b77c8eae39f9ce3cc6ee41103dde6ce6a3acac7b5931ef76b4cbca7ba198e6ee

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 02:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65aa9bb80093a9c580d72626b88f5cf3_JaffaCakes118.html
Size

36KB
MD5

65aa9bb80093a9c580d72626b88f5cf3
SHA1

f7a25bd85129ab0660c6ab49422df00358408367
SHA256

b77c8eae39f9ce3cc6ee41103dde6ce6a3acac7b5931ef76b4cbca7ba198e6ee
SHA512

0bf4c42fee471ac46e75979923ee9134eb8eed1dbc5409493062ab68d30a84ebda6d0f26f15e6ca182d3bccce6a4240c381a0cd7d47313e1fde3f4ebd4aa3da8
SSDEEP

768:pzT5fndA5cIdjIfIaU/371Z1PhYBV4K5paD50p:VT5fndA5cIdjIAaUD1Z1PhYBV4K5paDI

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CAFF3CA1-17E1-11EF-9034-729E5AF85804} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422506268"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1316 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1316 iexplore.exe
1316 iexplore.exe
3060 IEXPLORE.EXE
3060 IEXPLORE.EXE
3060 IEXPLORE.EXE
3060 IEXPLORE.EXE

pid	process
1316	iexplore.exe

pid	process
1316	iexplore.exe
1316	iexplore.exe
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1316 wrote to memory of 3060	1316	iexplore.exe	IEXPLORE.EXE
PID 1316 wrote to memory of 3060	1316	iexplore.exe	IEXPLORE.EXE
PID 1316 wrote to memory of 3060	1316	iexplore.exe	IEXPLORE.EXE
PID 1316 wrote to memory of 3060	1316	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\65aa9bb80093a9c580d72626b88f5cf3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1316

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1316 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3060

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
2b547d03cd7298516e54cb7dcd1594d1

SHA1
7e5d6f201d553c7bda52c82af5a3d5db71d3c789

SHA256
c94b6277fcc74d794d7d795fa5b2e5befc51879f5b3ae23678ddd8963d67d6db

SHA512
03ed976909ce5b368e9e7386b0bc65aa04eeb9bf90698f39b6be499a25ab673dd445f803145ac82c9ef003bedbd1665487b3f58503a8889a4e9eb7b92f5bedbe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
220aa3eaad523868ca9868917571e07e

SHA1
82d2cde665f0b53e8139282aa324584f7159a3ca

SHA256
5c105de0ab4fb14d85478c101f5be8770b07237b9c24a87e1e615e6ae608d2c6

SHA512
24e5c9a8cb696c22577238794f25dd8d5acf30eeeb4cdc68d3ee7025ca6499523aa1bf97f589e4a6211cbe39fcf764badf77278b1af3bba6aedcda1e26c0c2bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
7afe4de9970c677c096526e45274b06c

SHA1
97413c59f214fee20c0d0224b568aa989ec20b59

SHA256
64d19e45552e25a29d8348caf26ea375d55c8de4eb7dcfa79d4255a9ecc49628

SHA512
21ac8e9f147615bcc13ab9d17b425a33c5a4a402a60c49769e98513be5c2fa2f6dd53c2e03602f740fa6232de4bf36671a5aced437d51a6e953a450ef6cef95e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
adf361423e812a77484de7553ba0b51b

SHA1
9209a9ce4c3c3c8e6f24142b7c8263355f58be58

SHA256
5d0ba669027269e02453a46198516c71b204856646b12e48df4256ae035f6178

SHA512
b0b28a22df2cdb02f9eada2f0afa709df8ab3f4039a9195271757d2236e9904771738ea1f9049404bf91891047ad6f5e5a2a87d06f77d41c4923cda846b6e1ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
832bf71a205261e6c056cf885460ba80

SHA1
ba7c7c05e1139e01a1838e53fbcbdc2149b82a2d

SHA256
5e772c84918732841ce726e41edff80941482028fca081efeebfffa69b97979c

SHA512
a7a77636f0dcccd9dd0f9d5dab847ecede5e19547ddefaed62a12a357cb91d1932d911eff626a2a9a10488ac1776ede18632d55b696f17b39bb369189e509fc8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
e53e11edcde52bed8206b37b93677fc6

SHA1
ac52ea61ba15a9aab99dbb070b6db180a2dd6eab

SHA256
b8e91392afa4e94f1a69e3a4be5abef26c6207ee58e793d79c32e52dc2e44b7b

SHA512
0216fa2327283e35eb8d86785f689502285fe05d729b232dd8686f7182eb9550ea125fd6f8d56a20f1dc1607e522100e729a1fecd01befbc3a0ee572f9047c86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
d8c5ef264d65f0678e93237a272300db

SHA1
c8e7e60bf15f1167467546c675eaae0745caa661

SHA256
f25a4b4486743a2775b584d951be7b71faa5ad9eadae779288a95e87f9015a37

SHA512
eb6cc42a127b4f40ab938fec8b2587b2a22eb0db34b8ef9c86485eea5198e9876e6c23ebef66b282d1a5213413a98e58a26b93dbc1360f204a2a854545bac1a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
7af40312ccc9d9383e3b7417257eeaed

SHA1
e3760f46657cae215f7d66f6309dee0355441eb5

SHA256
1ec25c502eff06886d3a81b8c3bdcc2abb84930e1190fbbaf4b96565dd048ce8

SHA512
a37fe543ddf30530641ca3c181871b5cb9246c1cdaf228379748bfe93098999d48b365322f1225710f7637bd08d9404f1a44c0ceb1250b6ee9b6d71e23a464ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
b9bc69521dd74ef4e5ab454e0df9f6eb

SHA1
1160596da4ef95ef0357949e35ff17151e9576cf

SHA256
c8eca3cbab9a4ce538bf29adc4e58995a0b12fc864060aaf755d4a8c23b25f02

SHA512
fa57166fb789cf7641644f7a8973a754b734f3e2d0208c7e4c703748017a5085a4b4102ee471fa83376724fa4247b367762db10281a0d539652f62e4ee34bd9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab12F6.tmp
Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar13C8.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit