f6161ba26a7836a9070177756549d65c6d3c64a9c87dd219c5ae4bc8cff0f597

Analysis

max time kernel
134s
max time network
128s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 08:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1988b7ba7f0b53287a445e7fd7e91ce5_JaffaCakes118.html
Size

5KB
MD5

1988b7ba7f0b53287a445e7fd7e91ce5
SHA1

725d14cfc71917fd6b1b6ab8174bbc5f0bc14f72
SHA256

f6161ba26a7836a9070177756549d65c6d3c64a9c87dd219c5ae4bc8cff0f597
SHA512

ccd38393cf10f2aea6ba269e4251e940c6db251509a9212c13d07ad23d964d48d773e09a79a995a0c9b6675a52349311b018826c33bbc6ab2d4e6a5d6c315567
SSDEEP

96:o1I7dlK9rWMrxN7v7ROL3AyNKTpL5z/5I3KB4JjGo3zkNgBqO3Y7cYmq:o1I7TYTnvNC3AVNL5zHujGekWBqO3A0q

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7838CBE1-352C-11EF-91CF-DA79F2D4D836} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425726926"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1656	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1656	iexplore.exe
1656	iexplore.exe
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 2716	1656	iexplore.exe	28
PID 1656 wrote to memory of 2716	1656	iexplore.exe	28
PID 1656 wrote to memory of 2716	1656	iexplore.exe	28
PID 1656 wrote to memory of 2716	1656	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1988b7ba7f0b53287a445e7fd7e91ce5_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1656 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
33ec089e7faa5ce9e2b37141461cc429

SHA1
25b2910164e2c82599d77c785bb9e1fb218ca787

SHA256
1fb4e9c450a19b7ceeef7e349d84d67f0734f775479b9d69f084f0249866050a

SHA512
5bd27dadd78118c028e8381335bd7e12d72c5b79e21fda2b9364171cfcd3afa1e0fd9bcd5cf1841c97861bd5a36b94434bd238369f4f8b298f1e1602e8f360eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
12fe997bed501003cad8f1773ca866ff

SHA1
4902b4e26f480a9673f224d39aaecf358b289f31

SHA256
8b9edc23ceecba1012bf9c18d3c8a3e9d5755fa6e50d95dcedad00401f614d9f

SHA512
3f424b334c0a80b409abb88f36cc73d9f791f91f6394dee093e28f9719ce89774c38e5698a3c1cb11af1c00bbed93dd3b41f683bb14c96f394924816201ca65b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f4f21d4d2885b5e2cc256e8945758fb0

SHA1
bf957b96a8532aeed0afdd22baf636b78a237d7c

SHA256
54e944b4fbc4b319958ef8c85df5a452e304173c7e69e324667e172b5728c130

SHA512
794e3d770b16db66591dfb30e8eae98c1a99ec7ad76ed7aa30c57e4a0b7c6f73c388f5a875804e2939ec2bef11fa2a379d217c5b98ad06115b72b307371cac21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d282ea28b07a07f62d1eeeeb54b71c65

SHA1
a4233b283380fa14bfdbf8a8589d7d9607d12030

SHA256
fad3d49086c9257fe749de3b50fade77c5ef0ca58097c4be7a54b4925b2d4f03

SHA512
cd822150c1cbb17355fd8cde6eb83f76fb49e384f7c31309d74d0db971d942139ba4fd5e509c16762e5638c6a143fc5f1338225242d21e80985f78550314f452

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8464d2361cd978f4898a10b4d8a530a6

SHA1
5cad1f24bf91eea56bcdb19257ea1bc067aafa53

SHA256
ada7e4a431a9408c619252861dd9f262ce5ace7377d395bd3afbbd23d8950314

SHA512
df2498d081ce53289d848f0c137f83c5c6d0c1960e8b62a26391c65e12d1a846ba82ccaab5c6177fe60ebd3c0219bdbc9dc5b8bbb08c5dc336d896067bf5bd49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d5dfffb48f441dfbbbb06b19a20df7c3

SHA1
e93f4f52c3f083bfe51db886f835aa03582eef1a

SHA256
8ab3cb7d56768f8c5a737751bca55cca86926e46559b2dc3d18197dfc0d18285

SHA512
3a3773bb71ccae549f622e12fa073b5bb1fc9e6122e381614e552f35616edfb8f6c4dabb2c978c021a9d8dac5c5023d4d8fa43bb916cc1c2610811604efcb792

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2e19d429b69a810e1cb9599b7625b90e

SHA1
1f602bb8c2bddd4f49eba5c343a3c8cee91e22dc

SHA256
2bad92b61dfc50becc2c9d84a5415632f4d29f6800579046620a75cec44f9472

SHA512
00b5e681d12b48584b010773cb115a1e0c75d8595a792cb600dda559bf1ca5733d58c63e2b25a106711dc573844621f32e0b920b7e053dcabad927b8259d5efb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
29275c7fb3b95ae76279ac527fc724b8

SHA1
0774e109a4bcf1acef2a997a45063323ee5e3e12

SHA256
4adcfb19f99a287105dc89f6eb015dae9eec464df66670f4ee2d1a51d6684fbe

SHA512
bcba046978dacaa6dc2db2a45dd247814fed22c0ec83fc04302352d47ac69c83259e6202ebbd3bbd850ef130fae0fcb51918d6dd40c4056e5aa4fe8c87f32efc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
479d5711e6b06188b4bdb7e843f77536

SHA1
f11acb284d1c3d1afe846f956eb9c77659ea0790

SHA256
8f58cec49329a0d7f4ed4160523a97f539a745ba17b0665380470bbd742e000e

SHA512
dfa5efd84bc8ef054b7b7a30136d94f347e8ab358bfa5bff34cda446e2ecf080724181ac3bf3df17e0a96221fd28430c48fb8b84bc133ccab7ac675fe79b3357

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab14AB.tmp

Filesize
67KB

MD5
2d3dcf90f6c99f47e7593ea250c9e749

SHA1
51be82be4a272669983313565b4940d4b1385237

SHA256
8714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4

SHA512
9c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar155E.tmp

Filesize
160KB

MD5
7186ad693b8ad9444401bd9bcd2217c2

SHA1
5c28ca10a650f6026b0df4737078fa4197f3bac1

SHA256
9a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed

SHA512
135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b

Download Submit