b2ff62197adbdccd3c62cd7b8be3510d1b6f9a603324c4323597cd3542ec23a7

Analysis

max time kernel
137s
max time network
140s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 02:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65c03a678c832b533863fd360d34175a_JaffaCakes118.html
Size

12KB
MD5

65c03a678c832b533863fd360d34175a
SHA1

8e113666badbb31d0d2ea01e38467ca72de3a85f
SHA256

b2ff62197adbdccd3c62cd7b8be3510d1b6f9a603324c4323597cd3542ec23a7
SHA512

ce890da58a16eea8b5c7ebd1c911db8241a1496171bd236c653407841d7c8aae5adb2c4ca8e721c42a8f0b0e465fe2f06e40335fb40310012220a051bb2d8817
SSDEEP

192:W/zXLYAyr54x3uBMCT77FAgwkcHlp1gsh2Fsh2J0zMz:WLLAr54QBMU1AgwkcHn12Fsh2J0zk

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000005dabd85379f131491a8e0b50684bb8a61ee13ec33b9378fe5c5f99a846641eca000000000e8000000002000020000000ec3587b3ed442ba7cfc371979fa3bfbde447295ebec3392cc0628a29a2e9c278200000005b234491e7085acf32e7314003c639b8d939c3bd15bd9a4fdeeac8db340ce6a74000000064ecc5736dbbf8dd1076234fb3b471ffb0110f13a2dfee2706b1f81f93d21a940e109b88c454041b3c786b53ffd398162909b05748542fa796d84dc31ad47e44	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000004f3ddace2f0f2bf9f6e2c71115a5344e962501c99f5fe28bb75f21e9d2c5f65b000000000e80000000020000200000009d7aaf78ab396906010aff5f0321904b78bb24f3f52687a80da475de42320aa99000000044b31009b9046d9fbbad1be0e35015799cb8b8810f26d6918e68152ad357caf4ec4fe5259fd15598eb0491ccb073cd3645248fe27d5327fae7cf40a7c88c9292123bb75e84b04d263c6a99b11914402ec247723ef4d632af2f1fe5cc3bf7230a08db8216bb2adda4ed0abce282040357f99e7198f70057686bcc002b0e89b78b98e171576426b0108816053ba25ada104000000045d3388b0323ca308fcda6c029c599f7f158daec7fd546b50f57dc5e7628146167a6ad9c586dd0750e0d3a8601aae609aa0852636db94cc109310a385ddffd8f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6065caa9f2abda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D527FCE1-17E5-11EF-AD96-EAF6CDD7B231} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422508003"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1280 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1280 iexplore.exe
1280 iexplore.exe
3044 IEXPLORE.EXE
3044 IEXPLORE.EXE
3044 IEXPLORE.EXE
3044 IEXPLORE.EXE

pid	process
1280	iexplore.exe

pid	process
1280	iexplore.exe
1280	iexplore.exe
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1280 wrote to memory of 3044	1280	iexplore.exe	IEXPLORE.EXE
PID 1280 wrote to memory of 3044	1280	iexplore.exe	IEXPLORE.EXE
PID 1280 wrote to memory of 3044	1280	iexplore.exe	IEXPLORE.EXE
PID 1280 wrote to memory of 3044	1280	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\65c03a678c832b533863fd360d34175a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1280

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1280 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3044

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
621da8bfda46becc0db65248da6353bb

SHA1
8605baae7a8b72739b38163c1ce35f3f78aab780

SHA256
3932f6f8075b938749f73414df4df51a0721d53b7e91a5e3863deafd5c74d6d5

SHA512
6cb101e3b14b309a34dc906ae648b4c93ced41b330f39b320e41bcf64bc486dbceb7790df30cc69a0ae967932d27d15175e95b769bab34dcd97f06bb148794ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
fb0cd134383cec490a670cfdd1747e3f

SHA1
49fd00d9b781eb5fffdb327ff1201109f0b9410f

SHA256
0630581ff06974e937c579a9b984b98101cbf2ea08d5d9f85f0092aa066f524d

SHA512
b0e22a69b5b3859e793621e1e04335adde868e20c735dc1b4b65ad7d592aafd67f2abf06a0e769ea493f8af3636e2354f43f23734c9bdf123c447c8143bac2c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
128bd48ad4357cdd5c7171ca99311fcc

SHA1
c368b2c312cdddc2f55fca79c40cd7b5bd90d8f3

SHA256
e0d338dd0763b05b74918419ff4da5fc1a92ebbf9c118b4e674f071e35bcb128

SHA512
a32beb66969c2eb9d10e94f14488ec09ff08fcac81b7c955c5c035bc9b95bf5e7f8a6b84c893488098b41023c61ab29dfe4397411fe3643dc89d0d4c8e8d4fe9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
5976dc8c042dd549576e37100e3452f2

SHA1
993318e43aa648dafca24e5123b6890f63f0d384

SHA256
3cd80232d9f0aace4cb64ea5d8d0db8e1c65df87799597c2a7a7153922be1601

SHA512
6802dbfb4af0cf9e764795d610cd531ddfeea6e238ae54e251053849154b6f4a028a16251cfa13860ec06ebfd2e29f3cc648ae53662cb684f85f9de6028a582d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
b92fce5c2fe4de96740ccf0fb67a31a7

SHA1
4f7000c618a65a2aa413718d11d093296c80d410

SHA256
c5f5b8723357d0994a061a8db19b1764252494b793d5d535d1ea306ff6c99303

SHA512
904c882dce3027897381cf5060362d40690675bbb2e1c539a9405be50283addca518d741db724f3f903d175f0411d99c639b6bbcca97f75d01f711ec27aef126

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
e0f05a4d3dde06fabc0d40c5898aa270

SHA1
8246b273e491a5bf2ceda772ab8996f646ad543d

SHA256
4241814d7f052159c42c9cc01e8e8bc8add08a649be3ab5fbcc8b0088b6290a6

SHA512
6d2864ecbcb9a4c8ecf46b8ddfbf36e1d7acbf995c39ec7d024f9fcb319b0ce9b65deb052715dc7aa782bb6a646e367c63506d9a8ab626a189f5f87c2ef3b6ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
97bb26136d6898b86d6175f2029dad74

SHA1
fe5d9d3efe3e3b6bd7478fc73c21dc00722c36ce

SHA256
fb0c75c5438e47371fddf3cb5d40380ae0f32a12be73766fd83ce4809912db9a

SHA512
5b1169e37244deb938815fa36b47672977ecfaf30d4d4781520c709a6824231ecbc360f8aa0daa683b914914e57cd1cce15bf0a904b9e18bf68cd6961463e857

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
d69a74135998f7f2b05043254d5ee425

SHA1
565c8f282283525a72cb8328adbba6b39cb61278

SHA256
db8c324953620d8c32791e7a4085cb8b93ea817240385a212fdfc86cbb27360a

SHA512
ba53bc380c0db5381d0e95993d4935ece45937f26263b426c0a4c65c49a31d0130d9430e1bdb65a91c47f8f4b2b81403f471e19b82a0d738cc83c7b1365bc7ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
a1405c126a3f70d357dc137704ac7423

SHA1
40c5168528c9952b69336e0f689fe416c504e9e5

SHA256
c07f125846f6d77657f2ad52724826042ad8194e88ece7e2b5f86666e2225d94

SHA512
d30ad8fb61cfdd882dd5a44c6f4a62466cd9e4e67656ecf7751d305ba91d39d001759a4ebca25ecadf87f79d5bc472c675da5ac16ab6b9638328cfc9154bf8f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
303c3e274aa8527a33530200196877da

SHA1
7a1acfdea567ac160835c10cb55ffce10bd6d334

SHA256
d042eda54c1c4aba9038a6ddf9224f632f06b9a48ec5d3f977f4e3b946a64e8b

SHA512
cf11ee5ef6cadf627aa83e824f1e65d99a9bf4d5d8f8be3c40edaf02743edaa0941662a059faef56238c5f47952e04e3cf7e5d9813624d5ddaa4294d8fc4d99f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
15bfc828d106dcb682e57d36dc092c6c

SHA1
0dd8faa741b665ecc4c84a6cb471b4f1ff8a529a

SHA256
01e23678b36a4559e4c8fcb6af46b98faa87cacb9205cac6df57fbb576de2373

SHA512
6124465bb91dca3bb6ff625058699ddfdba0e1f295de4b403ddc311ed1326592a45b48383e92999df8379953edea5103eb831a82234c1782491cbccfc27770c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
9f5d0beffb5b2840a54f5f872cff7720

SHA1
5dd728bb7635376e9d192c08a5a89bce93db02a7

SHA256
d182095c3294e4124d07ab927e28464427ca0c2e136192f0aace67dba3214b9c

SHA512
d86ed427ec81b347ca26d7ee855d0594f7af071fa9a68873616b5d78f97ee0bacab5666afc1711b359a64a30980efb0ab56be60d5e5be01a2eaa56b3aa1fece3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3594.tmp
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3604.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit