618c7daa1f1615ac37fb55a3f7e6881546cf64ff4a84c4f73605691129debce1

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 04:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

497aaf65631c72bc52b5c01e691a8d4f_JaffaCakes118.html
Size

18KB
MD5

497aaf65631c72bc52b5c01e691a8d4f
SHA1

c4daf5b0623ff0c08d61a8488cbd0f725f6a6f03
SHA256

618c7daa1f1615ac37fb55a3f7e6881546cf64ff4a84c4f73605691129debce1
SHA512

a379be037001afc2d93d44783dd4d7d937491134c31fec8f3247179691b041c701a7b2baedea68d526772b8f71d41df84efff62731c055a78e0a681a190cf820
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIj4ZzUnjBhjl82qDB8:SIMd0I5nvHdsvj+xDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421996953"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F2819A31-133F-11EF-B2DC-EA263619F6CB} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2860	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2860	iexplore.exe
2860	iexplore.exe
2456	IEXPLORE.EXE
2456	IEXPLORE.EXE
2456	IEXPLORE.EXE
2456	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2456	2860	iexplore.exe	28
PID 2860 wrote to memory of 2456	2860	iexplore.exe	28
PID 2860 wrote to memory of 2456	2860	iexplore.exe	28
PID 2860 wrote to memory of 2456	2860	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\497aaf65631c72bc52b5c01e691a8d4f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2860 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
adf915cd12bb0d6e4dad16db628ee556

SHA1
fb9eb646bcc56a90bb5d66793b30d14117d5d06e

SHA256
5f4de951fe9c27e9476cb71017b5f3e5a6b94e40e59055dc6b47075d896879a5

SHA512
91543dfbb3be2c4141a98b6dbd35f338d3f93ff81ddc98fa0ab033b2d766973f04f3e143bbd99ecc20859a545c2e9d854c8df3f2440e8944ed0ea192cbbbdf46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5cdf2dffe6925f73c1631ced80bb1fc7

SHA1
78229954977d9075b97506d6e842379e13d33c76

SHA256
2662ce1d5cc13511bea07fdc04cb4283a38dfb534e77e77ac42f32b37ed60b02

SHA512
d07a2f3070e605c511294db9c9977329f969b1852b5a5eca692033fb8f36b6f05b18b8ed793b08aee18a79be04fa4e66e585352785c91ec631e6f99f54877fa8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e1b545403d8c012bbd9b286943651f61

SHA1
fb9d495f19c2856db906f483272b205bfa74517b

SHA256
be37715a2e66e76bc5b91fcf4e9858e9c07ff6346e2363749b0ebdb6c7a1f3ae

SHA512
eab1f4a13e42cce4c2028986750a8c28f6d75c8dbd6ba427d3c0af96e72ab2ac47a52b903101bbd11b4791957eb96bf69d9599c4c9e625cd3aee18ad34b679ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c48fdb63d087b7059e1cbfa034369828

SHA1
d1a6c0d5eab14e08d6aaa5a9418de313c96f29d6

SHA256
b92798f3b4c33227445b15cb9bd2d9b3df582db1a1231c45affd135c65938155

SHA512
185e90aa9900971a91a5981b9f37718c1881ba595b59b8f28bbdf1f3e8dfd795048e8cfabed5acdb69c33c8c9c012506d6a376f02dcea251b34da20b75df539a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
198cb300002a19ebaaddb42018ae4b48

SHA1
ac2902eeb91d88a0ac7df360f1b01e0305853045

SHA256
cf22e42764f550a348ea70c0eca1754b350e0885b8fbe8fb028b79c0171c6cd8

SHA512
598cfebf35c23f77da1ea07b5d26142d30f47269657c7e8e6f2e0127cfe4e13595615c2d97dcb3241a4812215f48dd6baa83c73c76e8163c7a06a093c2cf6bdd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
afd1ed6f0b70739e46396e90bb4911e5

SHA1
c22211cc3e369006ac53ba3a6108d2a2f7997ed0

SHA256
bc5fc17807fb0ed6ee3842514685e69a90b9c3c43c9ef62eccfb4aeb48bc5bc3

SHA512
4f6783c46e25a5178f9036d395f3bd4d9a62fadd238cb67094dd56b2f7e6a33a664cdd09556fb779960830e467e6826e4618cdc0d4104f6593ab31cf997b73b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
215fd645e3e04c4a8a7137c89df7a401

SHA1
4eefa05d3ed9a4bd81fcb7ee2a6a63b0f46190bf

SHA256
e7b5cdb90a1edcb762f4abe2bdd558dd7caf721249fdbc96acb5558d6b5eecea

SHA512
9b4a64bef0426d7f1637d96ada5a54fda78890fb42f45106bb4bb123715d8ce240f5e5c4492ae5ed115da3da4053de0d3250457db24f22ed4aeb1ffdc4e333e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
54bf9cfd4cf05406b6441d7fdf33bcd0

SHA1
06da556104c60616a5d2af0f0485a145480a20f4

SHA256
c5865fd8b90f3407244903a0893dd454d46049e778486c978bc69ed74249477e

SHA512
2cfe190fd675509dd47347037e04c91c22cb4313f13e81fe8e3c1dc8bc8d0ba65d48b6cd6b00e3023e216b5abe4968936bda66c6781de51a1027e669ad5da27a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1d0f39c7e1720c6044c5223a482cc3f

SHA1
6d6b37cae55e0ef6949486469630f4615702cca0

SHA256
10594a7ceac5b1c63439450ec7605553f8f5582e65cbc5b46988f78731595422

SHA512
b6c6cec1164545fb972cb9f682f261f62e936c6a1cce8b40ec6260ce9f7dacf320f285501fb3dbd8c0148f92731d246082abb997974193d1539a5f10df6bcce0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9310.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9332.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit