6026ca9dd587aecd049f4dc1cc212f882fc717d857889d35dacc7d25022f3cf5

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/05/2024, 16:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6f1ed205bf7c0dfa6037789fe8d5007d_JaffaCakes118.html
Size

70KB
MD5

6f1ed205bf7c0dfa6037789fe8d5007d
SHA1

71299370d4138ec173ca38a1735b6727f8d6ad6b
SHA256

6026ca9dd587aecd049f4dc1cc212f882fc717d857889d35dacc7d25022f3cf5
SHA512

be7628b701cd598a83c5b77d631d406ce2e59f05de23c8461bf4d1dc1529c8236ea1476a1118e60fea9e928ef19151d91f92a939a9be8c21dc1573331fc53dfb
SSDEEP

1536:5nk8vJVEOr+6XKZVU03Y/lWvQW8Xz+LKtzF3iAv1nXyZiqJ6Q:W8vJV1r+6X+xvQWQz+LKtB3i+1nCZiqf

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422729807"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{42187721-19EA-11EF-A4EE-CEEE273A2359} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2528	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2528	iexplore.exe
2528	iexplore.exe
1120	IEXPLORE.EXE
1120	IEXPLORE.EXE
1120	IEXPLORE.EXE
1120	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 1120	2528	iexplore.exe	28
PID 2528 wrote to memory of 1120	2528	iexplore.exe	28
PID 2528 wrote to memory of 1120	2528	iexplore.exe	28
PID 2528 wrote to memory of 1120	2528	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6f1ed205bf7c0dfa6037789fe8d5007d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2528 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a21bd1e52c118946d600ec46d190e79e

SHA1
f146beac28dc73d0c3537ba106ad87c95beeba69

SHA256
4050699b3c8113e6869f387602d47a497bf09d167fefc48870742527a00475cb

SHA512
b0928a5c38475313c5abeaf2f1e71a8b277177d1e3981bfd1a3c6dd7e79d219b418007016c34b0784175a6918b3cf709fa5b1e84722e97f0c0d8c40756a9d926

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20530711b563b28ad818b33e00c26d01

SHA1
e978172171b20e226d2891a86751be1cf3bcbfbf

SHA256
0f78aa6d754a1ba66c605c66b944625bb999f42948cc4207b55abccb027af369

SHA512
4df288f5efb5b623c30eefbee7f2f416bc6604563019217229305724ef34a7bcd516cf1859f4921b9684c828bb1a950eb6e14c950b1940a15262ef4e16d0d258

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3620297796b71a59597c7b4dfd4dbf8

SHA1
dde80fcebf43cf7481d7c904b0a09c67109b5a8f

SHA256
8fe81237566dafbf6647a8e03a41ccadaf5d3cb9dd38251ac94db918834a8eb1

SHA512
f5871fedd7c271d130e053068abf01b123d305f887bfd333b419ed6fa7b94d99256feee5690595d853f185b601c3498102e9bba577ddc4791b8b1e1f9029e862

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
35c44daf33ad804da1d9b1379bc53cee

SHA1
0ee45df4b6b1b98c89af6542dcfb36a8341a8a09

SHA256
0fab1e58b007c8f9d2beae6dc75cfb9543eaa824f99d9be48152e5bc4acc5e0e

SHA512
77420f0504d901671c6b0271931276565adfbf09c1a09e327fcac7db350536edacfc37c8ee097f8f28f9e824653850931fa9b1141a4b987b1691e111a3c68c0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa05113fea5be03f9531a00899c12768

SHA1
08835217a6354494ac175d69724ad17872bb53f2

SHA256
daaffd90b0076d1c5e1b0e2a1b4c8af0f27a91e98dc29f576edd80ef2815e2a1

SHA512
7084a1f9fe21606a3241d353ee538290060f78d681bee1f5d28bdcf69fadf9abe3a6cf54cdb9a8fda1186c9c98c2e9433441363877f06003a0f254d4ca72c480

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23e0875491a9e2d7c6b960dce7af23b0

SHA1
71196954776ee379b08089cfd7ede938d9c19292

SHA256
6bc6ed28b13d2b9302a5347d69669f442dba441c7d182343463785366fdc5690

SHA512
256f28359649299d47cb145c9cf6ce633e2cf80521fbee0ba2d637b198b2d519dc8135b495ec0a4456fecf5335a8991eeee0581d1defd608af8fb6b45afcf3a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c2f5c0822235ea489ed9888667e21173

SHA1
68af1d52df37fb4411524b7f2f9a373aef1b4c2e

SHA256
31d450362dd137eabc3131a0c3dcd214c5df72c4024aa4f1b9245009d9b27a10

SHA512
e71bf6b9dfc47970f0127e3672a2553df597c534e599729ba7b554e1d553e96108d5a8196ab28bb67973f581030887e98c6dc44e162006c2229c60516a654d88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76d665113feb37dd885731f25a43e4b6

SHA1
c34f65a3cca51ca823953eb79b1ae1100952bea2

SHA256
1f02bb0c4bf28a0b9cf14fc65b916e9e7ebe814426b05d0e65d9bdef208fb786

SHA512
8f265376f386929ff0f407e44166669dc32d0be3b0a55dc00af214ff95414f58d0067905760e3c60b4202ac44b86a5e7e70820ac8e553e2a7e5bf06606e80946

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ffc8fe46b8d31f6099842334542f2296

SHA1
65c36838817a14b37491ba5bf0c9dd64ccaed426

SHA256
7b6f453c9c961d09d87911a070802530b011481b5370d3686c3ce2112db592ee

SHA512
019c08e8bd3bc76caac57733d3c30a4a3f3b0acbeb8f7fd53ab518db15379ddbc5dc6b17bfa279b7b4af537c4e6cade044005dab1c47d3ab4144ed1713dd9630

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab100A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar110A.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit