2c47b64424a89f159d82a4eaede8c7c548ac2408885d11a2fae949968be0a52f

Analysis

max time kernel
150s
max time network
142s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 03:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65dc242245cfce3b24aca8b1fdaa26d3_JaffaCakes118.html
Size

19KB
MD5

65dc242245cfce3b24aca8b1fdaa26d3
SHA1

eedf3e4ad4768037ddbc8894ec6dfbefa2214268
SHA256

2c47b64424a89f159d82a4eaede8c7c548ac2408885d11a2fae949968be0a52f
SHA512

c31739f514017384035a75556946eaa69d5120b379901d290ff309a49960f9a53d6b30ae45f8f0fc24a63d2508b2d4a7c81b0d7e6e988492cd41826c96dd1533
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIR4nzUnjBhpT82qDB8:SIMd0I5nvHZsvpIxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BDC2CB61-17EB-11EF-9C59-EAAAC4CFEF2E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422510543"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1136 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1136 iexplore.exe
1136 iexplore.exe
2308 IEXPLORE.EXE
2308 IEXPLORE.EXE
2308 IEXPLORE.EXE
2308 IEXPLORE.EXE

pid	process
1136	iexplore.exe

pid	process
1136	iexplore.exe
1136	iexplore.exe
2308	IEXPLORE.EXE
2308	IEXPLORE.EXE
2308	IEXPLORE.EXE
2308	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1136 wrote to memory of 2308	1136	iexplore.exe	IEXPLORE.EXE
PID 1136 wrote to memory of 2308	1136	iexplore.exe	IEXPLORE.EXE
PID 1136 wrote to memory of 2308	1136	iexplore.exe	IEXPLORE.EXE
PID 1136 wrote to memory of 2308	1136	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\65dc242245cfce3b24aca8b1fdaa26d3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1136

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1136 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
46902402e9c12792021279599b2bc51b

SHA1
4a0b30f3fe9e4e4974a7e3ad2678149b5c0da361

SHA256
f8b78f111ba1989abd2cb0112be5fa29ab3ceaef4697134ab877dcf9c9a8b2dc

SHA512
c2f907cd23d82a048eed315aa15891be920d88706f272aa942ac538322846ff0b977ed1d3d56fc169bf42997d9681c48759a66366840965910ec21aa1049d186

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
d11805d17df827900ab316c6e5288c8c

SHA1
5ae2fda1eea56fdde06e98ccd8f2d5533e948b28

SHA256
454328cbdae3026cde47a3f3c28efde9f4cf87844abacd4d1a85b5089f1c2057

SHA512
819379231773789cea77c6495563feb172c2523606016d1e2c624bf3d26730697ca25dc728fde4b987f502e303dbe972775581cca0f233f13dc76a9c0cd01cc0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
a46d18a74b69d06fa67782f37861a846

SHA1
5e5e3c6b22c28e943a593d9621ccaa8b06fe329d

SHA256
e84e33666d917b929c6041362e04a4d562bf7846bc1d5c3d121183d5055bd006

SHA512
3e3c5d132b1be6e22ccc3d92c7e6fa5bb1377ce08f1e87fa06dbbc4cb4c0426a137e6e8887cb0e788ea238df5b27e20503a222d0026ee9c25a51f95eff66b8eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
9da0d476b24a1e8f7fdb5dbb014b4189

SHA1
803b0ce736275009d473b4610b10620784cdf6a6

SHA256
27d0afb29bdf14e4d81fa2b391ded34205f47492c64d5a26a7eef8403abdbbbb

SHA512
ce7f39a06112cc4ec188691e71907ddf2434741a08d1da138842b9eda0950d7015f4a90973e090b8b93842b9988eb1dc65ab7ed37d765fba7298a1136b094b48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
f887e4b2632a754841c8076507e6e123

SHA1
ea16cbe7bc0e9ce2e570342a4be04b18659a572c

SHA256
c9d5e315a61c03af928dd1dc34e0d5b06766851cca5f77042b42218ae052dcc5

SHA512
e449787d11b4dea38c26527323b2e7bed5bfb3cedb4a8db7fd648e5a727bac82b8e2c87114eea9d9fdd9f17482a8cd2212392704d3b891f4d6a75b46b1cae6be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
009f17c98f6636c457bb5c9d086b3370

SHA1
bd1be780080efc00c2e0ffdfbf341adee7683f9c

SHA256
64990e8228b3d44b879a347a739b50d75f8ee16b5a813184340a97d017e2ecd5

SHA512
43d7c79220ef642f5e69ab6b6be715ef4cb155805b159eab6a2afda14a3e867e1731f58627469ed682348e179d40cc77a5b4182b063fb7949c41fc667dd0056d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
2a460fbf2ef922f77e4f3c8213c8960c

SHA1
c4a34ef00d8081a866b3bfb34907cdedb23eed55

SHA256
ace0b0757903f6e8f3fad1b4829f4a0a42a88654c4ce0572862e55beefb7d925

SHA512
cc9a7c897ba4b06d8406a79eba085f4c1b33611917e45d6f2d0b79559d3e0beb27fb25a4dc8e1f213ef48f8c387878e24465535490a90b22002f28390ed0e391

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
da7c302ed2d91e7bbc695980487e2f4a

SHA1
cd916a61a48d68309cbbc70b0c3496e45f563933

SHA256
2344761c34d94930c94b7f290de087213a010cf2ecb18fd70ba8569d92866eba

SHA512
ecec21c841574205c96ebaa73be71179a46cd86fbb65a9d235fc0c0d050365830a71b27a232e10a9df41cd2652c4e3ef1eb3d75d07087eae77f7d03afedda597

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
f7ccfe561af56107220f82f7b6176274

SHA1
0fd8ff65fcc713b444c10bb8b7f4715df93e4b00

SHA256
9c467914220863a75984e89302bf8695d9a6f37d312b81ece03f072f1598a212

SHA512
3a019ae62daa42da09b0fa75e55d1a3f38db4dd2ab2e8a643129f79a99d61113411acb8affc3aaf9fc27d212273c0862d143975c595a5a6b7b48d2686de88a4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
27cd15e474b3495ebd58a41490bbe898

SHA1
f46f8e22792fd8d2ed9fdd52019624c07670a141

SHA256
341ca0e9d96b81592c79cf6d80f215072825d262c3733a018513d2c0bed9326e

SHA512
eebaf80099ae9068a7772308b44fad87f1ca0b8916dbc4683d31449a2bedec4bdbb7072f988a9d1a7f6c87f1f7eb2dc0304b524de8d5f1889fa9781ad25c4303

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9001.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab90BF.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9102.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit