060ef570bc26de8527767f8827e509c569de75219d2578bb8b8a345e4977f51b

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 23:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69132b985553a2b2b40e40f65c3802a0_JaffaCakes118.html
Size

9KB
MD5

69132b985553a2b2b40e40f65c3802a0
SHA1

6d4c95ed329efe9e5e7f576abfc118c515de4116
SHA256

060ef570bc26de8527767f8827e509c569de75219d2578bb8b8a345e4977f51b
SHA512

8d8c67db759c5d98a00cdf22caf9f68e79f012136e77a948e4d3f6a78cc2fa3978f528275289738d6eed07a4fda12df048b63275c94abcca04a87a76d11c7521
SSDEEP

192:SIjAB+PJ0fvGGQduHCRMnIhOkKhvhKoj4NuBUpyQ+1mFN59Ej2swqPVaLUC:SIjAB+PJ0fvGGQoHCRMnIhO/hhKoj4NZ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5394DD81-1897-11EF-805B-F637117826CF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422584237"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1232 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1232 iexplore.exe
1232 iexplore.exe
2372 IEXPLORE.EXE
2372 IEXPLORE.EXE
2372 IEXPLORE.EXE
2372 IEXPLORE.EXE

pid	process
1232	iexplore.exe

pid	process
1232	iexplore.exe
1232	iexplore.exe
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1232 wrote to memory of 2372	1232	iexplore.exe	IEXPLORE.EXE
PID 1232 wrote to memory of 2372	1232	iexplore.exe	IEXPLORE.EXE
PID 1232 wrote to memory of 2372	1232	iexplore.exe	IEXPLORE.EXE
PID 1232 wrote to memory of 2372	1232	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\69132b985553a2b2b40e40f65c3802a0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1232

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1232 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3cc747deecaab84a21845555c8ab90d9

SHA1
107e2cf78439bf4be21fefa4a58ad5a6774e9b8d

SHA256
f19e150ed687a4d8ced59c9a0568835d25ae4bb5d34b6942d7a18141fba2296a

SHA512
ca8b6a756e1278943306266d5d189efa5d6a85b0e0d47c4826e6a6f68b42baf4e525c35ee1f08e850ecbefa6aba0260125db9f40546fa08f96bd58426d01e4c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
16fb60489fd54983618fc47a12dc0cb0

SHA1
7af325cd676929db8daecbb582faed03a436b143

SHA256
7ad1bff50da6eb4e194c239e7c5dd3fe1d8cd6f44f09370ba369e5d71942fde6

SHA512
e5a477ed47d3cceb0ac965884e5a9c334167f9bcecd2b0e230f7e37a0789133551783351b74e4405b1874f83f389761244f5afb49f7d48acfdb60c63371d09be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
feed153a6a140e036b7f3a05bea38477

SHA1
d5e74d433d50e0a9ff8dca9a758e99bae4b6f8a5

SHA256
1ac8bcee8c516a48e89a5f12391049dabc5229ecbc1e226282c98fa8a2235fc8

SHA512
7df94f93a8b38d40c4d54dbebbe74135b5b30c0c15558aba23622bdda2bd064bc74219fa5ee2f827b986ac7de535ac439550e84de4c189c5d8172aad2cc5f54d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e51fad296c622bc48a23268876cb3cb

SHA1
15a97799776b777c5f5149967d529fd7e2e223c7

SHA256
1eafdd73213a1d12ab82f15dc58ef722b717e68403c2eba2174eb0568852f0ad

SHA512
11be501451c7aeb500ad4b9197996da8b194720730daf8578c335855f7c11ec96caeb5b04183338fee752ed799ecb1e1945032bf1d61f8e5a9db5aeef98c2a6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
01abde64fda3911f4c2bb63eff259b24

SHA1
4cb9dd9fd0d53fa5c78600da95648f290fd4313d

SHA256
1ada0d38dcf4bf7c4fe4c2fff48d7fcabf92a5c7d78c9e300928d75ca37de692

SHA512
16b271e3d93f3bb40a4efe236552de6c0f4349d28e598daf211d9c8fcc668f7bc9cd94171bbc4beb36998ea7cb633f1d3a129e9d5694944c6fdfaa7aa53bcb8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa8984863ccfd5cc94862a467fc6f9a5

SHA1
b975c396a8a9dcbad2ebae4c2b80d2c02ea583e1

SHA256
f3481aa3586681989d0375cecf0ed012fdb54feb6c9fd0ed3385aeea21942ca8

SHA512
ab9aa184719e8cd7d0d8e246a553c0aa722e645259efe0a6ae3bf7f55a762a87122a7303c92cec319fbf0c0fa603310bc4f67e56ce508b811fcfcfd075f48ad9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
efbe9076a9f24a3889fd660743f76c71

SHA1
4a23c1bc926a6cb7d7eb8beb6d0feb8f2ae12394

SHA256
e408985e5596efc8c18acac84eb7d872301422df6baf2f96fe9e8e1bbe045a55

SHA512
11b5b9f36ed3958893ac2dbb061753dcc06e386a24dd5bd26795745aa27f0f5c18286078e2ac5eb48209d4c0b1768a23ef360bfa21ec74d01b8e19655b999171

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d542d860cd0829699f96e30738e05a4

SHA1
78d957dad20b96cda507fcce8e11e1ea3130ff2a

SHA256
533918b9ccff845fc64c676d8c2057b738c432a5953c5c14a475a2bdbe64a95b

SHA512
1786a33a28cb5640289ab51ff3745295bae2674275adbf37fe4ae54b1c5189db2d5a17938c7403cfc06ee7d509cd3396b8d319e9ee0999990bb2298eea738a6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
631e9938d1ee515c3e07cac2c5866b39

SHA1
58a70c761a7389fd86e68723cfdda8cbe54d94a3

SHA256
578e53b60a2938c0cb13a7bf4684d1fbbf9496cf2e66f5cf396f8139ad94e88b

SHA512
da8be8c402a3a77d54e4497a3c8e559911541f0ae8c23e681e99275565ad01eb3a9980fcc51611d67cab7e85390ff885f147086f78e211375f6e79b822da0db6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f596d6756f17deff935a5e5c2d46053

SHA1
96d5dbb21d18a47a3f6db079d58f723dd514a333

SHA256
629e9b84396796a3825eca22d053a25bac253a5f1651745aa67a97c9c9a47add

SHA512
1b866c5b4eb70668bd11f012dde6e4d2f4d22fce9c30adcfc3032f81687439122d00c0e0e334f8a4d8eed7f547b1109e44f203d0dc78977cea58d436908fed5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab120B.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar126D.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit