7265c82e24cb16d325a731230f4d34f6785dca7cad07ea69a9dc67ed291ac523

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 03:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

22fd585c1a550aa50b3577af77a616e7_JaffaCakes118.html
Size

18KB
MD5

22fd585c1a550aa50b3577af77a616e7
SHA1

2abb3cfd364869692a041d9c8e43854df4d559ed
SHA256

7265c82e24cb16d325a731230f4d34f6785dca7cad07ea69a9dc67ed291ac523
SHA512

10f1e6a4c3357f93a879ad07ffe8bcad336624daccf255f3f9d38cf6911146225498719ed28ae21ceac87abd245c13578827b985dd4a1872722d1da864261971
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAIZ4BzUnjBhr982qDB8:SIMd0I5nO9HdsvrmxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A9396431-0CEA-11EF-970D-EE42DE2196AB} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421300615"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2004	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2004	iexplore.exe
2004	iexplore.exe
2944	IEXPLORE.EXE
2944	IEXPLORE.EXE
2944	IEXPLORE.EXE
2944	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 2944	2004	iexplore.exe	28
PID 2004 wrote to memory of 2944	2004	iexplore.exe	28
PID 2004 wrote to memory of 2944	2004	iexplore.exe	28
PID 2004 wrote to memory of 2944	2004	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\22fd585c1a550aa50b3577af77a616e7_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2004 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59f8ba32fc36894f00860839ffd382c6

SHA1
32adeaf1cdadce2d2d2f9d446d8102f98e354764

SHA256
0590c17083c03cfe0b57aa8648ec4bf45766b8b0f56224aa3097dbb0ec2b7918

SHA512
c5b8720d33d4acf90d3256bed6d64ac8b67f79d24cca4b10a7557dd3e313bfaa398a9dd7bfff20753a0abb1fa2bfef34b819cf56561bc849cfb588300fa8bfcd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6498529ebcffa09c310c44955e13bbe5

SHA1
d3c99241d6de60ca6a1ff588f84bd664e3a95c33

SHA256
1e68eff0a4b91d50a3264ef4f58c1361d6cdd6237004097589572cd78e1d3c19

SHA512
e360dcdd09403694a881874ad6f02b11740b85e354451d48fc4fed0efd917c50738882ee211660ff35d3d1f45ff942d70b848acd54fc664c335c1af4b4e5e9c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aba26ae650038436258c30154a3bb0d9

SHA1
839a8a50bf928d2f84d57c817e64ad50b8dc73b7

SHA256
cbf29956f4e27a11a4d8ff07ca8e89816bdcdbf8f4459b390dc665222aa50493

SHA512
659c7ef33cab34a10c026bd4387a28f3ab174814fb9c4d9794e52974c7413ad8c7a9f7ffa42475065325a0dac945db0025a29e936304dac414f9d4820b529a25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f7cacebddefd71e447274f150ff53fc

SHA1
a683994016202f08bdbe43a3c402861f049299a9

SHA256
00fd8092b207dcee3fd55e0c112f513dbac063ea4c319cc0337bc5114574d766

SHA512
ec27821e2c0bc9619ff50d35c2a8ae7672a841a51493a0bca97981d96bf3820ca05b53c8266d5bca854fce2731c1a3948668730115a794faa87161e17c352551

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d67ab8cf85aac31c976ef5e59b000cee

SHA1
5bd461ff468cb5c0585b81a8b7eca1d88123a5a4

SHA256
ccf62ec7d87f4caa162a66b352cee9d87afc3bb3a26320b8f9fc223ed625e5a1

SHA512
25dab0291c7120fe31dc061b942995fae3fc9911fb810b5d5bc08abb605b63d95cf4ba1a8346cb99dcb00c189dcb8a65f8b1d1c55fbe0ef9b5acb7991332ced9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea54940a650aa3e07774503e74509dbd

SHA1
5f76104d6bd0691c7f910d8979462b817fb360f2

SHA256
c1d431d5bb92e2530002636ca4bd9adac4e98a565b9d1c920c3e600696c26f62

SHA512
4f62b5d73ec4ed8752af01489cd343ce73b81a3fc749833d3f3b533e4ec012c4ed04c9ac24b5d78ca9c1dbfa4c64c152a49d050590bca0e6dc9f1052a03d4e69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03bcdcdea5c2d41332b50dd76c328c7e

SHA1
f5a430c47c4e899b0691be758d63d9706d66321d

SHA256
e90e880e9739d98b5167738bad068eb63206d16713ac0f4db1763996369fbeb8

SHA512
2a6701efc94a032dc2e7872d1a95ae8c5c3fc02a3e3e63fec55c825e8d48b66941accfe6427f54cd42f384e78d032dcd39160f3affd3d0faf073ea34a5ded42f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2154c3fcd1d3bf8ab988ee8469139f23

SHA1
7eee50a9d8708703f231fd23f02a1e792cafdddd

SHA256
f3302ad0dcea21bd11baa74c2d992c504e00ac71e21107bd1f7d5a4f3185aa88

SHA512
e2db0c80ab8e6e39b7ddbaa2167abe8bae3cf516f11b19d50cf50a23c0aa4efc6f327e7212606dea3d01e20ce0fe9ec5a51ca5e464e60d7fe0ee54a75c27021a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b7893b1c2ddd0746f9bf90bbad87af7

SHA1
6363ddf94104494089873bbe333f013eb7c27636

SHA256
f1bee3ea23724cf4ee0dd1727a91f520f21cf535fbd4fe8c12aedd79afa9a48a

SHA512
2ef97d31839a9487cfc11f7f2abdb53e01f481a40b8abb687184fc1e4432bbf87d9c23a181f50816c8fb83fe5d737ddcb7e9772526ca5cad489c7808fa0a3c5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab772.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab85E.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar873.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit