3e922af703eadf147805225e8da56d7acbec173e9154a73c2f6a7dd02ce1202b

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 16:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6f2da81a25fd523f88c7efe6a1b7f186_JaffaCakes118.html
Size

18KB
MD5

6f2da81a25fd523f88c7efe6a1b7f186
SHA1

6b8ff7a1970168aff6ebce324603d4173cf9bd28
SHA256

3e922af703eadf147805225e8da56d7acbec173e9154a73c2f6a7dd02ce1202b
SHA512

4f38df1f19517253f4a3f5b66e4f3cd8cfefeb12369840800c53276609152bef6b75a2b13538be32e16ccecc329813fd60232e7be45809bb13a82fb4878d58f3
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIo4GzUnjBh6s82qDB8:SIMd0I5nvHDsv6/xDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8CDEDCB1-19ED-11EF-93E2-EEF45767FDFF} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422731221"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2664	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2664	iexplore.exe
2664	iexplore.exe
2440	IEXPLORE.EXE
2440	IEXPLORE.EXE
2440	IEXPLORE.EXE
2440	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 2440	2664	iexplore.exe	28
PID 2664 wrote to memory of 2440	2664	iexplore.exe	28
PID 2664 wrote to memory of 2440	2664	iexplore.exe	28
PID 2664 wrote to memory of 2440	2664	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6f2da81a25fd523f88c7efe6a1b7f186_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2664 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ab5c61d448828009220b631d4aa87cd

SHA1
08a2ec2b0fb0949d3b7a37b9fca0e2a198229296

SHA256
abca72862e9193c827f6285301f03cafe9d99c1b98efadde88f8f5d7fedf7394

SHA512
c7c6ab8d28df3eb1bedcaee7b695de81d4e98557703ebd55d9484e2a2ec8dd086d2d939792afdb18c84860c3484dc70bbd7e8b8294a7c3b80c5b09762d6c6ff7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
408d338d5134e716915ec7117fcc7016

SHA1
6dfc461a82a955f956275bef36e19e3f14cb98fc

SHA256
6e6ee52d64700d97fd63d0c521efe6615be68af6f23171b48edfffdd020d0c93

SHA512
24b6ab8e7bfc3d2206fd789f341af4f0e7a3e512f9a2c36d7991f0dd995815a621c03b0feb24fbeceb2beb9e8f44f9b0376a4f3e6a240ccff8886d282e6cc682

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
12ab6b2518d1a9181d7fcc535f476e60

SHA1
29fd54d59d4d727f86ed5da63a19f6ec89a4f0b3

SHA256
387faf1de0660afcfce04cd425597524b14818d6a2420c25670ee14f03c5432a

SHA512
5285b6ac18f3769c61f9aac4bc527e6f941b7e91ef4e962407d2d98d4c9355b5614701c951e97f71769d576cbf08010f9628147e9cc12de88e468d6312ae7759

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c909bcaba445eaaa062dda5f018187f

SHA1
c8a176835b705511c29010da00ce7acea02b0b19

SHA256
24a6af7ea2ce916b6f2d37ebca554a53b28b0d0391aa9bd63d0fc442dc1a5473

SHA512
b6dbb511deaa8f147472c92bcf477f3589cbc682452e32a50dd823e90aa53dd1bfe2de3bf70a1837b222712ab06473f1f5997745ce2498f228820c8792bd9266

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1307ce041e3cb8f6a24e1a1e3cf806f0

SHA1
e790cd699132dd5968e5d39e5595911dcd066187

SHA256
1b32bc57160b29a29e69757ff200caa8f091b79ca3179d60dea2a6f45c87be18

SHA512
36748c11bc0f15952df09b2e864782bcbe8046fbe7c821147b5c2b645e285e290d7be2dc82ff87ca25f9360cd6b7e925ec943c25fb2613ba8517e5c8bddd386b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3285b87121a39803c36a11038c941a8

SHA1
26f9970e5902250444509147e09e7f9367c4ba5f

SHA256
c175f7189796a043e1bfb7d2ed6924ac9027b2d5bb8b63ffd3ac29af56277e5f

SHA512
0f748ff0d2fbd7d5e8457672459d2820d00729bab4073629315e0abc43000577155d0efb3b8afbe902cb3aec4238c00bd7fc476fb9013ba27253d0cc65e74112

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4b18755d1695da56b594775ae48e9ae

SHA1
4efccec95c386ec683e4b1d92dfd2ea6898c2df6

SHA256
239a736963c23a8e7b609b37f5e550d6ea66cfda33b48fbc81a4d9704d40c480

SHA512
15b84ac2d11643a7fc123f2318a406e2512d23feeb4d1fb89a74148a2cfbdbd80eb172c53fa99e5830a0dfcd20f639f125dfa1ea9a21c2677897feef4312f918

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f665ae7f0ff3e4ce03461eb27326bbe

SHA1
72167b7c3526c3c13a9436f74e4a15afed283839

SHA256
13757aa40c09917ce1b62bf3595e967bdbe487f18322015f9b1397067a3b003e

SHA512
002295b700123d37727c191a1ae05da3d66dbc7efcff942ad24610f01f7d14e3241d16678415e93b8af2e401d32b31875a3ed868a033e5ec37824172e4a4157d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0cf634b86d3d136461581069903cba7c

SHA1
cc1dbbc38d37cf693403176d5a67a2815214e0bb

SHA256
49342355a918c3c8b84024f21714422263d2d87ec6ed8718a390e2139eff6a74

SHA512
6c8ac8d5f1713e55fa1a0e730c9f2d15824c96b34be9b05415a44f6e1d7ee3ebb203062585e7c0707826e933f200ad8a5b243edc4eccf77b4a2c4c9ce779aa5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3075.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3166.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit