1406d85dc6ac145b27149560ef9a253cd8a634f6224eed28067429427155d3ca

Analysis

max time kernel
148s
max time network
145s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 02:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65b5b12d2bf44cdc48d2dd6cacd50209_JaffaCakes118.html
Size

20KB
MD5

65b5b12d2bf44cdc48d2dd6cacd50209
SHA1

8749c5d9b07aec5dfb8a0f9142f98c99ba52c3a9
SHA256

1406d85dc6ac145b27149560ef9a253cd8a634f6224eed28067429427155d3ca
SHA512

6c8f9d79a280822a192fdfbc2458d49b1c59b32681a2f4673d15e308a643b8354694fb47530baa0a5289bce8370916742b223826f71cac982ddbb564d4705698
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAI94HzUnjBhRr82qDB8:SIMd0I5nO9H1svRQxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DC4EBF11-17E3-11EF-82E1-DE62917EBCA6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422507157"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2188 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2188 iexplore.exe
2188 iexplore.exe
2100 IEXPLORE.EXE
2100 IEXPLORE.EXE
2100 IEXPLORE.EXE
2100 IEXPLORE.EXE

pid	process
2188	iexplore.exe

pid	process
2188	iexplore.exe
2188	iexplore.exe
2100	IEXPLORE.EXE
2100	IEXPLORE.EXE
2100	IEXPLORE.EXE
2100	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2188 wrote to memory of 2100	2188	iexplore.exe	IEXPLORE.EXE
PID 2188 wrote to memory of 2100	2188	iexplore.exe	IEXPLORE.EXE
PID 2188 wrote to memory of 2100	2188	iexplore.exe	IEXPLORE.EXE
PID 2188 wrote to memory of 2100	2188	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\65b5b12d2bf44cdc48d2dd6cacd50209_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2188

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2188 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f98b46664a60b0d30a67cffd9d8fb57

SHA1
b1464ea10439affda37a71692939c579ae1d7fdd

SHA256
85e4c1d468e6ad51a33dc18bfba95d61583737ba0b34f5297e50600adec2db54

SHA512
b0fedd253f4892dcab931ac87ab12034b59bdb64f12b0aec160563a97d64237200bbd32830c9728d1144c5af4e6ad7e20a4a150f6477655e192ed37936451a16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
207718576e2e1e4039e66469004fcf2e

SHA1
4f78a139605e14253303ef1d1a24c236b2ab7122

SHA256
611664c808253cd3c46ff168d53834be000797b42b025cc96454ba5b465234b0

SHA512
888ef6fd339637ff69469f603e4f3d1bcb8166a8ec2f2f95fc1d08d83313647925a98836fa371affb8eb96ff91195dd3de134ef4aa2e8661e9a679ab8289fae6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a4482f9fd413031abc3336852c1f320

SHA1
e7b2613c51767ba7d4712ea4d7724354d1cfe508

SHA256
4e2f526a7f3ea0fd02891c9e496ad0fdd6365b811f8ba3f9981626952c58cb39

SHA512
39230f71eafb2a2777616f1ba0751fb826ec5c208cc4c863284b038f7e46481bb823af6e1eaed8b81df9d58ca7ec2912fae65064347369ac94bfef7a63ea3eb0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c9b415c394dcccf3157abb9ef737d94d

SHA1
354e79352e1dfdcf6f5d4cd6970db8a53ecacf0e

SHA256
bd3fa2604efd428c3b5897ae0da02caf9c4c842712ded62e97c32fae9ea4e2b5

SHA512
9e3d1192048155aa36b95048b499e64ddd473dff1c04f47e57f561e092e6603511b65ef339e25fbe58e3eb097aaa8ff5839c38ae8db68c6cb1d465ebcc8ed7bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cea1b21aa5cd0dc134b5c5acd74362e0

SHA1
6569c2bbba497935a941d05f5f3c27fb5295a737

SHA256
e69adb9ab6e51f0be6a668ac6706b5320c1ff13ac395e2dfa8f957cc4f0d4d7e

SHA512
593506704aad64b717ae6afcb5ee8ae9e3577348d7074bc9cd60f56c987ea232ad2492ed9380f7906c2afc1423b9ad1af196b8f5d6333fb5c56f75bb10988ac0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0de94a6bdc4562ea99982e9adc8cd163

SHA1
14d1dacd2053e03e5b47ed8d2c0809fa2acd1fc0

SHA256
8d5b30c08f4f1d920b49f00b694ef0498214f57665754bd886ac8761750a591f

SHA512
c7aecfcf711c376c6bb5e1318a25a07a0b19b16a7214f107ee70709f1bdbeccdb184cb49c4c362d5e445df50ba503b8fc1b90963d6bf25fc3b8082ad704f800d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ede737855fd41b5b6668cad11944a2af

SHA1
97dc72004c02d54e5c87cf392965f05b71903cb6

SHA256
24dadc9e2471f38b41d74281b918d5b4ce244380b0066d209e1c4cb495d45737

SHA512
27ac4aae21ec2a5cd01459138e1b34853b612df372f94408569c98772e12ae5044843e8b9ac997b9d37524d932c3e48b990a7cee97eb9bb5a8206da3084330c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ab2fa7fc4e4bb7431733c22875f2fb8

SHA1
978fdd5f0be3b5b25dfc5bffab3984c381bc9099

SHA256
1a9d712e4152438c5d0f19bdedb6ab3a98a4247893e68c3e9e0ee71654076783

SHA512
ba56c690f7db6878b925995d12a79d7a57974e2c14763caeb7ea427d324b670da92f214a90e41af590f5b5f6bcc93da4fc3415fb2a90ed2e47b745d5f3949b8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF7D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar105F.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit