ba1888c4710924fade45632ebcd89d44534386be86698b021a1b95062338cf20

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 02:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65c20e05499a63553b9350bc75f05fc6_JaffaCakes118.html
Size

30KB
MD5

65c20e05499a63553b9350bc75f05fc6
SHA1

12033e293c49307dd20666dbb5f9f9b1d385a984
SHA256

ba1888c4710924fade45632ebcd89d44534386be86698b021a1b95062338cf20
SHA512

cd944469920cf1ed82d954908d624fb9e944fb4cc3d97e07eda810a4a2bf7fab82c18536cc0d906748f0f3d8a8cd9d94bd3094756eff4fd26b1466bcc288171f
SSDEEP

768:S3tq9J69n9OFKZpsIL30dqsaMqlM/dmOPk:S300nO2psIL1saMR/dmGk

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{57AA8A71-17E6-11EF-BE0C-E2E647A5CFB6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422508223"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2924 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2924 iexplore.exe
2924 iexplore.exe
2956 IEXPLORE.EXE
2956 IEXPLORE.EXE
2956 IEXPLORE.EXE
2956 IEXPLORE.EXE

pid	process
2924	iexplore.exe

pid	process
2924	iexplore.exe
2924	iexplore.exe
2956	IEXPLORE.EXE
2956	IEXPLORE.EXE
2956	IEXPLORE.EXE
2956	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2924 wrote to memory of 2956	2924	iexplore.exe	IEXPLORE.EXE
PID 2924 wrote to memory of 2956	2924	iexplore.exe	IEXPLORE.EXE
PID 2924 wrote to memory of 2956	2924	iexplore.exe	IEXPLORE.EXE
PID 2924 wrote to memory of 2956	2924	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\65c20e05499a63553b9350bc75f05fc6_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2924

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2924 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2956

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
b63dcd8317b988ce545e4bb4dfcdbecb

SHA1
cd78ace9621692c4ac2e9ba71b267297c3cb9648

SHA256
d6288083259f6b3e9891aee0814ccfc7f5dd474e95f47f615b07884a5531d0a2

SHA512
1b4f5493229f6692bfcb50a87bbebe7176bacf60776cee5e24147582ba556a8fa6480dbc27ac1a9132170e21c6aeb1ac7ad532addda0d25baec7815c7a116512

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
1c5deac1cf5f7b8415d48ec22a2e0b05

SHA1
c7bd092435651eb40489f8b574f41db8e8c43b75

SHA256
581f3ececdbf638263c1f13b713cd73aee1d60c4621eb8bcdf8e3826f13d6dbd

SHA512
f3a8d5ba9726262b529cb917170177807f186b33db5e23a18776913d4204d783f281473ba6cf70c5ab43fc4b9a859b6364503181b3021dc05667b83865439706

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
6cc6108a97e7025e475346ef1d4dfe92

SHA1
d9852d1dfabe10d69071aa3bad07830ce7c9d7c6

SHA256
c22fbee5874eb81654905304e859138244622524493214b94ab9bd2e20a313d8

SHA512
b449f9cf4f10844f29946f3dab417373792300ac34f72c894324b06d214c814c995a54e3cb89bc1f27ac0fdaac0797bc12f655f978873df736f4a7b47da4d3cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
b6580176d5e51bd380dffa71234c6e77

SHA1
3dc743da4a1aabf25a34ea3f290674389e0f8311

SHA256
8a6cd86ec8dad2487a04a93baa8c132c40aa24aca9be1c1d312f3c110e2264ab

SHA512
2b75ff578375b790740a598b4b7b591e1eb4dc0c3245976c81770236be875fa0684234fa4b98c996b0993e38e47ec2d8a6b6d8dd27cdbc5798fab67851696f08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
a844e84f9a0a06905daf75725ad85502

SHA1
72c9c243d917036f3c4e57d4662c7d6b2f3e9320

SHA256
8955933a98b3c947c0ea642b91e351a8c7b8259481fe1d1116ef1e4bd8234073

SHA512
90730154fbfcfd08668cf342dc4b0cd904012cc551165e9d3e61708d7abb833e309f46d5549c24d46c17fd5f88dfd56fde4759665e918b06003476a98fcd2c50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
bf3dc53ee7f6e847c6b0f42202a439e3

SHA1
85e7edf0bca90fc5102999adcbdddc6af364ad75

SHA256
6e218d742b1592630e49d1deee2181a9f5eddcaed8b18b22c3d8faedee7f320c

SHA512
162d9a3468dcd95ae89f36e899084e0fc847937f4e9fce6aa3c336c95dff6c679477920a90b257462224f0b3ecdbce96a938be8fec37896d7cb62f29fbe4dee0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
31942ddf4866a5c87b1a7fe848d86952

SHA1
2a0dfd80c7fc060513a1cd2dd340610a33ed6675

SHA256
5cb75cc7dea954c379d5a83ef0b1f0e4fbb2d5ed3a9b57920d8368d501c0d93d

SHA512
6a5ab2b2d2b1095fd13d2d3c09bb38ee46ab2a4543fdfa11484c8f20a28ca7924e84fbfc200d797b023e5b0dec0949915e9f53f9d17331c7936f3ac7950a9765

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
95f77de7884a4a5e8b56a2331aee995f

SHA1
337668457df30ffb5f5e840b360c2ea0e03a903d

SHA256
5006bf9d9fd088094b785cd3d738e0411636881f24f9a0f0ed0c9db05b44cb3c

SHA512
21d8e06887f64f81e986c4f1d678be833a1546b7ff121fabab7f62f5df8b1c66aed17cddb4a58512d3df024b5274a815b055fb5e4c3c2d59e3c16748d6b7e55a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5AC.tmp
Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6AE.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit