fcdadd544ddcf578e4c308e31da05f620298a70bd3d60f300dd4b5b1a458bbd4

Analysis

max time kernel
149s
max time network
138s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 15:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63b96f4d2620b7c9161954f471335e72_JaffaCakes118.html
Size

19KB
MD5

63b96f4d2620b7c9161954f471335e72
SHA1

f7ce379fc5446a3b58964bf07f5491137a4dc4b1
SHA256

fcdadd544ddcf578e4c308e31da05f620298a70bd3d60f300dd4b5b1a458bbd4
SHA512

f9aa688f44be20882aacf0e62353a6db77e799385b57456a33212bf7ec283481114cc1291d484ab73d2886db96b3f07ad482624697e03ec6de4aafebf3049c46
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAI14PzUnjBhpj82qDB8:SIMd0I5nvHRsvpYxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{996991D1-1783-11EF-BC57-569FD5A164C1} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422465813"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

3056 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

3056 iexplore.exe
3056 iexplore.exe
2624 IEXPLORE.EXE
2624 IEXPLORE.EXE
2624 IEXPLORE.EXE
2624 IEXPLORE.EXE

pid	process
3056	iexplore.exe

pid	process
3056	iexplore.exe
3056	iexplore.exe
2624	IEXPLORE.EXE
2624	IEXPLORE.EXE
2624	IEXPLORE.EXE
2624	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 3056 wrote to memory of 2624	3056	iexplore.exe	IEXPLORE.EXE
PID 3056 wrote to memory of 2624	3056	iexplore.exe	IEXPLORE.EXE
PID 3056 wrote to memory of 2624	3056	iexplore.exe	IEXPLORE.EXE
PID 3056 wrote to memory of 2624	3056	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\63b96f4d2620b7c9161954f471335e72_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3056 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c16f58bf7d43c916aa542cda713f0852

SHA1
a1b9d14f0f45c66eb4dee4853cffb576d6d10589

SHA256
7b86a68f0a78a7304f26e15fe35562218640a3b1ea32191653ed8e646a4dab50

SHA512
2f86ac498f6e2fbc6f66b953ca815813eb490d2312e333072523c355fb940e7f9c91edbe58a1d415abf64bd88771746fef107ce3d7db557975362e71cdff79ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fcccb8552969e94d8ea2f636bb8e3bb5

SHA1
7d436a7d3d68b8a3033d08b024c7f730e11e3255

SHA256
4f829ba3fcd8e62221445b1ce1ac3697338e32844d71131f441c98f5c5dabafb

SHA512
25fa79f4f35b664f423810e909fcf056d42aab5b35c8300bc2a17dfd101d9c1d4e64a42e88873906613b534b342ffa1d35ea451733a483a3866439d8ebc04b6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce9407544e37f11357836c8f17ef9d19

SHA1
afb51a61f5b384751363c2618ab459e136033f1e

SHA256
b30b56005128690108679043b960b9b39dfabe6a09aefdfb8eb2aa5733e70c8c

SHA512
e8340e7543a3554136aa1977825af901ccf72ee122f69cffadbc71ef8c5fe7bd75735e6c7d76de8b667c17359425444fc3d0d80699f619b4da9570fb0eb5d565

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6a45e724dba3d1f87369932fa76e95a

SHA1
482efa737f96351345b31955d68afb641834efc6

SHA256
e7369204ad15ebfa05b9876ccdaa4fec804147b224e77ac5563b3c2fa6e49d84

SHA512
e666c7586189729e0e66fdb59a38763a73540014197bf2591c7ea2c8c9311fd7f49fa39c8348057ad37a1c0008a38cd6f514cc0aa62128cbc183d05f6a26a079

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
94b843c673ae08481ea54080e6284cfc

SHA1
940d2d9d763c9a3a93816930546ccac712d2e78f

SHA256
973d27aabb91a4bc54728b918005e3d01c0cdd841eda0b7fbca14f650423c6e8

SHA512
6e13542c7ac676a9253a985bf18828aa8a52ca40045ea327869b72902ed16dc54db2d646791e3d13934b5b839484050257eeff481d9ec3960acf07259019f73c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18fdbb11e6f8343d8203a9c009ce19c8

SHA1
24728eef0b253f625aebdeed8ea849768131d500

SHA256
fd4366c006e83c36535c140863eff1f47c5a6eb21b6e99e1a17926ab99dfc7be

SHA512
b722e2a97696e95fcebad2108827fe192adc6a759e70f2b2b149730aa36052dee25cc742a5e1e17ddd9a6b72fef6e0f3c4e2ab6738c9bf9ddbcab01959577844

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4cf2552ad3c07b5d3fd73861ca594908

SHA1
1d980cd18ae66ce43e8c0f40a85334a437546b85

SHA256
03d04a37c44542beb7d1963f2e5885afeb74d7569f048007c7a57fb40a34e56d

SHA512
7770ca8529552f03be1b78e95eff0efd7226819dac1fb388734e47ceab634b2f5e416a4442b4680fb1da5b41c3189f046e7c22b76fa4fd60d3d64a2d1184f20e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6ea917e0d85ed29215959643ed39eb9

SHA1
e8ca140ac9cdc74ede093a6f15ce4f16ae399b34

SHA256
c25c761b98f70cb3312cc569edcdfe3c6e35a44c8f159df09b893bcab7d445c4

SHA512
5ae29e869f58834c3e8c5aabfc62a4494ebef6bfca6a51f396d0e290f91b754d2150e13c4df6cda4a002b419312665d0b3df401a157d08fc1b4fb476a3dbb078

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab21E4.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar22F5.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit