7ec86e3a1ffa15b7b962af011fe07df862d1b6e9c5725598938b0483fe03b434

Analysis

max time kernel
150s
max time network
142s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 14:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

639029bac9e1e0a5643034ddf4f9da5c_JaffaCakes118.html
Size

20KB
MD5

639029bac9e1e0a5643034ddf4f9da5c
SHA1

539f242d9b97e5cbfc4c86380f6ee2600ae0b33e
SHA256

7ec86e3a1ffa15b7b962af011fe07df862d1b6e9c5725598938b0483fe03b434
SHA512

9572ccb9cf080e733bbc5bf1a787be17aed94acb33775c8d7a29601517c461411f91362ccc3f48099ff44ef37f9a62b75ceeaa07c2bd66f31a5dc9fcc2cc283d
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIK4wzUnjBh0e82qDB8:SIMd0I5nvHjsv0NxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AEA64821-177B-11EF-B671-4AE872E97954} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422462415"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1224 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1224 iexplore.exe
1224 iexplore.exe
2984 IEXPLORE.EXE
2984 IEXPLORE.EXE
2984 IEXPLORE.EXE
2984 IEXPLORE.EXE

pid	process
1224	iexplore.exe

pid	process
1224	iexplore.exe
1224	iexplore.exe
2984	IEXPLORE.EXE
2984	IEXPLORE.EXE
2984	IEXPLORE.EXE
2984	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1224 wrote to memory of 2984	1224	iexplore.exe	IEXPLORE.EXE
PID 1224 wrote to memory of 2984	1224	iexplore.exe	IEXPLORE.EXE
PID 1224 wrote to memory of 2984	1224	iexplore.exe	IEXPLORE.EXE
PID 1224 wrote to memory of 2984	1224	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\639029bac9e1e0a5643034ddf4f9da5c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1224 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b5edea1f530a0798ea1f29c8c220e3c

SHA1
9b88903d4638c2247a0df2bc7f478ff3a647aa36

SHA256
0222a4a7fe417ba4a85707a68e59b9dfa0f54fa77a7a3f0fbd6127879f4ac5c6

SHA512
6b7589f3d5ac9c812cb4e7cd6e81a28aec5519dd29924ac95838ec69d9a7dedfc3ecdfe3c92774f5c9660fe7f5569c254b0e6340773ef82078acee153c33c7fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a77154a006a2f1c068a690456bf0225e

SHA1
d95890f9025eebfe21d3803f0f458342d4d8cacd

SHA256
c0d312403f3100c9ea7b075d543a49d0e9c73130518554f5882d5c1eeaa9d6a9

SHA512
c15c8aeadaef58183bdfbd4e714aeb6e6bd22373a3ec92cc67a6fe0d6947b3ea870b026b4593e81227c5c26cbbf3f03b77fadecd39733142e881162f13116701

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6dc9c2c7029c3b7ed973f7ceb01092f7

SHA1
d0ff7687c207e32d09ebbf05f1d1ac9eb5ee0726

SHA256
bee3ae3e082ec14466bc3328bc2a48f2b04d48cbb988ff2ca50470055d2b4cce

SHA512
97e3cfff9f4a7d593bb64c4c5e1f543b9084c5081ac63f4054bbecf1936d135912103b4170f5446381ef9b654fac8d261dba1c9235698e69e81a2bd34b0dec5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
26acc424d8e168b0ca4d3acf4c7d9361

SHA1
f5e1caa091073f23b3b4f1912bb882b2a6362920

SHA256
db987edca34554c56c8fb301c1477099c60498a501d4b0c71a9a5f503d43c4fc

SHA512
cb7fd531f9d2d92fa164dbf2deee53fdbfcb386313b56a5efb0778df9f614fd9a1ae1e8ec084198e9bb750fba9be922b0cd03be5a1f780716373bee24f698a2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc8df12fe3208536719df49b880a2be3

SHA1
caf35d40c6ab8ff1fc09dd23c84c9268ef12f40c

SHA256
c5d9bed24f43f2d4f3d38dfd9e0540dd2e05b8b93ca4b7ac49198d16ba64180a

SHA512
79760696081dec5dc0f0ef29d118397c1a58ac9df4034d2bf31acf99b72c6b384d1e4a28b72561d34f6014f1387466506bf0a40ced794028416ca6d4e70ffd54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a7889ca8912837991bd4ad227802ff0c

SHA1
fff8c08f5d77b2415b90710f88db26ec18ff97ef

SHA256
b0abc651ffff690c6fe2409e4ce58a8d499b171e4364129fcf19a016281706d2

SHA512
3d60821ba1c9cd71d47873e158b34e389e02be1d8192d58133324ea1f7b66c8dd6e1039e2a5663b2c3e451c6283b13a610177715f15e309b206345599bef9254

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17fe9ba19bb7beb05e02a1b765e91f95

SHA1
becc6c9b6679f02aea11bccd4b0dd139cabde25c

SHA256
20988adacd2991d9e4d60c3a8e3f6bc1df68d871ce49003811202992e8cbb0b2

SHA512
1efe6cf72fd6ace695ac58d76fb5b3b904b62903a93f511f4ef1858ab02ed035431dd25a2d4c2c98c89ca2b7797e12dc793e5232f7251d407627e861849c2907

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f29ed136dffb52a13aea51410210262

SHA1
b8333e26fba89380cb99f96826db2936a26d02c7

SHA256
7380ad724e82d22486a31ba4f37b9801918dc4f75c8fda2c7cc3ccc5ed330f98

SHA512
1c77546242755ee88bbabb17b74e58041d1cf26c6182203d05e27ab7a6fee4392fba10ad931da3eb515b3a0e85cf1660f0a0744a007519da76c9268d87dd994d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
076e453029d4c35b57960ef3d5ed834a

SHA1
b327236c7443212bfc781b7086d21b3a40b3a8b5

SHA256
81f2b1fa8ff71c0d7c29e725dc074bc7936745355736c1b78be19bfa0fb330a6

SHA512
c00a01ac499d6055fcf596518186c9f43b958bd4aa261bb99fc447ae444dc9df5378eeaadb8302a41d4dec9d630d27dc8958b1442e7c559c18ce4e288c8c8dfa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8BFA.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8D1C.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit