96811fe060e7071c829b9328fc26e16b43ca4421ec1db6a6e242bcc7ba013e53

Analysis

max time kernel
121s
max time network
135s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
21/07/2024, 17:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

60d9ec6c6f965c8112d116ab6eb53a4a_JaffaCakes118.html
Size

23KB
MD5

60d9ec6c6f965c8112d116ab6eb53a4a
SHA1

b69df0183c8046ededb911e5de5fcadc14564be1
SHA256

96811fe060e7071c829b9328fc26e16b43ca4421ec1db6a6e242bcc7ba013e53
SHA512

1e9bf989d92152be300e3f2c9a8c88b1ddb086e729d88d513cc87dd9ef7fefaf2bbeef75faa0b9f1495f549a1f160fecace30cd2b101b7c32f24bb9a3369d7f0
SSDEEP

192:2VQlIsr0kf95EqxyYL1Zvn5QOhEkkBu+KC8k/w1wvqpLO71BLOXuBuLbdU8d:sQlIcVfTBJZvHWfF/gnLOxBLOXguLZ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427746602"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E4B99FE1-478A-11EF-BD32-F6C828CC4EA3} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2324	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2324	iexplore.exe
2324	iexplore.exe
2236	IEXPLORE.EXE
2236	IEXPLORE.EXE
2236	IEXPLORE.EXE
2236	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 2236	2324	iexplore.exe	30
PID 2324 wrote to memory of 2236	2324	iexplore.exe	30
PID 2324 wrote to memory of 2236	2324	iexplore.exe	30
PID 2324 wrote to memory of 2236	2324	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\60d9ec6c6f965c8112d116ab6eb53a4a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2324 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
73b1c937d4d206b1bf4e0fc4c7d55734

SHA1
8f66371831527766d7bc7087be977e3aceba684f

SHA256
d36745a9431001414a57ec53fac0b75696f90a811be6067617fb901752989fa6

SHA512
a034f40a4ed349877713cc06928ce6f555ab0a00ca723d773a85e639caff30d7c95ee6aa85645b014c47958487fc1aa31b452dfb3d274eaa65018e894690a117

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d88b78b85e18b147f674d0c6eacc4ace

SHA1
e6d57b109aa43392f4221d0ebbb97c1ffddeaadb

SHA256
51103f34249d1fb1db9fe3a885a4e5c12df4f75ac07d45cff2be028198db0423

SHA512
3d583475cb138b68007ad6202585102d79fef247c467eed84145184061cab55b073911a5d63794a88081d924407f9fc95944f53e1c6fc01c7c20d50ec2d8af7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fe9ff11d1fef4d3e07f42b1512414129

SHA1
962379c8589aa6091cb102726f882de45e282099

SHA256
90d2d311636e33af57fe084cb445aaa1f3a90e3be31027f03afd713b995f2816

SHA512
7af32ce9e3e01c045d6b37ef5993b23dfc3bbe2205b15597f2ca86757e0ff36ca52606ace258c88eb1fd5289f5372aed73d038d5c283c5712f58adb369d20f48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b61c189c448ed99d1f1d6883c6a1ca9

SHA1
9859d2b5afe59cd0c09d552c7b67c393c7142795

SHA256
8a13e27a9640515d5ebad267d75e6108a6fa5101f2d96f59064570adfdd512df

SHA512
7a01402dcc0022c25b4102c067698db1faa28e9fb0783096183f4008a2a45e55569bba0c0261e11c5f2019962c4bfa4f5d38040b8ea968fd4731436f9e315657

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0f194a95361af027351047e1d9ffc4b1

SHA1
ebe40348c913c5ffefc90ddfae40a4e050370874

SHA256
0c99f8874d078fa8371d4972d57694380f85ddb15048f757bde39f6970a1d745

SHA512
d06b8236d6ebfe6ec5f757869c0d8c26756250c62d69d9b314442b689b50bde63dcc9acf7e357741185f5552e3c8e4000b948af4480144d58ddd48aec3451c06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fe6dc6e4be187dd9bc768d94c45da723

SHA1
5f6605a4680943e3784fa6064f0587f148acd8c5

SHA256
ce3f3b45d8c8af250d2d759fb1b27c27a7eef03020252282ed248fa25d721847

SHA512
137f4ddd46a00ce8b338f80529286862d56f6a769487e47af0d099bab1477e1dc2395a9f24fd258f53be86f1c9db921d9eca3c90bad40bd23e23a632860abcc1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f9a3d6a9583f2cd0bede51c61e8045a2

SHA1
50580635225010445cd134b96ae1bed68b8fa98a

SHA256
8e258e09c3cb1d0b2e815ef742e86ed309769c67e2e4d0da62f6d0f9197f7854

SHA512
6a3d5fc9d7eaf75059c8fb55efeeb65d875121c7f6a24331bb9d5da8e8b37dbca15973ecf5f3684a50b0c380baa52aa87fc8dc617aaff2a21b6134cfdb95f751

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9ccb4786524510b262a6dfc535a03f53

SHA1
7bde239f9da0b620b67afdd7e28bba7d4d3f596e

SHA256
14975394e684e52e0a136d115f65fa01b258343c15b266a649b02fc9cd466c64

SHA512
2f4750f9923ba5f9b0d98a4129256fdd092bc348dd987548b24bfe4f7e02b26de5ff66476c94875b550d0b4e470625a8baab223d873774ad51d2f3fa03890377

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
208a1b3ac28e636d725af5a140278188

SHA1
330352d7c5907b348c1cc50e85324b7667f74595

SHA256
e256815ffd52445720bd0eeccbc20d7e4be9387d048d5a1eab85e0bf298752ed

SHA512
23e9f0234a4009e74111df2e73a029d97056a24a73646cfef6f5c84538eb97adc8f68b88392240d119d5c10445c665bdcd17cfd728374ca6765e3a1ea0360bf5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8cdcd6a0802c857921e739df111a08c2

SHA1
2a9079e875c6a755c50ee2e2496b53f93bb7254f

SHA256
c5eaba8fd6579c6f2e0f17271ec4dd65aef4761f7e2ff3b877103d924a511e39

SHA512
5339c34d1ed5de06769d1e68f5d705f755328251451bf9dde9cf263399888936ca2705bd87ec9539b8a99c7983d1254d7f8445badce96d617864e179c6d83ee3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7821adbe367b9128b05bc4ef3210536f

SHA1
2ddf720692b8097c132ab8d312dc61f85e2d85ea

SHA256
eec6faa415746c439de2302f81389568b33de8033c6fe847cedb8554fad8057b

SHA512
1471d5ef670ea6bcda76b6b821d71a3e7db400808b1bf9f80e9b03367c18149eef28026467b5d4687263fd99dc219c78d759242893cb3b536ca376c05fe23873

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA0F1.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA1B1.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit