5c3b391d7867e51a30f3f7b6d6048de8dde3f07a2c5dd467e4db0810689f01b4

Analysis

max time kernel
147s
max time network
146s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 03:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65e27f76ac82e6a9cd22230b8a669904_JaffaCakes118.html
Size

142KB
MD5

65e27f76ac82e6a9cd22230b8a669904
SHA1

fef6306928182e1c043f70555a570959e3bd1a04
SHA256

5c3b391d7867e51a30f3f7b6d6048de8dde3f07a2c5dd467e4db0810689f01b4
SHA512

f8c1c542d3582a88194e9b8b8653dedb8db1a71ce7647bce1f6f6037d57aaf717a539f27e5dda3edc19f1dccba439d3f009e6a51165731e4513dae104859e6e8
SSDEEP

1536:STT97W/U/x76vuyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrk:Sc/Sx7dyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422511169"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{343F5321-17ED-11EF-A7A3-7A58A1FDD547} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2548 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2548 iexplore.exe
2548 iexplore.exe
2412 IEXPLORE.EXE
2412 IEXPLORE.EXE
2412 IEXPLORE.EXE
2412 IEXPLORE.EXE

pid	process
2548	iexplore.exe

pid	process
2548	iexplore.exe
2548	iexplore.exe
2412	IEXPLORE.EXE
2412	IEXPLORE.EXE
2412	IEXPLORE.EXE
2412	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2548 wrote to memory of 2412	2548	iexplore.exe	IEXPLORE.EXE
PID 2548 wrote to memory of 2412	2548	iexplore.exe	IEXPLORE.EXE
PID 2548 wrote to memory of 2412	2548	iexplore.exe	IEXPLORE.EXE
PID 2548 wrote to memory of 2412	2548	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\65e27f76ac82e6a9cd22230b8a669904_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2548

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2548 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff5fac7870e42d923a6fcb6b303cfecd

SHA1
6368a82e5bbe1292e959e850b418a6a8282b6879

SHA256
cc3bc671678b620bf864f645f3b91fe2db119943c1d21040761b6936a58b6a7a

SHA512
f9d9982ed96154eb278896a6cace523318bc0635d4d1ccc2c20ff327667a850b76cc398e8b78011cd7d05fb62ca961d836f70d9e0322e041bec9fcb6018ed62f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
89cbb38392380b47b5f2f5407a084b0f

SHA1
599c305ca448b05cb287c06f3107e94a59fd077d

SHA256
2750918dcb48bf3e7eabc094b8cd12db37ee783a9461287c006267dcefc0d3b3

SHA512
a3c0404fc6948b7652c96f6cb70f11093381aadb5db1f474033153fc203561b0a4abf0d5a28df602ed18119cf6aaf356318dd99b805503b20ed123578f40144b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
178f688d10a95e11aed322d5c04f7d06

SHA1
b15803f2bfa179cfda4d61b568c9acb0c0cff52c

SHA256
0170c440fe01597e6f507fa997b529a821bc6dba6cd882cf909fc21b9bef73cc

SHA512
00938e347839a03dcc14ce44d67e83dc592de5a1da26cd45d04c428da400d2b7d07243a603df31faaca9fe63a85d6e57fbe39c773f14488c7409386bd7f52925

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44f28027a7c321901ef5ba111ff40d24

SHA1
3acf9a1d45f2f45df02bec1298805ff4f8436809

SHA256
7f3f718b28fb3eb709d182642b4ebffd6935c6666b9bb5e7e92f89cfd8ed1246

SHA512
6895a9ef7fc8ba7a04aa242e1c95df70ce4b56c718a67cc4a89437f5f5329f9b8a4e52dcc76e9fe1116961a4a5b9c9a2ed230e61e5e9111c413985e905a4c54b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8cd1ce7a9f1dbb250400fa1d1b2dfcd6

SHA1
e72bf59dfde8cc027cb1da2a62d0561c62ac51ec

SHA256
aca4ad47fa11ee9e38983c163ee8b3c18854591f005e8c3ebf80fb0a8d43230f

SHA512
2eac8508ce01facb4640e73ecfaf448e0435c06d6f5119e87a196b288a55d6e111e9a2f1ab56ddd08c382177e064ee8eac9304c77135282420e5ea065e5d4475

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b1ce9d094d61e1a10a29dc58f448a831

SHA1
75939fed7bec86ef0438c00e45793b8e8e680411

SHA256
79b34815f6a3573fe4c50f2ba536525d546c60335c9e664359b0eb35545b3743

SHA512
80989c4b92c55cb3a037b69383f809be1e8a3dca5bf591d0908f0fe01e5968b9c080bab9154d1ec0387ea0c155a1d9cb789a7fd6052c6072e05a92be1baa5f52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b82737cc9798321e90a1403e8ab7267

SHA1
c4befdc9f9e75eb426eea737c062361a78718911

SHA256
75c97e549357cc807cede5e0434bfaca3515281d45cb09aaba7af234ab1a4376

SHA512
c92ddbfb013553545850a6fdb6b9cffbd3e909d70ef2a61e3e8366a5eed12527342ad380e61a9014abbbdd4d7bb0dabf5e8e37e21bf6657b1fc93cf8147acdc2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b9137f765d21e4c068b3b60f0b010ad

SHA1
1ca3e3e06e9f534daef9b54c46723fe82660bc33

SHA256
209e28a34baddc840d3f2ae7da5337ec76541d4f060c6c6937901a7b7455ec40

SHA512
bdd379819f7d68f99cc05606eb6a101f4c1f8e2e9848cdb2b108cf30de01f95ead137b03ef983da9f2095af02adb190268d0876a1f1c460b41ab15b282e125c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1754d72f68b043a0a768a4ca0b1e7d08

SHA1
4d03ae688228b116f42fdfdb50d429d4b71dc625

SHA256
8bb62441e238a18b7d80aa55d9e2c9b9c7b236bf57de22d63b2c52b854e02d18

SHA512
7e64a0641933ef7bda5f686b3ea13de99f8fd040a591716d85793fd2372465e2bae6db8672676859d2a9003c862185fd12bfd93579d485e59d73cfedc6c9eb32

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCBE.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD20.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit