d173518c5e1a7f825b4e1e262c60737a78825ef03e3908329e6bb9c4edcbc2af

Analysis

max time kernel
149s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 01:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

658109a75f557604a9d19f426dfd2f73_JaffaCakes118.html
Size

22KB
MD5

658109a75f557604a9d19f426dfd2f73
SHA1

1b41fd6513ef91169b3c0daa7f76eee698814086
SHA256

d173518c5e1a7f825b4e1e262c60737a78825ef03e3908329e6bb9c4edcbc2af
SHA512

a8c9e13720ba1b01c45c822dba98158fbd69eae8df887d6834d2b9060e94fe2c9561113dc0c166d64bd861a146409135b020f0038f37db71c129157a4d378fc9
SSDEEP

384:USIHA/Tv5/jIB/qoLsE2shnKAWAZJA5h+RiJrEuw:USZTRjIEanLWUJMh+RiJrEx

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422502779"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AAB5EC31-17D9-11EF-8C27-FA5112F1BCBF} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1760 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1760 iexplore.exe
1760 iexplore.exe
1296 IEXPLORE.EXE
1296 IEXPLORE.EXE
1296 IEXPLORE.EXE
1296 IEXPLORE.EXE

pid	process
1760	iexplore.exe

pid	process
1760	iexplore.exe
1760	iexplore.exe
1296	IEXPLORE.EXE
1296	IEXPLORE.EXE
1296	IEXPLORE.EXE
1296	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1760 wrote to memory of 1296	1760	iexplore.exe	IEXPLORE.EXE
PID 1760 wrote to memory of 1296	1760	iexplore.exe	IEXPLORE.EXE
PID 1760 wrote to memory of 1296	1760	iexplore.exe	IEXPLORE.EXE
PID 1760 wrote to memory of 1296	1760	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\658109a75f557604a9d19f426dfd2f73_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1760

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1760 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
2b45ae73a348cc4ec5f66d155b360116

SHA1
5131d9d168d665c332ea3814ee4ef772cdd86f0e

SHA256
62cd2491b8924a90e2c92f1e7f34f58143adc930985b21891fb4d51041ae4a1a

SHA512
d51ad824668c6f058c1d6e71a2558f0ad054c82a6cd9135dd72f801c3739ce5b247332b8002ac7bc3c270937770f76ee90e5c75bf5a8202a7035173cdb2020bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19a29d71c8abccd71a21e64926859f02

SHA1
0bb4e31c844f879a3bbd42c6bb3b7f6199446b44

SHA256
0eab8b9eb495c5313983f8a2aa48b8502daf3a8298c9025f410489291398291e

SHA512
3271d57595795826bac35664ebf0ca582083c424e6c905d8531681350b579f98b4d8bffd8c6d4c6703d8dafdf1bffea09aa3b3084cecf0042862805e8bb5ba0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c89fbc4402f7122045714697d929b1d

SHA1
99ee380f10dd1aaffef3df754c317e0acfb9e1d5

SHA256
d25b3a8923e42f58dc624b3296e70f3fd6d3e3c742b260e1d4a1247b71e0e593

SHA512
729360a010efc5e9e86bc0dd0954146aea4870bff23f215c80f55b901c3cf44c9537796f0654f214deb6ee09db31d7623598a9e7f5e4934d62327c121526147e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d8a9c10da6968252c77509ca04b1316

SHA1
67d72a07d63e4f7cf9bf8c9d3ae6b0a96e8d9b75

SHA256
a51411f986a86c1a6c047af29d4735b736a11851035aea8d76c3091045f383f7

SHA512
2cfb223aeefe403c54aca60bd586caa6bd11bdec6837f85185330d85585552d600f21ed5317b031b84fd18a9a787a7d139bed79da8b069d5f96f293a82ea7f51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d29594e4917ae8d9eb48095015d38ba0

SHA1
b8868f2d124a6548445cc97ab681e83281c305aa

SHA256
5234a4457ec3f4336de4295dcf6f9700353dad7fbd45b527708cac5055fcd69a

SHA512
6bd42f7f488e1e5ee2488763ce20a9371f374117aed6d84760b3f7cb59f1d6beff2f683e5096894021f1c2dba2c53db59117ffb27b29ff3162765882f105c518

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9555fb59d7ffa69291d7c6d8e07cb71d

SHA1
52a6ed63a7bb08cbb4dda4d04b9fe8bae9b7a30e

SHA256
e04c7e4f201bbeba89ab03199d3bd4106997023e085fc6a0e24029fe0fe3e27f

SHA512
22d904849939e620eb8215eb4440820c2c812e62deabb9d12f57f2daa1e6070df37227ad24063871d4598e7b68124b23ec77950a3cd7d729723e0bcdea309b1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea826b048725309829c09200535c73ec

SHA1
bfda19022f95e42208fa581f132bd99f57abcb26

SHA256
6e82bc3998a1bc02871acea1d86901640eb5154c1b0a6485778901858c002af9

SHA512
f0b21f1f5ad8d46ce9f73790ae3b3ad0a4e8a47d952f2f0858a9f664486fb827aaa70e3b30aad537a4cbde84d8b22ff37d23b6b247eaddfbff49960fadf2466c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da8cb47c8123a4826d39381bb5475899

SHA1
fc4fe88c6bf97a9c36d6a5d07942a0ca2cf5c0de

SHA256
c39f27ec1a24763e42b8df14e4aa32a53b0eaebfb20877a56775d99223b1dcba

SHA512
5883842f3c09320d8ff910f254e6fa8e6fb1ff7ba463ab09a63f3794beb17f6278f72600b6ce05829fa80feafb05a9c7772fa16ad712415b79395c6a9f139aa3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9701cf8a2a34b7772c6fa7ec1da92956

SHA1
7b3b7b8307e88281dbbe32b4fe07791ea804259a

SHA256
3609b157bd3aa975acea6b1326dbb62c02fc96fb439ed90a0120d8c130f975e5

SHA512
c4ae31bdfc4998e699576bfa67dd34667601d2978239277b85da7f23f3e9c533825aaf5a5c049133aed924eb5c9d0b1bfb5c3ff59c34761d761cf818e5cea9ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0290cfa38eabc609dd6e9da2cc28dd15

SHA1
8d23fc86cc572f5b02a9cdd3a592f8e61b7612c8

SHA256
69c4afc48cab4f910c75065543486208eee611fc044b3d4827cc1271775da243

SHA512
a8ff9c9272e22bf77cf66d0ad81ddce3cb4ada599652277a9f44309272838e45feb6f41cec3c7ef80e35bc28df6999f9f2e0d406c9908ab92537cf6195f22875

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13ba600ce3ebdd9f51e0990eaed943f5

SHA1
1a4132646088c1d8175b83e74aa3083ab5f4ee1b

SHA256
cbea0582eef95b067b656c1073bfa66ea86ef92d078e38e2d01abedecaf01c4d

SHA512
f4076702398a727c8be6639e7453923b59ed3065db3954de1ec41c54fe8a8d843854d1cf330d952d1f6c20e9fc78dcfbbfcc636636ba30931ccdffa591f2520a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b67c871b722a20bacee1976518c95b58

SHA1
7d0298313db598918ed8af51f5d40236f8d886d8

SHA256
7004436da65da75a870bd6e64110e274e7f3fa802a3419127dc4f5ff2f083e24

SHA512
64074b41703cf70f4920f2759635bf52e135a621e74772421fb874dc714b033d7f3cbbf6cfd243c3d115687b2c11069aa88a6916ac7added0470f1be89f6333c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
9798a9d96d7e93ce48e881fa5dcd1da4

SHA1
e05079be33bdf9d5c8db194ed7ab282e44dbaf42

SHA256
36590d78531d213b72cdca9fb97514d18b597d61978cd2f2a624cdcca8e84384

SHA512
d8b2f5fdc691e6e260b2143f21aa2b130bf525d49618bec925f3911ae1046913fd40e86a6703599c51265ecad9529d1da8421ff4ecebd8e39fc3b06bd377bc4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L9PN2QMY\jquery.min[1].js

Filesize
89KB

MD5
219073097031d9c1a95a1291d66f3a10

SHA1
2b7996b01d90b7f424f2a2e6063947461db4b2b2

SHA256
232066e3f6f1351afdaee1acb70c409766641fd5669e0b55ce7c77fac0a857ef

SHA512
9ad2745f96cf79a4d59393cc3fbb3958b244013f6798c12abe41e37fca80df3c7cedab4b47cbd197645c86b31077388ec8f01ea8d67c5feacbef95b1ae7582b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7C34.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7C35.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7DFF.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit