36100e45e6ec03d790568cca64b23662eb1f7904bb41001819588a3bb34235df

Analysis

max time kernel
130s
max time network
140s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
24/05/2024, 14:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6edbf536114483124993075fca09854e_JaffaCakes118.html
Size

26KB
MD5

6edbf536114483124993075fca09854e
SHA1

e0c1ab137ae1624ae3580b3b29acd678ad676220
SHA256

36100e45e6ec03d790568cca64b23662eb1f7904bb41001819588a3bb34235df
SHA512

2c729af97b681c7451f6e57a5fc815ab13d6dfb9c521ef74c10079da0b0a7597500d4e6971ba4870906ae62300f5efb17f4f5e979c723e078c97bbcc4df5de8e
SSDEEP

192:uWL6+b5ncf66nQjxn5Q/inQieBNn2nQOkEntyEnQTbnlnQEYXC1AIpdEQ4cwqHXJ:jQ/g+JVOO

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422723403"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{58F74111-19DB-11EF-9A72-56DE4A60B18F} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2192	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2192	iexplore.exe
2192	iexplore.exe
2656	IEXPLORE.EXE
2656	IEXPLORE.EXE
2656	IEXPLORE.EXE
2656	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 2656	2192	iexplore.exe	28
PID 2192 wrote to memory of 2656	2192	iexplore.exe	28
PID 2192 wrote to memory of 2656	2192	iexplore.exe	28
PID 2192 wrote to memory of 2656	2192	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6edbf536114483124993075fca09854e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2192 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
875f949cd7aec21101690600f57aaaee

SHA1
84f4d590885f5d653a151c5ff267cf5decdb0791

SHA256
420bb13b1e9c71968a0efdea9043c4887dc4648520c396e13d158320fcd22d31

SHA512
a8ae710cc0c3a751fea593e5e449a0ae63db5f58547c734b0edaac22029199f6aa800ba0d0defc8a222f3d35a526a1f39df10241c598548eef0ce756fecb9b69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d25e27562cea5961fdecb4b98fa529d9

SHA1
b8314ba41d3ba9fd7e69672e87da37a8709bce89

SHA256
7c500929406990bb234ab35406cb5852d452a9cc1f8c276acdbc0c06f6f0ee50

SHA512
9699869bfb5bdaa19808929d1f9f8d4a61433cf232dcb882b518304071d90db0e6d72978736e76814ae3b09f4a1ed87c1e38edeb40996920d0639bcf1b3c60ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d88295ecee429202b94f0ecc454e4bbe

SHA1
abfcefba6bfa12c6271f5fb18aa6db3608d6ffa9

SHA256
9ff75ef700054ef0075fc3939b607c1fb47ab18f3d94beb0e07e4e0fad6cf3c6

SHA512
987939f32c141bb765dc1a1da07081187279d4e3a4a7b61af46acc89b94af785901acd0e0a44887f45e8acc734246169b4f020e6f7ce38aee6fa5021767d922b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6bf86e94e416352ce335179110f62a59

SHA1
e885c3df6973a9b7a5fe9b75164fb971f9c0f07d

SHA256
b76841d7607ea2bb185e70e82db48fedd161e74789fa737d107b782cc2259ef6

SHA512
6f7c1e8bd27b2e5a70fa4a20dc801d0904027a3fb8a69be6fe7db190731acbb55455635f4190c45c5af3e11067fa275ca5edc9020007d1dd0b83ed9db8eb53cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f5a2359be13557566cecf50810916b8

SHA1
8beac6a6e2741098c95d467e9361be9bd3e53352

SHA256
db781bbd54cc71811fcc48900345feabc5bc86f20ea53e5dbcc29826eb61fccf

SHA512
4aa592e19df0ae264073aa19531d8fdb80992980cab8d1930e903240cdec283e9377df5fed1995e6c26906d3af6abf381e087eb1b01c7d3356c56e922a3f6772

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f464a1df128e8cc3ae2dad316fdd978b

SHA1
595c632a9e31b63fe08ccded590edab3655b5927

SHA256
a129680195e5efee5d2baffc209e7fafd85419e602d862ced4b38a00bf6e4748

SHA512
867e4cba1a7edcc016a913e1ac888a24e3ebbfeb572eff05e8ed60081249dcc8211d764cfb8cf9d9b767e34327eafafead37c904374761d40ee4702a3b31a569

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b18a719e0e93278da10ebedb2486a222

SHA1
11d991a75a00b94e1243a617b957ea264f7a9e77

SHA256
4bb112e85b323d582525e48d78493fd80119c35033205f46e65cdb5906818efe

SHA512
4f5c922765e3ac84a2c41190941a2f3783d5c2a0d8b042a58a81ec88262fa8b83d2fba6e6c4fd871fcff27aaeebc1a5855c84b970cde94cb47eb3eb23672dccb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f3213b712275395f64d11ab5f9fefb6

SHA1
87f5079c7761cc949d408194aaca4a2742843344

SHA256
cb8b3ee5811f01323b13c3d6c24222f16715c28b8b89e8c79d3a9314441562b7

SHA512
a72b639894c934dd1ae3692b6d95065cd58d6076a57a2dc1659e5d80b65c7b171f2aba88006564645c00e8da50106cb61357efdaabaf53963f61120c78fa8734

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d503006f215922d205de943cb1fc5f6b

SHA1
79eac164c69f9b129def496a229cb9dbaace3efc

SHA256
81276cdcbbd7aaa4af45675ae72b5fcbdea4a86508cc3f7174bf242eac203461

SHA512
b09fa18b68021fed4a5d30510dbab297406fe35678e92434bc4f10568afd48941b6bbe824ffa558d49eeb11472603c99f82a0b4cc931bec95c729595d8c086b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab10F4.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar11D5.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit