f4f47a35a9957d9cffef9624e9a868954510f460d0b39aa70e528a679bda4e8a

Analysis

max time kernel
150s
max time network
142s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 03:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65db5b57027921d40a8a73bf94eba176_JaffaCakes118.html
Size

18KB
MD5

65db5b57027921d40a8a73bf94eba176
SHA1

4b554820f74ad948342d2759ab2a519e38c8ed9e
SHA256

f4f47a35a9957d9cffef9624e9a868954510f460d0b39aa70e528a679bda4e8a
SHA512

216e267b8a44e228e104c145c43d20f75a0a18dff25db17610c22c622d6b4c5281046bf82d24e781466d098668a57e51ad66518c53b5f49a9c062bfd4efff20b
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIB4xzUnjBhfx82qDB8:SIMd0I5nvHhsvf6xDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422510453"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{882E0F01-17EB-11EF-8C47-FA8378BF1C4A} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1932 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1932 iexplore.exe
1932 iexplore.exe
1312 IEXPLORE.EXE
1312 IEXPLORE.EXE
1312 IEXPLORE.EXE
1312 IEXPLORE.EXE

pid	process
1932	iexplore.exe

pid	process
1932	iexplore.exe
1932	iexplore.exe
1312	IEXPLORE.EXE
1312	IEXPLORE.EXE
1312	IEXPLORE.EXE
1312	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1932 wrote to memory of 1312	1932	iexplore.exe	IEXPLORE.EXE
PID 1932 wrote to memory of 1312	1932	iexplore.exe	IEXPLORE.EXE
PID 1932 wrote to memory of 1312	1932	iexplore.exe	IEXPLORE.EXE
PID 1932 wrote to memory of 1312	1932	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\65db5b57027921d40a8a73bf94eba176_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1932

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1932 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0feee834054257f4abbca1dc329b9ca8

SHA1
8f35fa1b3d6afe252c457820e890562fce7a41c0

SHA256
91d09ba055ded9adda6174e358067dd56a95e45a05494632fa92b06f82b18ad5

SHA512
38b4302c11c3fa47c737d1dcff0c04d1432052d41b26db5eebb534d75adcef7e21a08fcf0521047071a80a42ef1da8a6daa2182235ddd74c398862630325ae44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20444f31a13859ff81ba94354579174d

SHA1
6728b89a9de17a2fe00392c7d7e7125649320f53

SHA256
8957e342d623d3a3d9530da8b007493daef334b7f566fe6a67cd629bc840d36b

SHA512
9ca0221d8bf3890742edccc2a23d0288053c12b025e697ee2aed91b923290f9efe4ff87ffe8af8a9cf7b2deae518521f3364324ae951be2c9b5161ff7987647d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
11c9b2ed3e19b5b30587ae26462244b0

SHA1
2684324beaf980be0ebce5cdaceb6e9ec02dc161

SHA256
9140c2484f07b49d471af4079d7d44fbe818a3af126d260b9134884f12af1a97

SHA512
9cb8170c019b841f72ddd5a2008811e5d178c6aee7ba5cafa7eb217ab4a3bdd866b20870c23e9a26581fd09fe4406f0d485bdf15863e9bebe8bf16df59ba040f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d3540340653780b71124e1231faf40ec

SHA1
1bc4e89868365889190f6951c094aa05a3c0c5fa

SHA256
6c8ede6b1b998214c0ab7bac645787f332d7455c090f97a6cb58331fcfc492f9

SHA512
fb52b718d490805e89dfb86a2aac3c20b2d62a150c8a305bb8a64c04eea1ba8880f86eea1ed0e7fe73c96c1050eec4069f477aadcc464784be4b0fbc00411309

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7022feeb62c26c3d976630779fd54e9c

SHA1
f098f919f32b83d3db468a59fcffafee5b297109

SHA256
ae36782afa04818ddbb87d2ea6031aa46ccf1518ce509c248cd0b98e3b176d19

SHA512
f815e72722a555baa0798245152d28c299e388817cf0d3058a942a9aa6c2d28225da7e87b53f11c2844196cd5f1b95bd7b158a3c06d4704d88c36440f7f20783

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff3884299306d173336da8f142049e5d

SHA1
101888be8217d2e9701814be652ef380762dbf41

SHA256
40aeb39da6082a737629dd791e5c0a48df3828b144c09d1af9932e4851cf21f2

SHA512
556f7fd1df4c872836291f3e9841a0a0da47c25a0fceb2af2faa04e47b5c37b7ea50dee9fbab540a38696c4309775c55de7f0d7971106dd9150a7fe30575160a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a20d88cc246dcfd9f5b51bc43c4ef19

SHA1
b453cd7f26cdc9b8c478bc8e5625a97e62e53efb

SHA256
5ac93f364dd59d222edd7e3c9cf404f5ee20579aa9ea13dafaa385326e375c7d

SHA512
31e030b38c5e804bb129ecb9954ca1dd85aa44bbe8b4d662d9f2eefe155435319bfde03469d4cd4172eeeda51cf33a264dbb41611feb7319c872ca77e8b82d54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
057ad9f20363082b1fba2e3abee6088c

SHA1
b7be54fc8b13ff7428884067675359ca00d90945

SHA256
2a40f44f23379f7c4675af2fd403a2e29558c15dc06e9217147b61f4dc3d092d

SHA512
572390c085faea09a3be8a40386f6800dd76b0ea0c0a01b5eba8867a397e921bdeb67784c048311564c9fb5c6376ec75ed1d5cc2a07d1d6699c73d86a0119c69

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8C89.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8DE7.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit