4b38de64cf2a2502861ec5151fe704e750e117c68c0eaa25bd231972ed82a28f

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
24/05/2024, 14:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6eca66fc1120aa7aee607523987e6625_JaffaCakes118.html
Size

30KB
MD5

6eca66fc1120aa7aee607523987e6625
SHA1

1027f7abba649e760a6ed95e33d8b984819efddb
SHA256

4b38de64cf2a2502861ec5151fe704e750e117c68c0eaa25bd231972ed82a28f
SHA512

2473cd6905b74aca3b304dd12cae2d4d2a7a5ee4946bd4bf417a55dd4b84c2c5badae58420c72d46531f71762299add9a00064ec4622be7d55b197023bb085cc
SSDEEP

192:uWHhb5n4pnQjxn5Q/7nQieCNninQOkEntddnQTbndnQPMCSAp6K+iibI3serwxw/:XQ/WMiOcca5zARvfhOl

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422721838"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B42B8221-19D7-11EF-B781-461900256DFE} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3012	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3012	iexplore.exe
3012	iexplore.exe
2984	IEXPLORE.EXE
2984	IEXPLORE.EXE
2984	IEXPLORE.EXE
2984	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2984	3012	iexplore.exe	28
PID 3012 wrote to memory of 2984	3012	iexplore.exe	28
PID 3012 wrote to memory of 2984	3012	iexplore.exe	28
PID 3012 wrote to memory of 2984	3012	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6eca66fc1120aa7aee607523987e6625_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3012 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c5e561b8049b5ae5d1840f1de6588e5

SHA1
9a779a913d7a3dda5fc989dd859a719993e73125

SHA256
d3a01b9fadd22c2c7f873b5a8382b5a5fff5d5a69f94e665094b1efe5161eecd

SHA512
10096dc5b5374f81607b87a23bb89e8b17efe092cd180cf2ac487c98a28d62159e01db0a138d1cb5e2f2664585e57bd41b522b628c774ca9943788fa191cbf3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a70fcd594845613d8efa05699ebc09d2

SHA1
8003332662940225641e02c78dff1752e9cbe93e

SHA256
821cd5fe4def3718689256a797e593c7b990087503880efb50a00fa1e6e566ab

SHA512
40f028b9febd5e77ac7a83311d90727014b7c020b038782de11b95e61dd62ca2d3d099732889c580c49e64cdccbc6aa6f73c8dec8629ad0b0e9e119ceda69694

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
edf8d19b12731a7af66c569b25db863b

SHA1
61b469cddc180cb483b9e2bff085611d91b1fce8

SHA256
3b81071b4224014a21bdce57d299574521d753ab36242744a8e7220be33a2def

SHA512
7d335e04e05b67bcd3304593e9093cb52c232f11b971404916463f71c0184aec8ac0bdab560cdf20a4ba513c56e59150ba41f3d100d7fd41a441b5fe55df90a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
959c54df679c269890c1d21c32bddb5b

SHA1
bfc8f688c462b763beb18649e65bad75aa79f095

SHA256
47807fde342727dbe0b77553f78cc0b77fbebb18b210dcbf45f5defaa0836a42

SHA512
d0459a30b190be182f6d45f34303887f5acb61e48749ad97251fe06ba70063af55ea41bf0023569d55470f8cc4621685c30684df5afddcb8e0e747a2b6693040

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2cee211b2e288c16ee927bd0b5aed14e

SHA1
694ffb6912c0afc66e13c15b1f72feaae05270ce

SHA256
544b88d1fc63ea8c28ba2d00be1835e00a024958410f3dd0ea89a6df85541310

SHA512
175b81ad1a82a1e06b9f2eb0bb4f44de165158d4f97aa946177dae7c48a009241169d45153adafa104443fa1b21f44c7a0dd640da79a93a3d3304b2d8beb27ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0070920b5d3d5ba0ba1371282b813d32

SHA1
4b76282c082bb098a0c43ef42b3bda8954f2615a

SHA256
1696f1fb8bc15bbaa0b16d9c0207535ae7e99039ba36c91bf483a4448f01130a

SHA512
c5d1280858f9ad1afa23a05fef2b427d7e68c3e0584d2f9b37258fc75ac9cbdbb652bc8775faa16a9b5ab420f8e62c2e9dbdd4f0412d3637c3ebea557c9e4529

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
60cb2f47806404eb0c9a18778bf69641

SHA1
ed591270e1d5945cdd879e6ffde54a9b3d977047

SHA256
2a0ee1fea81d8ebd836337452bc05069665a5516ea9c42e360be970bd85e25ee

SHA512
48fdbcdf80d2b54b36482d04121fe6c292accf32993cfec30379b728fa12cefd08bdc8bc94b463dcda61b1337b010e6884a911bd10d8eb9274e6829e76c06615

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a14bdc689517069b43e2ef63e407a1b9

SHA1
4afc3935db438ccc165a79f53da5f9af8bfe8271

SHA256
52ba0498bcd6641cc3f54d1c279bfc14fa20309ae0551d27d08565f4a2393ee5

SHA512
c0780abc805eaf604d4b789cfc28e4cf3c091accfae40dcc3c43cb8112dcdbdfd4f9d0ad724cd4c3023b9690b062366118a6f6b3eb50d216c3fe91d4f91c4409

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d9e844e70af090c4bfa649aad612b0f

SHA1
fd5cb34b6b6569784d70d465318ff4cac9d49aef

SHA256
ffe0c4d32405da97555f5c4347faf8e7c769c8a093f108979cd82d712d9316c4

SHA512
4a3906090e020d29859e64045d290df125640b53f99a53a3afe5bd914e372b6a2b8a8ba6f62c8113f97f7f0587923c3a9ccb5f58a2eb0f888db967d4967d8c29

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1289.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar12EA.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit