6cedf368120cf528ed1be4236b11a9cb7b0980458ddd849c5ffe888dc0c7a486

Analysis

max time kernel
138s
max time network
146s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
16/06/2024, 22:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b57e5ed4e22c2a83bdec581db6d811f9_JaffaCakes118.html
Size

3KB
MD5

b57e5ed4e22c2a83bdec581db6d811f9
SHA1

3313ea87dab325436d3daf2498722a83c2b81e18
SHA256

6cedf368120cf528ed1be4236b11a9cb7b0980458ddd849c5ffe888dc0c7a486
SHA512

497a30ebaa9168a796dc13b20d1e0111b5e3c62337b5b745eab57d6596a0c614615b8c77a7d32e3189f4ce552c9d37e1a2495911108a3ed34909feee9baf376d

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{999C4881-2C2F-11EF-9BF5-F6C75F509EE4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424738711"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2944	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2944	iexplore.exe
2944	iexplore.exe
1164	IEXPLORE.EXE
1164	IEXPLORE.EXE
1164	IEXPLORE.EXE
1164	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 1164	2944	iexplore.exe	28
PID 2944 wrote to memory of 1164	2944	iexplore.exe	28
PID 2944 wrote to memory of 1164	2944	iexplore.exe	28
PID 2944 wrote to memory of 1164	2944	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b57e5ed4e22c2a83bdec581db6d811f9_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2944 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b59e1bf290710d559bb8517658221e2

SHA1
72370690582e33a205f45e0191a990eda6c03993

SHA256
4b111c32387b64c0a2be9982a1f01ca2b75b7330ff2b515dbc46f0a71660a42f

SHA512
0b09fffd5deb609a4f2d3309382ae56ced1e7c794353e46d9c2a2796614d7c0b8b239617899315d8d78538cfb954edb6702b5d62c3b18f09e160c1006252d936

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9238f422eb1ead3b9b87c97b0c5195f3

SHA1
3ed23fb11a0b58b2a59d2e2c28a9af5e97e848ff

SHA256
4a8c09787770649bdda3178203b4d6246befd9c70d48cb762ecdc07a058712ab

SHA512
9f630833d608fda292db0066aca88c9af1330abfed213a7edf328563cd5895a804896b7f52bbf3f81d534a5f58fe6d63625606c7d6f4e94587b6d760617cd88d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0a66d5004325ef386e3979f08179789e

SHA1
55f52dd1784fd115e4af8adab7887f600dea1dbe

SHA256
2925c17b59908ae5ff74ffec3b8931c0ab67e5d08eabe68c6ca806ed5e7087e6

SHA512
fa7216ccd1f5d3659fbfc095223217c4350cc2259b440b16b0793ee50ed3516f10c946748f4cd8339edb88227d416f204e6c4756effdf4918f8767834c3ad0b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
12a0817c3a61782e7b70141f39368191

SHA1
e590b70024fed8ca594384c853f0e336369b9bc8

SHA256
f1d7f5e4e1c4968287f512d34492d874c814433701e62cc82bd49baa5f809a37

SHA512
75594cc1ae5df8930e5a3e70f9a265f067fae6fdd8f51ad5d41c09642e1b32fcee6bd28765f32c740ee534c51f05134dad3ba90896fd72e11643fbd92cae680c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bec767f5e3f1928e73968a3fe838da1c

SHA1
0acd0ed19d000b54ea9f6c19b61c996f2fe0e71b

SHA256
4e75da527a7764e5745fc845b622b5723686a9fe8ab1bcf5d7049e7dfc78e634

SHA512
c7da61bd4b04da2050801337eccb1f47188ffa21b79c47f326e99e73d2aa6d3b69a89a1703fd1201fca20e339382c7c12a1a1b9b807ddda260d454911c378265

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
20147c2110abc97a63609ed52514b743

SHA1
3cde806190796f0d3005a5892ed8cf46e61a7dc6

SHA256
09f181d9d5e91959c9aba281956e2810d9bcde37593952e4d7b1605d14b71f04

SHA512
22d7bd3ff27e813d511863a81458a19275d6bfba30b00e80c8fdafa196e60d25b626069e77f70a8fb7b47690e90749af8ac939b39d7b0b77ca7278a5f0bb9416

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b3593c7249af9cde18ddac7243ac12f1

SHA1
2a4acb9bc3e0ef53fc62c0db6379275daceeb207

SHA256
44c9c32d43a8aed4e0b5c2bad884a2b4aa7dccc626c51b32610c552d718b6fc9

SHA512
62dfaed4b897916ff142c3e4ac99cd7949198b659a73f359e8d0a0a3d2e7465fde945347ba2e262b877c48c65a9617469b1365d1b168b3465652aea36841bbfc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eef59d682634f0f456eabea4b12c88fd

SHA1
066d7b2cafebba7530bdaa57ffb04444ff6e691d

SHA256
7df3a5bed7425c135b2def0d4b7ee5faba20a1dd0b647e0d717a5045c65f8297

SHA512
7224844b5cc719e160deffa79f9821361baf0057ca123b69e105e4bc788fb3b09157bb958796a68a05eacead99de0788086f463407704452cfdf13336cff0d63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0bfd5e86930266b37f2d6d0d29013daf

SHA1
20b2deb0a0ea298debe70cc11c6d24e8b3641220

SHA256
d097b9277696e74eb85571c253262b1a315845fdc2af15b22dab36155b0d1856

SHA512
afe66dbc9959f5ebb5a510bfab1e8ace679ceba5f11805421f998a20036f981a48616908814cca42e782f6629d3756c71a0c3c533d67ff2b272e8ffb2319c4a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b59c25f02d4d5351105cb5e13264c062

SHA1
c8b434df32173c2778e26eca5fccd37262766f27

SHA256
795fce290aa7c879c099bd080468efa22dbf1f489143c7c2754c74cd6c714950

SHA512
5bc35d4588ce8b72cd42ac1bd8fa2320b01d85fb94d22169debdef51b122f4298728a9a00079335678ac4809ef0b214f92308fa2bfc03681bfa352736fea4b87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b34bc63f8f05ce7ee5726c0b58b5c8e3

SHA1
0287e152b7ab9ffb4ff036e60e5277b46b1c659c

SHA256
cbc72c8fc4c3262f077ec7b47ad9c838f68381b0f9a0edab6158081749bce726

SHA512
9cc71fb8b16fd0c6652a72a96eb69db7b103e98f66fc3f340b161ed45a147f29582b7e18a0cf87d4ddedd205d5adafbb35d6b4b567e0ddeeda649fac1a1653dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab69BC.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6A9A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit