8ceab59b8802a84eddfc7dbeedf5a9018f4ea50e3f80b7fcdef802babeeda4bc

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 23:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

690e3dd6d127468809678e40e8e89eb3_JaffaCakes118.html
Size

21KB
MD5

690e3dd6d127468809678e40e8e89eb3
SHA1

bc4b5bb456407744b5b64d1ab69b439f31645025
SHA256

8ceab59b8802a84eddfc7dbeedf5a9018f4ea50e3f80b7fcdef802babeeda4bc
SHA512

c8020b972feec0a945bbe48be4d3ef648d2b7845c1ba4293af476d635c5b1a7aa7740e1ca5cca3ae1af3a444eb9a371a2819886fe2fa27642cc869c897045160
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIr4XzUnjBh5D82qDB8:SIMd0I5nvHBsv54xDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422583755"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{344DF521-1896-11EF-81DB-4E87F544447C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2180 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2180 iexplore.exe
2180 iexplore.exe
3060 IEXPLORE.EXE
3060 IEXPLORE.EXE
3060 IEXPLORE.EXE
3060 IEXPLORE.EXE

pid	process
2180	iexplore.exe

pid	process
2180	iexplore.exe
2180	iexplore.exe
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2180 wrote to memory of 3060	2180	iexplore.exe	IEXPLORE.EXE
PID 2180 wrote to memory of 3060	2180	iexplore.exe	IEXPLORE.EXE
PID 2180 wrote to memory of 3060	2180	iexplore.exe	IEXPLORE.EXE
PID 2180 wrote to memory of 3060	2180	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\690e3dd6d127468809678e40e8e89eb3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2180

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2180 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb1cbd801f6fe28390bf7979a883cbca

SHA1
b716441c123aeab13000aa20773df02bd541ff7c

SHA256
0a2e41c6dff304a4043fc34b71d9fb3221e4800e01089d7063107ebffda4e711

SHA512
8150b43bc211de80f2e9fa977dfc91727f1e9557fe69cb5c20240365a2cb47af516d7f468c9b4a7c3aaa7dfd4f9cfce932b321fa76e6c1f800bd1e5cfc717bad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d89f78d17c7ea6b06561fb3e026e750a

SHA1
f153cad4494abbf08001a4aa00290290adee7eab

SHA256
c23f2b824416cfd32548e1b4b0002369d25a973a4eade081ab0bf82203e2a155

SHA512
0186de121dcaae975e3f15464a2143bf90d99b7dfe9fdaa334bf5107047b9841a46e18fe0e48395530d5c39d38bc0b56846ef35f1e176bcafa86ae3413b7df2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf967e8ca3a35caa023bc99101a0603e

SHA1
5b4963e37124ba66fba23575cf447c0fe6408cb7

SHA256
1edf2c12f2139a2d2f9b0cfa1ae5e6190ae93378ee4dd63fd8932dbcdb30490b

SHA512
0e8c3c9e0215c685d1a3e7d648e235bced0b5615af83ae6d003d7597ddb763a9968a2e0e56855d3d47640c703b597570a6777d3dc471f9727035e2816aff20f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f057f7689bc618b043c9706c8ca1bea0

SHA1
efb0ae28ee0e73d17b6a241a32d5cdb503297f92

SHA256
a5e2165c52a39859506cb12bd8b5ed47a97eca3c4894201f292c1281fd4dc049

SHA512
0f7cfef879790f64ad2bb2d7b9080050f22f83c48a2be82f48f925a8db9f260daa58c30ba7e51606d2e0d808d9ee147a7f7058a0f90742695dd53d0282972ec0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
701b1aa5180da74a19f4b2521a971f37

SHA1
7485291392c4b7666bbc3587905c43ca53f137c3

SHA256
71bdb75652be477a5e03f70b2a1ba6048c5006866fe460f00c3492b13929ecfc

SHA512
00108aa41aabd0d745df4eaf63d6901e6df73386650216e5fe90297e1cf394f211cba990cecb3c752a84fb72430b0ab02db555d62a90758b5633a8163a91dc14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17ab1aca793912c62df9af6f9be2b6d1

SHA1
51bcc3daaf8d80da436008382fb882542debdacc

SHA256
9a91168080353207be2324c69bda4afeb049bd24b6cd8b50126154742b9f905a

SHA512
227ad1e166d07bbd0b0b95516615921ea749a6bc8bd7ab514243a3707849aa83c37c7fd7fc79564cfea7567661b3bb1b8f760d7e8bca308f20071d1fb4531b8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
071af0ceb84c00cff3374dd73ac978c9

SHA1
540db52f1566b176df4683288777a46b082129f7

SHA256
7c8c472b3bbdcd9ebce02a3dd65a0285986ea6db898c08d7e790320b8fc37482

SHA512
988985d6bc0c620c9d571296c33c7d3530a71e77c8a2056bc511a3b25c04ab654cf0aa326e744d1e58eb7a8dae5d615084d8c2124297e2c76b2584274898986d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b19fde1874c6e4d75bfae89ca3a49cff

SHA1
830929865beb6fe7408da3f6408e79e739d1153e

SHA256
cd2a4702d6d7d3ef1c50ae810af22115488f87bf5f7b2e9db2b1ccc0cc76744f

SHA512
2c310c161a3bc13cd0a112d81fb7ddc7a23d230ed24918d18f79b120bc8c0e8ed96c674248b818b3dd96db2d9b8fc519918f0c77b6f2276e7e8dfe43f6e653d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b3ccab16641560c18056b0b2757bd05

SHA1
5cc62c575db049b074918ee746982a34f27a08a5

SHA256
8f8c4d557160c8acdbcb5bd9d065ee4139b8d95c2b44cc9927707e09a0065461

SHA512
a433a3e0cf46b8bab1123d4bba92a8c5890c61124b12dbe44271b76afdc671d118bf8296e8894c2a84f8e27cc5dae9c53c0be22838674b6a92915b9f66e16a7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1815.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1875.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit