0a3ed4155f77740eb3e10792f8e432fa753ca450ad45c7589061c7903b6b6f69

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 02:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65b54fd64c7cb5bfb817871539a49ce4_JaffaCakes118.html
Size

23KB
MD5

65b54fd64c7cb5bfb817871539a49ce4
SHA1

3ce3ff962c3c96accd5419f5844f0dbddbee6587
SHA256

0a3ed4155f77740eb3e10792f8e432fa753ca450ad45c7589061c7903b6b6f69
SHA512

26a11623a066463e361d57026532a9c4fbda52811d9cad2921147f5bfbe84657a2a3507fac64e3348255790e041099fbe3cdd564381acc853271ec191f4d898d
SSDEEP

384:CZyl6HBM6BM6BM6BMoBMrBMRBMnBMIBM5BM5BMdBMBxm4UM8:CZtHC6C6C6CoCrCRCnCIC5C5CdC3Z38

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422507122"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C775B5D1-17E3-11EF-AD12-DE87C8C490F0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2192 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2192 iexplore.exe
2192 iexplore.exe
2960 IEXPLORE.EXE
2960 IEXPLORE.EXE
2960 IEXPLORE.EXE
2960 IEXPLORE.EXE

pid	process
2192	iexplore.exe

pid	process
2192	iexplore.exe
2192	iexplore.exe
2960	IEXPLORE.EXE
2960	IEXPLORE.EXE
2960	IEXPLORE.EXE
2960	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2192 wrote to memory of 2960	2192	iexplore.exe	IEXPLORE.EXE
PID 2192 wrote to memory of 2960	2192	iexplore.exe	IEXPLORE.EXE
PID 2192 wrote to memory of 2960	2192	iexplore.exe	IEXPLORE.EXE
PID 2192 wrote to memory of 2960	2192	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\65b54fd64c7cb5bfb817871539a49ce4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2192

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2192 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d778ce6e847396383e28bdde9adebada

SHA1
2dc913c2920f6e36eb49b1729d6f8901b7ee86fe

SHA256
68be48ff4efca0619067ffd2b055ae36bc1443d6f763d98829fdec4e15a5208f

SHA512
bf0e292996cc9155b25073787d9f310ff962b1394a3e41f2c62ae5852a3b510b9f61e5cd23ffaf18649e96df11b6015525b559ca7b4b0e34cf978379064990d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
578e1d39526741be8edb9f7185507c08

SHA1
e8c148488352ea225deaa51e15222d4f3caae170

SHA256
b07422ee8852d1243cf672daae646df2177cad3f2a2baca379d6432c7660fdfd

SHA512
77a8d6409a03679404811da3cdbc899cac393b243ce19b18c937dbc4b6effd884629df8f09c496fc5aa428f2b4042e4b435d0ad467fb039d714b0f1f1d709f71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a195160fcfd686e18e1f9667639f49db

SHA1
7ca08963e46d4cf38c5b2ef75b3d4722c618ed30

SHA256
756f29f75c56eeefb081ffb231363c23bd8e5cfbbdbc4fdf3178e9a141190830

SHA512
70c62f70f78b1a8c2e23ace8a9d11076cc30f4872b2f1df33c4a7389d981e5d9eb6dc8071b2035a3ccf03337bb2b62a0904c4595ec0b6daf844e27704a1b54ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
944250d8696c64f380d9ae657a98c4c1

SHA1
7659d64da0b926fc2ffe0205b8cae9e287c646c8

SHA256
d58fdd0e0f2cb2eb6a878753658fc7e7d84adbdae6f89abde6d245a559e8e23c

SHA512
2ee8723834813238e4f8fc2557bb4ee57cfcef1deceb696004388a3fdce50054e2630231697805374e1676997bcfa6b2f2cf5c1a4684492ffc482b013f9b8e73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
54c70abc3a346705f64e594fd5436f72

SHA1
0974d4ec09e9815dca25ffe4ee075a67caf39077

SHA256
f6c5e91baece249134395311f127152901b68d658b671a60a351c3527912adf4

SHA512
1c9edeb7cef2d358e094e41dbf515f92e82b506ca692de9d1a9564193fc400b171f8ce3361e2feb7258f835cb2a5a0f7114891cd979cd4f6cbf9f5757576dc01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cfda61bb150b8cbad2215e51c0113121

SHA1
b3b6cfe005dd9be4116c759995b0971e7bf62d45

SHA256
259f274c2e2f88421da4252f474e7d45c0723101ba1b54612e1e248ff1c90ccf

SHA512
b32e457d0b13ffb8d8d9fae27b9a94cf363755210b64390311be64c105be797fea41353d01c357e0dcaf162bd9149e8d45c41b95a8240b1cf85a11b86ea3e03f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76af16bef5044ae148049674811571bb

SHA1
8153a29a8f380db575008d71e55af0e0d7dcd70e

SHA256
39cb46def70ce9f5329407a5826dcb661e72fec33d8cac62a062c3efd8059aa0

SHA512
3b5712ae99d54c97ac7f42e31c90f8992f35a85d417732af040527b172a63d9b3c017318711e6a8079a8806fc300d56ba50e39cbcb47ca19062e0e7d3e0200ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
92010e300e2cfe5ea014b5b3a1922c37

SHA1
b148e31979b1eea941f3ea8bb24d649a6ce317fc

SHA256
3bfef509cac38c69f6cb7f327724e5902d1ec64ff1a0b528671a670ba2c46608

SHA512
b455fc57a32647a1f196193f78db2c1ef22962d2932a875904fcefee6fa08dabc85019387135cd0f5a8121c3b3302f66222a4a857d9da3fc3e31df618bfbd051

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab14E8.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar15BB.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit