1e8d0ce78e91ca54bcfd379508c9fc2c5b30ed33d8418f918fdeac953a36732a

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 14:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63a64a7cc78bd62e4d62dbeb21798937_JaffaCakes118.html
Size

18KB
MD5

63a64a7cc78bd62e4d62dbeb21798937
SHA1

45c0e6fa0d72ff9370610c44ad4aa0e064ddc9be
SHA256

1e8d0ce78e91ca54bcfd379508c9fc2c5b30ed33d8418f918fdeac953a36732a
SHA512

6b2fe5de1f050fa515e62acc712b99a5667c7f7d1034b7b89a75189337f08ebf5a9aa5f3cfec33c74ce19fbac86a8ebc0667e1ab005ec7eca8684c437639352d
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIO4+zUnjBhmI82qDB8:SIMd0I5nvHlsvmbxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F95056A1-177F-11EF-A965-CAFA5A0A62FD} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422464256"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2880 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2880 iexplore.exe
2880 iexplore.exe
2080 IEXPLORE.EXE
2080 IEXPLORE.EXE
2080 IEXPLORE.EXE
2080 IEXPLORE.EXE

pid	process
2880	iexplore.exe

pid	process
2880	iexplore.exe
2880	iexplore.exe
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2880 wrote to memory of 2080	2880	iexplore.exe	IEXPLORE.EXE
PID 2880 wrote to memory of 2080	2880	iexplore.exe	IEXPLORE.EXE
PID 2880 wrote to memory of 2080	2880	iexplore.exe	IEXPLORE.EXE
PID 2880 wrote to memory of 2080	2880	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\63a64a7cc78bd62e4d62dbeb21798937_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2880

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2880 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2080

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
e85cf950d16314730c2fc1369daa604a

SHA1
569c01eff0e6d4728646cc9c81525414f0efcdad

SHA256
b40767613706d3e65585b13b84ae0545efa862dcc373743430163f35b8d8f21e

SHA512
f84d39da95a751c66b6918a84217a5c0483ac8ee51d72f2cea05254f1bef2ad2aee3dca6026140afe445e25c75bc39084ded498507f50fcb1913f327acf00858

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
a3582ba49a3e35f275c603b22f46ea45

SHA1
e13d1af9607004b72d899207cbf7f33f37c0166a

SHA256
100a7cf079a4b3bf194a29c4713be5d56ca6e601018233493599b98e3d0024d6

SHA512
61728ace008a721967bfb436ab43ebf69769c28c7159c91eadc384040be45de2154ec994209a7bb546f4abcc50a06cdd872f893fd030280589ef0489dbca8310

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
87761039651021712e32a875d3d42efc

SHA1
70371ddde5436134a4f08e39f5690582bb455064

SHA256
acad2f802bfb55dade0cb0bece3c26235b881c40ba0e1fb0c2e36d00b62a1338

SHA512
591808cf6d661fe49e7cc29721c3671c3510d8eb37ed86674880c22681ab950c4d777f0f5e08214e69ee60db3e0517f28f2a89404aba51048c7bfa59df9e7c55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
29f912610b5f5d2918b77d4ce1f5033b

SHA1
3da07900c21e88e0c6be3cdf611180ba3c8d9107

SHA256
5c97cb9d61631b0bfdbe4934281f0a1d8c9ab2ad5c52b838710e7c40a5c00fba

SHA512
0d24379c49bf7b9124e3e6b998711be2ed9f86b088a3dabeac6f982154df32c93c149add316675a8eac2745c6ca91b7e06b87cb5e04deac5655278f3ce884135

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
9f8c2441069a9ab715de4a132df6e3d3

SHA1
4daed498a13ea8e1123e073b4a8aaa876dde71eb

SHA256
3100dcedb3676845c488b72aed0b34184bdcdd02363770c9a1329c2141641979

SHA512
eb54fdbedccba62ffd3218873cb746b726281e141373c1970990d686ea28cc9164300aa9a717fb501e357870b38cabbaafa7be464114fc8bd2f4427cba884710

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
a1af1b6ffd98c83109671335307cc76c

SHA1
24813b3a57f0be5488c3a0aa58d6ecee0db783db

SHA256
0f943df6b1fd721d695844db534bab8279815fa72334bf0a254c8264750d19d9

SHA512
641312c3166bb1b29e5f10d72484aa9a458d882b3fcddab8ebeb0653c2a035f8a6e6682a409299c02ac3897e4d06869a3d906062aebc25628c1d7b9f2e383caa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
9e9dfc5cdea968c25a383e03155688cc

SHA1
0f2bf746cf14e20f1fdf3a4dbed9bd9428287248

SHA256
ab01beb3674d03051dc21997de07bd4f3c19ee9a15cfc7f43e228f2794201e0b

SHA512
f7fa622ead555406c1a467362d644d36839d796627f29985c0cd32abc2bb65deafe3223a9b5b5bf058179deaf8a42fd4d4cfedd58b1850ea6c561e050be49f32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
3972a60fbe55d4e759605ef2d70e17fe

SHA1
ecfd42ae69a67a78239b7963d65cc0acfb788271

SHA256
791715562014af86b1162d24ef3fef57a418d7a888ab5b9a477210b25e41ccc6

SHA512
a7b4db68b086c88d1f790f0a59b53fff9b308a6ecf7c0c165ea2c1ddb05b67ca2451d9c9c9d1eb9c4fd4f1da093bc18deedf0b7b8c91bb91d58325fbd701ebf9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
7970727d3f47cb2d2504ee101a4923e3

SHA1
19b8a4183bc62983335e00246bbf04adaf705b05

SHA256
47c249a2493e307ab1c31452091c78f667875000682a0e29c9dd4a71f3c92bd4

SHA512
f8038fd3efa04a79eca0f590e0019a3bbb241ec29974e6c54c7dbf2dbfe738ffaf582721c8a0400812ad6b09d81ed6ec11a80fa3b0b3090ec7351e845e76a1c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab16EC.tmp
Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar17DD.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit