e82eb052f3d105b3f0bfebbd6da54a015d8becd7fd04e3fa5e7073e2124ada15

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 01:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65866be9545a489fc68fe4982eb2b492_JaffaCakes118.html
Size

141KB
MD5

65866be9545a489fc68fe4982eb2b492
SHA1

680bb57a3a2e7cd61f83fb7c68b5d61da2cde7a4
SHA256

e82eb052f3d105b3f0bfebbd6da54a015d8becd7fd04e3fa5e7073e2124ada15
SHA512

dac6376f74ee1d9c9142eeb44d7ae3e81910eab281c7c07397b3e833c42d9e286967129c48ba272c3cb1acf26236483a334af71f50fe91890964a82091f8a494
SSDEEP

1536:SJQCqW8NZT1KWx76vuyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXAZ:S1uNtx7dyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 37 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEiexplore.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B1A7F2D1-17DA-11EF-882F-5E44E0CFDD1C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422503226"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2784 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2784 iexplore.exe
2784 iexplore.exe
2788 IEXPLORE.EXE
2788 IEXPLORE.EXE
2788 IEXPLORE.EXE
2788 IEXPLORE.EXE

pid	process
2784	iexplore.exe

pid	process
2784	iexplore.exe
2784	iexplore.exe
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2784 wrote to memory of 2788	2784	iexplore.exe	IEXPLORE.EXE
PID 2784 wrote to memory of 2788	2784	iexplore.exe	IEXPLORE.EXE
PID 2784 wrote to memory of 2788	2784	iexplore.exe	IEXPLORE.EXE
PID 2784 wrote to memory of 2788	2784	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\65866be9545a489fc68fe4982eb2b492_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2784

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2784 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2788

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize
252B

MD5
395405a97d939a2d033e3cc30483d672

SHA1
ec2bb686ac7a63534af4d4796be41fe937b18b2e

SHA256
bea987f1d2ed046554364c1e741a00df6af2622723f07e7c4c4f6191efb8b127

SHA512
9ee046bd5d97d18875c391f10e5d0134aeecdd38bd54a797d834401db653bfcc8b3002ace01841ac939f19c8f0d61c3a97a8c0ca30a9c3b5e95fc2a0e4876335

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
bea72ce09fb2b03757ff22886a7d3f77

SHA1
df501f196e1b32df5f6fcda30ccc126c6cd58cfd

SHA256
8adaa5a70747a596d9a90cf886d24f13d1a44b40dca9757e855e7cee053f8380

SHA512
709fd8f5745ea3de369ff7bc546c869aebe20662f625527cedbb7e9f344f588c3c5df2fe51dde59e6e108e15f56f638654ef15cabb9ee5271ece565553b29824

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
583d2efa3425ff7fb5b21b9e2204bd17

SHA1
bf4ce5ecd28622845bb6c1d286be5e92e1fe39b3

SHA256
d7c8230fbfd379a7ac1a22b8d0c6b90b21cd414bdba9e34383e0744eb0134baa

SHA512
fd8dec44aef54eb3fe57a24422ba33253b31af0f5970545621117565a26ac368f615a1d651a56bc96e284cfb0dbc79308b4dd44ad18bb4932e738dc977709230

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
a2e3af3765b9f60cc5825202c0c1c01f

SHA1
5fed2692b25f186858a6b702dc5f29075d2534f7

SHA256
e84e903da6639a4e5969781471473ae944c35185bdf63cb433b706ece354daf9

SHA512
f11ef49bedb2b62b84fe904a9bfc9c0fa2348b40ee68897a6a2a080fde474805179a7f5d29193b77c1d7f1ee128c14aeaa100a2a8b8bcc5ef3d601a82c282486

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
9c7d973b0ce69c469363e5becabe5e24

SHA1
42d4d2a5c5895b50d5532a6e04619bc01c4a1a6a

SHA256
8770aa5787d704f095fecac56cb344337c09201461f094a219bc068a5ec76827

SHA512
9e4c4571184882c2647b4263ba054bf13313d4bc47f4bf986a8db6ec247814edd86dfd3d3d3294e971559e1d26ac383afe469b187d59c1d092adcacd182bad8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
f15d13a3a0341c4a87a3d4ebf09bfc1e

SHA1
3243540323920bf2d7c5b06e8bafdd4f51df8bc7

SHA256
7d397b47ad578f57c8e50931eb1dce9abff36ad20ae4a641a7af494cf14fff45

SHA512
d8392d13a83c1e9b1bfe91539d34c7c47297e158a9a4fb3bb3a0b813cf7ec045257c8e0128ed719364a42b2fb0a8f21d4f4b946ccfc28e13fb5a4c2e68fa75ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
617145a4830f148822498970818bc3c9

SHA1
d97436663d688ade50ff57de1dfcd9d4aa5ded47

SHA256
982ae8ad9eb2aef9a79d45674da7092eca1de7f1808be3578a1547aaf6a7449d

SHA512
59566692ef949da128f1ae9d2b498aea83b48a411eb7dac5e855299f4d6ebca1d0565ba5099a5d711c4ee577320796f9e1e733bb7b8a51d4f90ef45b75b1d85b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
35912cbf4dbf61ddcb8cbba30ed0a3c9

SHA1
eb9dc3b09b6df267d3f1a852d0a54f0ee9196215

SHA256
16934ab3727785206dfa8772a291649eea7eb3389f98b0457c04fd2092000e5b

SHA512
085d97b49fda8be084c7676a3bbaa4457609ccd3b2924e4c56634d8be21530ccfe57d80b6e950878c1444a4c6c4d50ef324db6d6308ca4fbd3cbb42af942526e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
a974d51f4a9b6fb11166dae7eea9a1fc

SHA1
99ac65104124c592c1d6ae4ec568db9ca0ee9b6b

SHA256
31a1949c1d3c07ddc165d0f6d9d61bf3eccf5b32ffcf71716015059b210e39eb

SHA512
da65a7dccdaff3b83984629408e890093a2d49b46c396c4154fb75dcb31770c70839716298f92c4b3eebd066f261da793781a13997564e29f9dffc790dd804eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
1e3305aa1c2ca2a63c2313af69dec171

SHA1
10883c2dbfc74911a4a354b762831787d7abf3f2

SHA256
f6abf26b4578769473ed1f4823d3f56c2ac65cf91512f6b9223b97b4ac5e5e3b

SHA512
bd615c7309ed4e768228e19f77611ac7a8b1b01b993ae4e4cafa0e036d7113fe98b4564c0304320610177e4c15c82aaf25659dc7551e0f9595bd46aaa21be928

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
56167c28394edef3a4347c8d0069a8e2

SHA1
e13646e1475a8b18949d0b80e2f2badcad9cef15

SHA256
56a21db4dcdbf0f7683cd2e67165ae24c5b296c294b570c0fb781e99abe4764d

SHA512
97ca39c810ae7739555cc5711079ffb14da60b08e9008d27691839003f570e3f96fffcbf5797ee9ef78656e55cce6b0288929d3fefc9e0e6a1c2e2268f4da054

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
242B

MD5
61e80cca3072c1a95938717263a51ed1

SHA1
c2a37e5fb867e9ef4fc226f8064d640b8e235ac7

SHA256
f8eeefafd267f8d078c13587e0e83998b6a42dcd357c11c643f47c374eaea72a

SHA512
96281eb2d1eeb4908e9022130dc75fbe2bd87f41fde4aadd127999aba1a7fb32131857417a2b45d89bb82784e42178f68eca8d1aab6a588052d41b3d7c32a44d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar13E3.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit