6d6e92db3d4cc1f7db75ff53cf741d8bb086220264fb05447ad8be5c0b57a91c

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
15/06/2024, 08:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ad84608f2d134fc4eb6238d641ab4c8f_JaffaCakes118.html
Size

23KB
MD5

ad84608f2d134fc4eb6238d641ab4c8f
SHA1

21d4a23ad3917ced750a26a8254878fde4601306
SHA256

6d6e92db3d4cc1f7db75ff53cf741d8bb086220264fb05447ad8be5c0b57a91c
SHA512

cd123249e473ce0537f56ae53a42f7de78daf582c48b19fe3f0e05780b1c47832fdd6be97d31f53ceb19ecdbfc685d99b683340fbc231390167320021c9d4404
SSDEEP

192:NIhovISb5nlnQjLntQ/OnQieAnQnQOkrnt8TnQTbncnQ/anQtZMQnFnQ7XnHnQTu:uhoQfQ/Pr

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{79090A81-2AF0-11EF-A490-4A2B752F9250} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424601646"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1748	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1748	iexplore.exe
1748	iexplore.exe
2304	IEXPLORE.EXE
2304	IEXPLORE.EXE
2304	IEXPLORE.EXE
2304	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 2304	1748	iexplore.exe	28
PID 1748 wrote to memory of 2304	1748	iexplore.exe	28
PID 1748 wrote to memory of 2304	1748	iexplore.exe	28
PID 1748 wrote to memory of 2304	1748	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ad84608f2d134fc4eb6238d641ab4c8f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1748 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3cd5ad6b50f857a0f474df670a6225ac

SHA1
4f118da3d8e71e40ff906ce9e85f7d3ce6aab344

SHA256
92defe71acfae713189e653230a2802a0f1b2db74bf7d12519360fceaadbd27e

SHA512
ad35166fb174631d79fbb71d7e57101d88b6bd49b5ece2e66933b8521765d8b44577a3dc83fa91171ee2fce00c9cec2c479f1095532db2e005061bf97fe28a10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
45b06ceda9e9b150405297f18f94e7b1

SHA1
d9e7c44344f764a5cdba295a10562d0269acb907

SHA256
50a4672e4eb76738f8d67a67a0e4068fd772fa6072baa4b4299739c10e75c4d7

SHA512
e1f06d71985e088f4bc4af3a0cd88827ffe826e32dc802b6295ef73c95197f0fdf5a65ccbd70e363a01ac19eca7dd7989e47fa6b6c5c486db375641759651a15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f9d0f84f1879143d547a535863cfda00

SHA1
d3e35b7dd4412c173b8415d98796659224fe1816

SHA256
1352ac9b5432d24cacf8b822fe59db3218b11459027949caca4208c7d6532449

SHA512
a4a1bc00fb9d6eb8cb7f7589f4bc11a07063d58e49882761a0ab885c8043e124d8eeb9d305e6dbb37ee3a52f16f63a8831831adbba45e93f7b9a978166d42905

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ac73e149a221fd3a9df423dcebe93777

SHA1
9cdb3182e8f2d017123264a7273327f812e50282

SHA256
8718989fe16e211d29e9f9de9418c9e23050bc792c968ea9f27c9c8d06b3c069

SHA512
ba655d17dbbafd8f4dd4ac324c481f8ff4bf48ab3de06db1eb8e5cc807d4a314b942ad2a523923d6c041ba3bfaebe93b8612e411b88b22fe56aa31bed73e0f2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
48cb996bdef01cab7783d1c011821d42

SHA1
e624d54f94b98d0efd208d17c4348c6d722dbeda

SHA256
414a99ecf87f90177f831fc16785636b2f5f0476891aa6dc9b76b5686a2a3893

SHA512
1477cdd8dc1d74026fe65d108feac2b16f006b55398c4e741dc9ab31436503f09cfaaab56fd182033249a7d15c5f54b89f73681f4d0a8294bae8066c35128d91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
08917d17cb9b6caeaabacaee6d22556f

SHA1
c340fe2643dd4edb9b5ca4caad6d37e8168d75cb

SHA256
2af035c62d08a79bfc8321ed1811219a5127dc3655bdf4e3e35072d1a44cc5b5

SHA512
e0930887730bccef9ef0df42c55f1f95b28a8a323b007ca7abf2cbe95379cd1a476ec9d7ad5cbcb7fbdaca6eb56175f05b8ef6241babeb6b678cddc605bb9f1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
17cef852109d2ffb491419360bd992e3

SHA1
a22d4fa54ab615c8108a6e8f7eb90f426f6a7884

SHA256
c7ca1a4003ca98d17ef266657025c2651ca05a9cc7f6a86a46387538eaca8161

SHA512
52884227f8bc249b4db6a948d14394a9dd168120e7a307b5a43aa4014f3c1bf70157d7207e72fbef1df3c0aca10e5f553d429f600c1b9cca03d7b7a483d26d5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d1ec40d6f09143bdbb9bd1a5f31d5e1d

SHA1
ab0e9dd4afb92c18e6673c078684d576bfac7a37

SHA256
b0d0798e0f1047de8109822600ff529be6858aa3a9b7120a2883a1c419f6e72f

SHA512
c25b5892b39892cfdb992e45e652b61c09570ebdf94c974907d7e283d5cf4fe420b9743e180f422410193b80c6c9d6bf6b8069f2f5c13678c7098934cee71965

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC22.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCD4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit