61f037a82fe34929c70a271f5a39077567e7ff3bd815fd19f05d14eb2a5eb85d

Analysis

max time kernel
133s
max time network
146s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 17:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6433e09057a907650473b3bb396d366b_JaffaCakes118.html
Size

28KB
MD5

6433e09057a907650473b3bb396d366b
SHA1

517b8451712e0bf1de122cd6b67d8db2a9ccf1f4
SHA256

61f037a82fe34929c70a271f5a39077567e7ff3bd815fd19f05d14eb2a5eb85d
SHA512

f38d5051c34ab7e69f4fddaf94b15f8e3f289a87693d3424de85216a4acbed478c815c7bc1a90b039aa5ee1c80f49449c93622a4997f6310683979c218161bb5
SSDEEP

192:uwPUb5nNqTYnQjxn5Q/ZnQieUNnEnQOkEntbbnQTbnhnQ9e+Ym6/JGWfbQl7MB0y:JQ/gLAhGWKSr

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427832989"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0793B4A1-4854-11EF-B9AB-7EBFE1D0DDB4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2680	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2680	iexplore.exe
2680	iexplore.exe
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 2080	2680	iexplore.exe	30
PID 2680 wrote to memory of 2080	2680	iexplore.exe	30
PID 2680 wrote to memory of 2080	2680	iexplore.exe	30
PID 2680 wrote to memory of 2080	2680	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6433e09057a907650473b3bb396d366b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2680 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a1b8954a738c0298fc21d93482e72779

SHA1
44a950ea970bd6fc84392313379b983c89131940

SHA256
1ad09d0bd80c7cc0e3656a70508359b76fa769f4deba5156997acdc8818b2fdc

SHA512
f00d2d41128279468c1b5d2caf40ca97c68b622004d027584acf0e575164f930accb48becd84e7544ef05d3509c267d1efedf574f9bfc852f7d0380f33d6e569

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
12118770da3b4ebae0f3fac843193698

SHA1
8fff4a509bbeca949cefa0e7752f8f1e9bc645ec

SHA256
281e31a4fbcae62543dbb76523204f835c77b7b63738feb8df502e6c64172a29

SHA512
c27f2cc62dec310037145fdce6f4312da01711a2e0df69c0c15deac43b4d79485011cbe0d405097724cbd31dd9e94c712c27a765f3bbb8ed68e8e62c47c2240d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3a2f32ac1993ecee671223c8624d46cb

SHA1
061c124c23e8c02c8345dfdec2349691b5379790

SHA256
10eac97d9fc61cdbb11bfd722f9aa9aefd9c813b81091d9fb85cb759bb0119e3

SHA512
11c9a0eb3678fa5953868070af0830f904b09b67926fa713f3f4f3d9d39bb17b5d8cbe77c5e48a4de22d896962e307556c3360947a04d3a3f8efd110daedc2bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0c1940902ee224bd9e2e0ebb596825ce

SHA1
b938e7bc24f2cb0de4a3cfb3233699a496ddf6ea

SHA256
2c9c85696ecbac96258f8efb6524eb175ef975ee7ea56be566d93ccd3cd02679

SHA512
aeee44c4b303f24a3f16c487e44b0643bf8236e702366da1443c42e51a6ad485b330e9c94123c3a836628520263d3918da08e8c4ac67da8b68bcebef9aea8f73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3257efe208a9b24bf6c6ba9237c1922a

SHA1
40f86dd1d5b7f80b2c08f06e612b221329479a01

SHA256
b6fa126b43ed082cd8a15ca44b96fc8712d33609f6a91e75bdc05ce94e6d3936

SHA512
ac9cdc3e7e9ab6c3bc2779bb97c2ef129d33e6a6ded751d128a70957345fc3b1145583b9d5889d7ee90167a21323013dbee543c67095590ba705c1e9e7b17df6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
059fc6b077a19eef796fa4c57c60189f

SHA1
7cfb85e2095f0418904ddf88439d4b52130d906c

SHA256
a202917c437bf3b643117de91b69e738d4a35b520a3e29d93ac49d04d3674e0c

SHA512
3e9249946c6e1ee798783f432a20d9ad075cbbbce2a7995ae62e6b2cc6140cb190cc2c400ff27dee2dbff1158555d60209d37bbe84bd337175b1b96651c32bf5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d60fc47065c7c883ed05ff8a462c7538

SHA1
59050089fa021b08bdbec665613c8ac6c7bbe744

SHA256
7afc35216b494a146c4233c1fc38c6b42af02f5ee264db002c3d6fa50423642a

SHA512
8c1479ddaee65667eda5cf34d831a350af4ae6928adc14e99933a40df07b12f4b0db437dd5c12399ddff2ced76e5e8018c4b948118d170780d47fd6ee5d53e7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f13f58a13b12e68e533e56ad4a0292be

SHA1
9dea7031d1b2642c417e5f1bec18e639467c8937

SHA256
7be05245e19dcaa295a1dff56c80da5bf206d349377b74686f159553aadbf2d8

SHA512
7fcd926fa29248d1be713ed8a216eaf638d8816e7b3fff7bbc9db222bf39e157e422254916190964e2c433334ee80f5b3d9d3d850f55aea94125eb3529e8d2d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f828806feed8ecc31ae83d27ece29c95

SHA1
7e1ce8681630bbf1f48266ebf95f24c705c34015

SHA256
34e6642bf374df31abf3b4c09323b89e33867bf0e5474c2defabe36c08d973f5

SHA512
e9bd36bfaf74bd6759d250cd94d7de9974b334630eaf898df701c288aa53ec41f3aa84a453ee322926db3d7d9a81faec059cc0d18f65474464886ffd04691519

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB7CD.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB83D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit