10367465064bdedb8d0850210ea17ac769c201aa369fdb57c50d450b73bd5c13

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 02:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65a16c813b696f771177a7c4c5a9577c_JaffaCakes118.html
Size

19KB
MD5

65a16c813b696f771177a7c4c5a9577c
SHA1

973b132c65c23ee3e2ca216e195c2b06bc5fb26d
SHA256

10367465064bdedb8d0850210ea17ac769c201aa369fdb57c50d450b73bd5c13
SHA512

9da21f9b9600053bf09c3300281a3b3d9a2f2a56f60ae2278dc2b65e02401f4bf86d85e4317fb98d663912508f2114197d2304e90ddeaa32e3685aa80a7ab9cf
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAIe4wzUnjBhMW82qDB8:SIMd0I5nO9H/svMVxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B468DDE1-17DF-11EF-99EB-F2F7F00EEB0D} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422505371"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

3056 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

3056 iexplore.exe
3056 iexplore.exe
2168 IEXPLORE.EXE
2168 IEXPLORE.EXE
2168 IEXPLORE.EXE
2168 IEXPLORE.EXE

pid	process
3056	iexplore.exe

pid	process
3056	iexplore.exe
3056	iexplore.exe
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 3056 wrote to memory of 2168	3056	iexplore.exe	IEXPLORE.EXE
PID 3056 wrote to memory of 2168	3056	iexplore.exe	IEXPLORE.EXE
PID 3056 wrote to memory of 2168	3056	iexplore.exe	IEXPLORE.EXE
PID 3056 wrote to memory of 2168	3056	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\65a16c813b696f771177a7c4c5a9577c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3056

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3056 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
069fbc6ecdcc7d0a49f752e52997c508

SHA1
7a0f15db3de839a2cba05fb8f7625a364355eb79

SHA256
553c2b7ecd93f158e39e588d5d23d146d0213c17a3b5b48e977bf46c72bcfcb1

SHA512
ae4720b3285bb4967b90446df3ac78365fe8d6025c5fb86a2f0651df93b216a17380a66c6f9ca3d17825568fa369613835cb56899ef8f5d5d39386388618001f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07e4725ee01b2e273980482e8c80d280

SHA1
e36bc640d4f72ba39549711e73c6eab61ef74e01

SHA256
e797bc79ea1a2b1a3f1cc942f6ae5011295a5418d7990d82aae70ab01f006100

SHA512
a7ecfaa24cc7117559253158fc91410a8608b2191be51da311e61bcce52c27475ee27f4185474b20f9cfcf8860b24384da502d26ad672fdbe601a1ce4a2fefc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71f4505416d8883cfd1667c17c6f72a1

SHA1
748b492edb2059c56310d4024fdd327b5cdc1d9b

SHA256
59cf7041be60491450b6e85c7ce0da6378e35dcb27375b503110ea83a8cd7a29

SHA512
5511e0d6e09cc774c02cf7ad0aa7381dc21b94674c677f7aac9d2fa6d9f96973bb19e56edbbd0a958f9b09b539fd2e06e9f3cf55e89c1be130e77349d01de211

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07fb272038961dc854441efc57027350

SHA1
3dcef710388d63ebd7d9a77f29491899727bfc53

SHA256
5bee00b372a07a7bbc74af5c384dff3279b721df525fff8ecac1f26418a47997

SHA512
924df6c16a55268c6e696444e74b139cd40a7009c79b77933b850bf1c936f9e81ce5c2e5a05d952c9105e212405c64442198e3f0cd56e298197b1d0ec7ef5649

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
41b477fef8c85f719e1dd8957ecb9c47

SHA1
43e96ea2b4e2a44d8ac846c4fb1b285cdcae8e77

SHA256
8f7e2b112b50a42abd4a59b130d05bd5ccf90118851edef369a796a958cbc632

SHA512
cbc5f027cbc11556458e0f354f11d1c56ed9e0c326976859446f23aa60ca0ba7a7ef744045684d791f70a901997974f0f6b4d013a8ca96d38788d2ee319c6cab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4e902797d08e2aeb21e3db0a87c6e70

SHA1
91ca4fd404e8bcf316ebc4dc0825d8da1a9b21f2

SHA256
4f7264038a70a3894ff69a61d71890207a8d3c914181cb36e0661f3b334d581b

SHA512
59ded5f4b8368a4c83f93fb5b52f35228082de4971f9986b367ff126933537ac91f62ae675c85287b4fd7bc8e4f451a1e98a070a3a90e393b84a2d497e89294b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d4204f54ec810a4780d8707eb48be7a

SHA1
82ae3bac9abc53ccbf6f7948cc2154456e52a64b

SHA256
59b79c6738ab2dfd0882b08940375130ad9650e324d197eccf995c83ac674183

SHA512
a93d7c80e0503a1df4516e5e485d266385ecc216bf453d08d40c7055c15e06b857eaefcb3ed2f27b2577b5b26712b2cdfb0350e772820a16b0c6fa52775c1085

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
effb8c2255ab3ddd12e9ef73c8a4c852

SHA1
373a9e19034ad55de335b738e3f64968e6138699

SHA256
6d0a08f311697ca428835f3108302e795ba68b1d13901e1a8ff7c2f49ea6bef4

SHA512
c97985a993e441cabeafbf65cde4ee93477533c89658e3aeb23c0746264d70d5bf986d189a4d94de2804177570a64c5e6bbab57cf1baf8fc59d889b26ba4724e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
01e9a3c7068ddc315eeedcfc529e85e5

SHA1
579d59799ca12d190d2204a6b05e953d36e32f75

SHA256
fcd99ee8cbc4240eb544eb3b7d5f5f67465ea620485aa139f1d98b030951f0f8

SHA512
d00d4e57f61892845e7862a205c136503f3dc91fb7263a20a0657de32fd70d81db487f375f94ad89d12ce643ef64e34a8b20be825bf0005e53cc0e08886afdbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab23B8.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2429.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit