00f994a8d06ac1a5704e32a17cebfffa255984694aa0b1156e1d72c9bfd8c90e

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 03:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65cae6c3a336a32566310d75590fa5c0_JaffaCakes118.html
Size

61KB
MD5

65cae6c3a336a32566310d75590fa5c0
SHA1

b20c81c934a75a6633c24912ab8a409354e4d8fc
SHA256

00f994a8d06ac1a5704e32a17cebfffa255984694aa0b1156e1d72c9bfd8c90e
SHA512

dd95cb8a3ab92deda2d3cb60dab1397413215eaf49527a68757c93411b9ecb83d4bc6bfe6208d297700250da2b3eae58dfe40261b879fd932527893ab7220a88
SSDEEP

1536:kTkKvPEjDUG2y5weuczYNQ3SryriG3HyTYTAQyrg1CvmxkLwrCRgaMrZu4i/:kvEjDUu3+inxkLwrCRpMrZu4S

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422508972"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1624E941-17E8-11EF-A1BA-6AD47596CE83} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2916 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2916 iexplore.exe
2916 iexplore.exe
2304 IEXPLORE.EXE
2304 IEXPLORE.EXE
2304 IEXPLORE.EXE
2304 IEXPLORE.EXE

pid	process
2916	iexplore.exe

pid	process
2916	iexplore.exe
2916	iexplore.exe
2304	IEXPLORE.EXE
2304	IEXPLORE.EXE
2304	IEXPLORE.EXE
2304	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2916 wrote to memory of 2304	2916	iexplore.exe	IEXPLORE.EXE
PID 2916 wrote to memory of 2304	2916	iexplore.exe	IEXPLORE.EXE
PID 2916 wrote to memory of 2304	2916	iexplore.exe	IEXPLORE.EXE
PID 2916 wrote to memory of 2304	2916	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\65cae6c3a336a32566310d75590fa5c0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2916

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2916 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2304

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
145806206b13981ed59473b2f4fd7652

SHA1
5e521d11ed071406153bc749f66faf6afe764df1

SHA256
be312352e2b72d13b9b5ebf87f60d7557119cf5fadf763ebf50ac88e90403798

SHA512
62a83b0c7eca3856bd97f3dbd54e5ee095b0c5921876e4c8c798f3d633ea5dd01a95695ad61d996a744fce156eec8ed1ae2b9a3ff5ead1d968ca180eab2e5dbb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
e423d66506d7f4f470af6218ddcf00ff

SHA1
deca84fcfd1d4dd9d5ed6fdc661e556a64d130cc

SHA256
8f65bc0243ba5df0b84c2f9dc71c32e384495391f4914a360282f81570d823bd

SHA512
26ca13cdb90767501193219c8f34f7586d77c4ab69ee5c34ec6d4210f8c0947d0929b0da5e8e2e3babea0d3b853116d1f6a1b449d07b4ee1ceca46249a847a2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
a5bff3958c48b25782cec253dcc184ba

SHA1
32e2148dfad2ff7fc27e1d5786ca1adfe35155fa

SHA256
f13914ad83d1170fa60263cdd58b2b9b8df9bfb3e075fe6cb9bfbe585ca11a41

SHA512
2260ccd573eee24de4d20657ef5ff7b8aee6ca714f63f3bc1e76b5691e30cb1f49314ee798c05464716f7f935f2bf3c27d5c5db607ebb564d3ffc893ec11c91a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
f25a4b7d6a54e186d8f0cdee369c9889

SHA1
ebfa10f98d55f98f55bbaab2c7132a83962e2cb5

SHA256
9ba9758bbf87d9b2935daf4cb611fde5693c97e64a64619400d989de6d565f65

SHA512
37812acb4289749fb7f65deb9bcc7b717fb526baa146a9b68e8ac7e792be6875bcb51e62947a1e1c547ec64a465dad351493ba3c93025e8218cb71d2d0da0da1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
f87f9575ef8b974d63e9eccef3e567a3

SHA1
f9ab26ecd1ff9795ff6fc4c5435e5c1735b41f2a

SHA256
280cabc7a8a3c2837992de7c18f0954b71f14a64f424536b26df58706e74b30e

SHA512
99c805eca5096e0ab0a0d030c29442286bf2a99861252e1fe4bb20ed994adc3f6a71608da4979119eb95d8a9582edf762c838103e3cfaf8af5d5511d55d9dad2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
b9465ad1cd6f0b98bf7511e24ae45249

SHA1
15d439cc85a8b902a6ac7c800094f30b8892e782

SHA256
4b9649dbf2ed64da20fd535f4281d50dc564223dcdd8798ed64faf5c48f4f94f

SHA512
bc76211d3b64bdbcc72dad145a1c7967b25fc3addd65824727bbb0d2de838f195e95fe3327e47e3e8d48b6b9d05d58f74151748a6ea3807db483c47f448adc6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
b6839c51ae28cb77df8146d0b252065f

SHA1
169784f1057e6370834bcddc6562ff6b828e6aa3

SHA256
7e4f271f4b35796604f4e2dc503a473f1a943035e962f05fd91b2c02cc9dd95a

SHA512
c662a348a4776b4f5e491c9ad4519d0e4da8127c1119f5fd7d9a5e41220b65511afdb15b974f94402426fdf3871eb757a05234d4d54cd0a0490b93ecef650407

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
fedaf5cbf5266190eaa4eb13d161808c

SHA1
59ce8c557cd8ae5a529306eb87a9b353674d20ab

SHA256
3c1c07c0c1c62430a33f87b531ba6629ec96dc7d6ab4d00c4289737184924932

SHA512
eca446d577761fc917c21fda79988de3aca5f74f90290702533d94b66b3bc272cc7c68c6326011c7f7e13def33861d4ae4ddbce629985837be11485f73214442

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
65d9cb64b7a34817c53a96c359f99022

SHA1
52a95e28eb74d91ef697cdc22b06f1488af83bfa

SHA256
5b22a46b89e958a996f8e2bae2e64b329ee9c2ebd5fc236c21dc8d17ba0a531a

SHA512
70f2256f6d569e22c2bc11b93e7273e9a94437eed3c621cf7ffac1bdad06cc4fc700ea73b19961702e6cdd49db672611c13401b88eb6d9593740494d6bc9150d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2C50.tmp
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2CB1.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit