3414ac0d4462b5c92e1785b82b426aa02d2957c049acc866c

Analysis

max time kernel
150s
max time network
142s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/05/2024, 12:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6e8533deab92b66b2381256da0c8db6e_JaffaCakes118.html
Size

18KB
MD5

6e8533deab92b66b2381256da0c8db6e
SHA1

64392c86596b6f15bd6c56082bb97d690ee9828e
SHA256

eeabd72448598fb3414ac0d4462b5c92e1785b82b426aa02d2957c049acc866c
SHA512

919c9a27371357399e19a6e84ef8799849416bf055bd1fcb58a2155b71861f909cdc70c61077be97b9edae570547a5ede7150ee43ce58918e2f60b87779d8779
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIP4DzUnjBhJD82qDB8:SIMd0I5nvHxsvJ4xDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422715508"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F6B83E31-19C8-11EF-9F01-52C7B7C5B073} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2756	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2756	iexplore.exe
2756	iexplore.exe
2896	IEXPLORE.EXE
2896	IEXPLORE.EXE
2896	IEXPLORE.EXE
2896	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 2896	2756	iexplore.exe	28
PID 2756 wrote to memory of 2896	2756	iexplore.exe	28
PID 2756 wrote to memory of 2896	2756	iexplore.exe	28
PID 2756 wrote to memory of 2896	2756	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6e8533deab92b66b2381256da0c8db6e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2756 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
825089cba84c8e60cfd291b52ce46606

SHA1
77764817943bea733a49ee7ce18846520f7cb240

SHA256
8728a10e54be30b36df574b52675d9f66297978289329f08f14c829d390f3b6c

SHA512
44008f434ca240f9387e83249f9c01d19e9ecdf7b62a1b4d97252be5448afe6bf804710d30e34db2cc49cf874908057e4a72a793742c4eba993359b39b37bc6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0167f6231ecc8e1b09baad05ee68c374

SHA1
cdd1b9fc91f2bd3f9fb8f9c71bb851cbdba6518d

SHA256
4520b33cf2e4997b583bcd314b1040a238d630a5b168aac065cd00a3aca25219

SHA512
6387d7208cd6f66f1d7d1b8cdbfbac984357ab71e5bf4e9bdc6fd600570d92430e34c4dff9fce1390a1c76a82d7543d09a8675cbf4a1edaa7c40906dc2007285

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5df9baf70e3582575a4ca503f44280b0

SHA1
37bef06d65cadbb21b6d2da21b2561f0b309eab6

SHA256
06d40f07b8189297d330fc8d936defecc0c3eedc9927e5c66008078e1293d05e

SHA512
b79d31614cf8edd4aec72d1a02e90c2902569d7b78b3dbd10d46623f59d70767a1ec123f50e4f0e3b28a6e2ad5d57688d08422b5ac9a57b3665943946fe03c5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ffb89c6a83c2ef644a640b8e64b890c

SHA1
53e394c3747937e8959d920ec9790ecf4f604dc4

SHA256
1ae34e579edf3cad634fb90200d799035b24cad9a081343822e38b0ce7e3e4eb

SHA512
ded57d4f0a22941fcc6a6005a51fec5448229e359827aea495cc7e47072a79b373a063df943eb6f276204c2a80ac15fb9011f4fb6bd28ab1baede5bb751d91f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c85e1985203ad63a66f1cdfac4a6de98

SHA1
c1ec347e15ed35a94f552bec32a2872a342283bf

SHA256
ee8e5979a56c8dc4c80d87cccc9c76aedeeb038130fb9f4c5b61ba88c4baadbe

SHA512
fd39b4115bb29a802f34232e4a09859739d6e83aedf67d7ba5f74e7e97341737871e54efb7f700bb52a63e8485a9003c4cf4047c09e14040c0ac136b3e49830e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32fa66c878015cd2142da50fac598bd0

SHA1
87b2f73a64cc6b73ef6b6252d70d7b6b9881b988

SHA256
a5b246e3cfa336c82714f9a69604076e0b0614b654030ab71dd4c373667d6aeb

SHA512
f3d548191cc9fe463ae13b386b1ef22c7cff766e3c73ae020119d3f12626827c18905180fd4874d0b5fcc6281045f1d3d2d65207bf021d80d88f37dfe4fb7966

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bbdfcdb213320c9369ef7a2b34ddde1d

SHA1
537773251a7c2215a0893c1ca48d605a30fab64b

SHA256
9331ff893a603ce6e33efe6c2f90841480fc5d2534e56972c9458dec3427bd30

SHA512
1ef6ba44133716b109c9655ddee7be84ff65480ac5883e76aad6f4a68f39a21a358f529f6025f52c003ec2e5c2fb53a59b01f4d2f22325b6c0ebee0a19420d20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c9b56ead3b2c9216d862f523e5d492f1

SHA1
86fd55e6ed9ea19a52a6c28c176d58552b29640a

SHA256
971304cdbbf73f8f719d6c313233414eefcf3ff1953bfe685f752a250778e516

SHA512
c0c21d6c10fb641b6d822870a79de835f6f564a72b92577c53c2468b572b4a7ed9f9c3e636cd3018be149099e4d534e54aa9197aa85d679e0a458575ec3e3a7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9B47.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9C96.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit