7ed1e42a85f2f3c4d7533d9506d24d823a4ad3fdd68f3d8bce5711ddd3759963

Analysis

max time kernel
132s
max time network
143s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 01:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6577a160463cb13bbd5aa77a0416df97_JaffaCakes118.html
Size

55KB
MD5

6577a160463cb13bbd5aa77a0416df97
SHA1

40b793e101653e0389605c13da4e248caf723d0a
SHA256

7ed1e42a85f2f3c4d7533d9506d24d823a4ad3fdd68f3d8bce5711ddd3759963
SHA512

1ddc36145ce4f90875d34574f954019ca746bc119bb9b5edf6ff44f88fe00868e93a547fe7c696a12f3497eb2b28500eb64810147658eb6fe619f90a7a9a0292
SSDEEP

768:KwNYQNxtqgsZ0AQflIPLz4oQcvVABMlfivi:KwN9tq/Z0BflE4WVABMlp

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F124F001-17D7-11EF-B3A2-4205ACB4EED4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422502037"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

3044 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

3044 iexplore.exe
3044 iexplore.exe
2444 IEXPLORE.EXE
2444 IEXPLORE.EXE
2444 IEXPLORE.EXE
2444 IEXPLORE.EXE

pid	process
3044	iexplore.exe

pid	process
3044	iexplore.exe
3044	iexplore.exe
2444	IEXPLORE.EXE
2444	IEXPLORE.EXE
2444	IEXPLORE.EXE
2444	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 3044 wrote to memory of 2444	3044	iexplore.exe	IEXPLORE.EXE
PID 3044 wrote to memory of 2444	3044	iexplore.exe	IEXPLORE.EXE
PID 3044 wrote to memory of 2444	3044	iexplore.exe	IEXPLORE.EXE
PID 3044 wrote to memory of 2444	3044	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6577a160463cb13bbd5aa77a0416df97_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3044

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3044 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0df992ffe184e60fc0557893040dea2d

SHA1
ea5e158ea19d1e9afe36c98ff8864d9c748f18c9

SHA256
f7c06fb0a2ffb7fd9700e1efa2dd663547947b3cbe4a7188549f38044ef666ab

SHA512
6cb5f547f2d93b536470e2b77930b47df604e677c93268f1c203717020c590628377cb4a8bea8072a10fe46a4a036fc15f92137b4b2fde8126c918f6724109c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d1a67c83d545f4212d6059d11ad143a

SHA1
e32c13b6e90f69f4ac1e26901635e3086241392d

SHA256
48fb557d90d4010269a86c24ccf9283ddc06c05669a620bfb099ef04e13c660d

SHA512
82785fd2db5fd516fb140088604147432210f280f6d7bd0e93da37a50908458a9a6d90fcfb183c3abf9d630583deb8fa3031a5798098c326dce779ceb3eaf033

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
141a77c11ced2995f92a528566e71469

SHA1
6536ca6efc9e619f8c365361519f46e848cbf116

SHA256
ac8c1fe57bccac18447aeb822b9b4a61e68d399836a8b9623442afe558f42118

SHA512
9199bfead20d4a1cae7efad6e81fd814f30d231097c0eb8eec61950fd57c7c2f4435d8651447f97c0e419396d90edce7d89d4a7aa15a243005e0b507c1c9d1bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a37cfa5c6460296732925d58184e5f2

SHA1
c38836f05d41d36fd1a3c14d8f483ef3e8898fea

SHA256
e4d94888ae1265391fae8356972d164cb32aa543fed0382cc8c3e364cd2c6223

SHA512
9029b8bf7b42998bdfd3338a73070843258a073470d6d5347b8278e28924bf52abb09baa224a73067513323442d403c71636557d7ff95b4fe4a892084f947c94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
70f8341e5e8b8675c6f926ae246481cc

SHA1
d46aac0203ea489c8b5c5be238e25fca5560517f

SHA256
5ad156625ff9e67db2c74c744abf83ccc3bd225de353eb3e75371e2c230c2ff2

SHA512
c661740a64f22f680aa684821bd8964b07a4945bc052fc298177eb1061ca404c0c7383af5c6259b4884b8f719131d7dc2ac59813c4ae6223b23a542af4a9d17c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
579d6a3ef1e8fb0b5e4ed8f2fc096aef

SHA1
0aecbc2a0816937e6214c70fce089cae15ccafd1

SHA256
2bb3e0ef284713ed87c7dc6f987bb68b541b3796d07104a3fc79a8cd9af3f8ca

SHA512
0bad7e8763f45bc8052d28061bcade6ae1181b3906db7c48f6014d63bd3538e9038fdaa2c3a95462a6577a40652440f027fef71228ccbc935d93b65fd63fb1c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e31435da6e6a5848e1b7d33038f8f867

SHA1
b574b9d2547956c33f4f8b6cb688c0389d62b627

SHA256
e87f78bd5403fbc19d0dd767d2cd72c5c74261453adddf0471a78a542899c14e

SHA512
0c876bfc8ccd29b58a7b3b0b7260e282488b6e1fc85da79d4d36b30c867b1cb30e2147b214bd3b1062a86f5b5dc3d61ed80ecf2caeaf3f4f5620e3d4b7150575

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2926d6b37e17240441f945f2a3a4e52

SHA1
185754ad474d99116786e29d0ce41aece2a550ec

SHA256
ecfbbe9d6c01e564cbddf8370a704b8d100adb025fff8716d55b6b14c3563a71

SHA512
32012a48b3e025604acdd39dd405899fe55d45a5947d2214e3327877de02b068c57374356f8d3c5811c2a867f9c5ae2e4712c885f5a1044dbcf28db2d652b6ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ffacea4b60f6f9ba77793dd22dbe04b6

SHA1
1a71aca3df60d6bc73af4b13277eea00c900dcad

SHA256
4c8c97f018c6611a76818345d45b8c370b50f23f1c8f3c9475c032c6656a05c5

SHA512
ea0796c294f7f25dc14cb58495d9ce938f1204aaf90deb8f8706c2c10acc75f4c135e724449a7a91d0a3d36a0b77b9ea514f7869e6fafb9d8b34cd76dfbf48a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3a97d7000f24fea3129191828c0757a

SHA1
106e0323281ec160eac3244394548c7958fa0bcc

SHA256
14e0953825b8133dabfee0245dfbd8d61b70b043931f3a4714e0a5e5758b6cd5

SHA512
b3e5bcd911b8fa50492ce91dc34af27cfa2d13119c794c7b521be24ce093190f00aa3737d9075b3f015d5541161f4d7c05747b28aa918f41bb54661651006e60

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1A07.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1A69.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit