920cd31a21e19e66077fe1c5ddc2ff6a4c6252ef13fe9b2949a17ad2d663edd9

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 22:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68cde55056559f6559c001d3b9b95b4c_JaffaCakes118.html
Size

43KB
MD5

68cde55056559f6559c001d3b9b95b4c
SHA1

5218e8c0567a7bc2f1b317707c6b32536ce61f98
SHA256

920cd31a21e19e66077fe1c5ddc2ff6a4c6252ef13fe9b2949a17ad2d663edd9
SHA512

2125b3e8427edd279112f840966381e250c5f60858fa25df23a61f234cef00519e1b3823d83e8369cbd52220541c390851c5b6e32561ce57217980a2e061256c
SSDEEP

768:gHhzXXfIDdduibA4s4jnT24Jpdf9zFsH6e0dcu/2DglSjd90kpz7t:gpXXfSdduibA4s4jnT24Jff9zFsH6e0O

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B5F1F7C1-1887-11EF-B27B-DA219DA76A91} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422577529"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1900 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1900 iexplore.exe
1900 iexplore.exe
2644 IEXPLORE.EXE
2644 IEXPLORE.EXE
2644 IEXPLORE.EXE
2644 IEXPLORE.EXE

pid	process
1900	iexplore.exe

pid	process
1900	iexplore.exe
1900	iexplore.exe
2644	IEXPLORE.EXE
2644	IEXPLORE.EXE
2644	IEXPLORE.EXE
2644	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1900 wrote to memory of 2644	1900	iexplore.exe	IEXPLORE.EXE
PID 1900 wrote to memory of 2644	1900	iexplore.exe	IEXPLORE.EXE
PID 1900 wrote to memory of 2644	1900	iexplore.exe	IEXPLORE.EXE
PID 1900 wrote to memory of 2644	1900	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\68cde55056559f6559c001d3b9b95b4c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1900 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d420bd002fb6e897db6cb6e043fceb7

SHA1
794f83cffb910982979caefae5d07c9e9082f9a5

SHA256
67fa5539849156b7c4d484a5de5e6e34da67ed7ea316351fdc3f1f9afd5f4e07

SHA512
2c1adea08837fd4fe7214bab4b9ea32f7f0b0cb0d292b1c23c09aee7ea486edcd2f4c7b006e2b24c2579b171b8866e9b73efb7e54928297efd5790d658bfe95b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dff1e55726f9ac38fd24a37e317e65b4

SHA1
e042f9cea407ce09a248d825675815d95e4518c1

SHA256
7c5cc2a032e2490a618a832b61d7e422e4356de78ed43bf45bcc4464a26c7d9e

SHA512
2a3cd5c24e00b2ca46e0e85bd8bee6c1c92555c5c03acaa87c6493acd7ab3e5b6b59d9721a1bf93521cc10e7e0caff71d3c74d8c4d7e6157f20addf9d1e983d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fdc695b0fbfdbc6d5bbfa1dfa7a26442

SHA1
a4ac1b3d71010b8dbbe50fe1f56f31fe8e0146cf

SHA256
8b670a6dd35c112cd05a893accbc9de882052bdb1d30f1c8bf0b03a2899325c7

SHA512
7d760e73ba5378efa891aa580413e66d975f95bf8b0971a548da659ea01529cfb8500eb24d82139138e0176de52134b4d25d96b759015e0c5abd8b30b4694c3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93a196ba50b949a1f698a8c06af6c1c9

SHA1
8f4809adf50aa2c712805bf1eb7a76e2443267ec

SHA256
5ede5744fbf617f76b508d349093626e5efabee84988c0d91521ebc57b8dc256

SHA512
ccb00f4c9c9fa8a9a7343cce34dc8d72062141f2be1ecc332a738bc9b9665e3853e3b08505065c35581581ad16e3f3cd266fe659b6dd37a73880251be4ff7e1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d02696abddc3ce23a8525fbe63405e2

SHA1
2e55995fdfb42a3b2e4d04c10f1e7a9eb897a139

SHA256
2106de60d3942d2c2264e04b10ee789208f37f69d984f150a297b87a629682ad

SHA512
41f66fb5c0d7d3968b1e047c8fdb1b198954f8409310b13710de38c5d62978ad4eafd64be0e7b39b9c7d55001b8df4310c9e3ffc1f33f5e3f59e1abdb540c643

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
acc7862f7eb803643a6b44323a29130b

SHA1
27050e15bae0b838deb6d74a255c02bd144c8955

SHA256
2ee7082af2b08cf548cb04cae20a347e1afead32472152fde6f208560056ac8c

SHA512
133c4bcd2ff6d900a7c63434ea031dc8e466dc2535e0a3dd1d4aa32d94b907e7e890a9c4890a858befcff26a6247eeb4c67d97a7ee94f7e3e0d0901c52bf19b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53b725bfe3d6aef75d9a52a18d47cf60

SHA1
7993c4e4ecb36fe3ecfd6cc4309b5c04bcd3761c

SHA256
8ce2519d1a2d1f84a66a188aeb39cf4b5a1197f219aa3b0e75e43a4f28f23c4e

SHA512
b7b2483b5ec8b4f17a901d8e6e84105cf42acf231cc67e2e1bec5b2525368d940d6b7a09b31135fd6be281fd375b98ccaf277575aee2eea01f6c7da3b1bfdf57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e139a53a6374de8c28fe3dce780d3779

SHA1
dda36ba2f6f81c46736020bb14992c9d14f569a8

SHA256
0c04c6a4fbb209c633a6902466b2514821fa7cc88f436284d66fe243950755d9

SHA512
9a78866d1f773e021c20474ef096f352bdc0e553fbd191e853bbd7a0fd0b843671e0ecbb9b2ce09aad4f40053e194f65570ed20f361f44e873bc133b90d49d94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
81a7cdf68870b0903d5138a8c2f2485c

SHA1
1c78b58c88c6c18baf72ec4b4a25a76b05ac1d79

SHA256
149c43c0d86cd10d8aa7278d9a77814696bc5ab3b2ed4d935a6d9108654a018f

SHA512
bb0917b3307bb34011ee8316dc25c0f0fbc771998235e5ede56b18b56d7083cc006c154550a57136b6c9157d3c1b282c42f19cb7205a389a441efaa2e4b30567

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab25EA.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar263B.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit