491139a6d2106ee02da5f87042edaa58643b985f3f870b770fbead0c62361e6a

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 23:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69119224b148c276d949bab2d051ea0d_JaffaCakes118.html
Size

19KB
MD5

69119224b148c276d949bab2d051ea0d
SHA1

e6d0041b7ad97b9708d76c31c09c01ab978bbd98
SHA256

491139a6d2106ee02da5f87042edaa58643b985f3f870b770fbead0c62361e6a
SHA512

20b77b005212e4817aecb5434db0d036a68c3b1958db52bf39f262ef8bbc0f28f7baced6e03bf9288ebc322830fae6c0409ba17b13b7a507f17ec33270fb4d88
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIS4izUnjBhC082qDB8:SIMd0I5nvHtsvC3xDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422584122"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0F0EB0A1-1897-11EF-A346-76B743CBA6BC} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1680 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1680 iexplore.exe
1680 iexplore.exe
2228 IEXPLORE.EXE
2228 IEXPLORE.EXE
2228 IEXPLORE.EXE
2228 IEXPLORE.EXE

pid	process
1680	iexplore.exe

pid	process
1680	iexplore.exe
1680	iexplore.exe
2228	IEXPLORE.EXE
2228	IEXPLORE.EXE
2228	IEXPLORE.EXE
2228	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1680 wrote to memory of 2228	1680	iexplore.exe	IEXPLORE.EXE
PID 1680 wrote to memory of 2228	1680	iexplore.exe	IEXPLORE.EXE
PID 1680 wrote to memory of 2228	1680	iexplore.exe	IEXPLORE.EXE
PID 1680 wrote to memory of 2228	1680	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\69119224b148c276d949bab2d051ea0d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1680

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1680 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2228

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
66fe42051b27ea08a6822b57a380158a

SHA1
f4fbc8ebb925b6de888400927fc3bcaf593eec5d

SHA256
70558cca39128bbf094756a9b1f51c41c5db7b335bba4ee4ea8b3fac1934b429

SHA512
d41425564d186adac40523bfc5ca4cb383931ad1f61bfdeb4f7e98755258adaa88ecf8d1e9eafa16c8dd6915f8a68c201f1d804490a383530dff668d4247cb0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
2ad93bd58d46d4fd35dab9f3a9fdd9cb

SHA1
2a3afde7ec1e46421b4a4571c7b1ec1a46df5f89

SHA256
8b556ed00efc0823ab51599ba82e9648a224d5c53e49ec6fccbb46e12751a5d3

SHA512
4b06de9d9c79af95f66ad15468cea7a0c74cb126b9db026fe4e102b3bad168766448139d9eb92a914ffd1d6c1a70b09c386b5a2704e69703e16fdbedd5bc6c29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
1d52ab5e3f1419a965374e127c7e61a8

SHA1
65b615f83fa84d93d596e69b1b70c84f01520869

SHA256
eca940fa18dd5a482882dad24bc1267ca2e41f03187ab1be89a2630a2206d2ae

SHA512
0ac237fc516f3d95a5637cb05364f4f005ab72863599607cd4ff78f669e30f603a3467d78803022b16777582c154d830a4b26175c85c6587a4e7efe6ed6859ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
4076af96f9ca798a1094a8a2c99f2051

SHA1
2c24d10aa6aaf1e5a661eecca9fad93ed8304fbb

SHA256
5b919c3ff387f52c99286b7e37e11b828e60be74ccc418dcd9200dd3634f0dce

SHA512
c0433a09291dc36363419990241488d0d3b78f8444973cd5a45f0e83116623e576a2228dc9294476ac085ac7d1a263e13c6d39fff7810d0343e7c6d91d671065

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
9a48e9b8de8e3ad64ded0d430f3d7f9b

SHA1
162a1c83ecdf72f723dd97d30721f75cb3d46732

SHA256
365feceedc0c3b144238852bd81ea80bbeb7ed7b462e712be85b8e14508e9ff0

SHA512
ba31578c99df8a3cd72528e5c1db13c15f4eb575f839ad0d8012924dd3307ace0f6a7c65573e9971202f886039d91de4b68de7d660af1eba42fb478d89da4bcd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
40c8cc008a7296885084619aca5cd63b

SHA1
04071ae21ff0aaa15351dd672c5c7f555b48ace5

SHA256
3e75d0603c95e9fd905387cf072466f3c641ec7156a3023eeab6c69beae351d5

SHA512
13787ad66669fe3ba1a6f72bb41413be3d2d06d2ad86acedd6ed773f0d4d3d8f77d47f779548a8575218a1d8819775f9f2ab2ea31736cdcc24bb94a80b4d46d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
0afb920b95456eed0034709e0331200b

SHA1
24b533e347201f614c22cd7d6a9ec2232d6c27b7

SHA256
023fab21a9ce6904f8ca078ec21c7b80bea0f41423449a7411643e20f8dfb519

SHA512
170ff928aed1f90f34dc0e59ace00d36264aecd11da643910f51a1cca8e84e35b3f88783de000b76bc1bbae4d2cef479d80ca6845bce5081f4ee5fe83407b190

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
ade113481b9a73fb18d0bdaa472abf7f

SHA1
74ba7448146469df065246af30b09db3e42180cf

SHA256
47c792ffad2981a4c729d81e6f9434d29f3c02e44b14607cde8be03b829fd9e1

SHA512
9882adcb29369f201aa24130230a8956ec8cf71d4472beb3541dd5f317daf58ba300a0c31cbf65207eb00de258762a9dc89067640c4963917d2db4514cdbd1de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
642385b197030d4fcbc22b607876c89e

SHA1
fe62c6d23a30870def8159f71613d5eb128bf44a

SHA256
31b84cc7a285e8cd6adc38a304a9c24b43e8b7e59004fc4b678aa636957e2889

SHA512
8e6a68d91af53e45495ebeedfc029ef7f6548ebaf3acaba982589ff80dc28dfce8a901c836b6fa8b66fd5a39518a9d28f8c23269df5d69c42054d1601ce007fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3F9.tmp
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar469.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit