7b60ce22160783e266d9c73bee971aefd42e7a8b78d7c6ad50acd031382ffbb1

Analysis

max time kernel
139s
max time network
140s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 03:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65d010e64c228f4bbcfbf5781aa2da8e_JaffaCakes118.html
Size

19KB
MD5

65d010e64c228f4bbcfbf5781aa2da8e
SHA1

cd1cb7945b2600791fa7bff1ddb3a210997d5747
SHA256

7b60ce22160783e266d9c73bee971aefd42e7a8b78d7c6ad50acd031382ffbb1
SHA512

b4ddb3ae078f2168755a3a78cc437492d63b3f075fa5cfd7b96e7c8ed72420fbced529d5608d9a3a9a45ca01a61aca6224b9a0c13523661276cd9a8098b25ff5
SSDEEP

384:SIisDbvOWOHvejhkpnESxG9Bw1I1qrrwIYKIKUsO3U2TnzrwUzkPfeIPXe7wbgri:S8DrOAowIYK1xzY/lA

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 42 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DOMStorage\xlimama.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "13"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DOMStorage\55told.xlimama.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DOMStorage\xlimama.com\Total = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DOMStorage\xlimama.com\Total = "13"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DOMStorage\xlimama.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{18353E01-17E9-11EF-B459-56A82BE80DF6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DOMStorage\55told.xlimama.com\ = "13"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DOMStorage\55told.xlimama.com\ = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422509405"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2860 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2860 iexplore.exe
2860 iexplore.exe
2332 IEXPLORE.EXE
2332 IEXPLORE.EXE
2332 IEXPLORE.EXE
2332 IEXPLORE.EXE

pid	process
2860	iexplore.exe

pid	process
2860	iexplore.exe
2860	iexplore.exe
2332	IEXPLORE.EXE
2332	IEXPLORE.EXE
2332	IEXPLORE.EXE
2332	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2860 wrote to memory of 2332	2860	iexplore.exe	IEXPLORE.EXE
PID 2860 wrote to memory of 2332	2860	iexplore.exe	IEXPLORE.EXE
PID 2860 wrote to memory of 2332	2860	iexplore.exe	IEXPLORE.EXE
PID 2860 wrote to memory of 2332	2860	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\65d010e64c228f4bbcfbf5781aa2da8e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2860

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2860 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
ad676a61b7a7eb6ad242d4f5a18b5bd6

SHA1
77c654459985c8906eae8362933ea60e1ce0d887

SHA256
f133a7b0ab14e09a8226f1510d0b8bce1eabcfda185685a63c6707bee453b8b3

SHA512
f1cb6fb7682bec774d814f88eba87bc09026f083bcd6f4be5aaed454ff037209c07f2ddc17a90fd2a34cad4e940346cc397ce036a328449b8b4115b75727a884

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9feef6a63df5a1606b54077a24c7d9f0

SHA1
f0ee0867d83613f173178990fe46783d69c500d6

SHA256
ed98f4a46338c0bc78a3ab2c3b935808cd0a96d24f3a7b2551b09e04fe7d9ff6

SHA512
62a5bfdf7eeb429d517194fd91b448d968712b1eae7a6a55d23e8e458cd8c247481d371bff31b32f7079220466f9127994cbcaa828250e2c6f8cc3558d6ed3dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b7dd7c5126f238edce52ac213178ce5

SHA1
b86460fb938e4bfe872a2b489f19003d1faebb05

SHA256
c1ba15d0b0e60e0a44ff44a4425ecfb95558f344ef1cbeb1401eba9a1059604f

SHA512
787812ed9ac6db292cb5ec5d7fc5e0a0acbce3e7c64c25316e27e331268abff8dc8614a6a8380ad4ed65672a6c76a02aac83e1f0239e837efd271ec675ce935a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab8bbe9ae8e7bc65b674e0386b3f161f

SHA1
2dd30b13973f04c38a8ad098a863b57af48b209a

SHA256
15fb862f185481ba3430d9be56bdfa1b5895de6209141bce2698fef125ecb131

SHA512
f01507e90de62a47eb61bd3bc2006435a927018a3de363951f1c924dc597eda5a1573c95cb0ae7b9f1c54282e983c5869c19cd286057621922a4fd32ad9e20d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32e0dd6ae4e870503530a401d26c694e

SHA1
5a67ddc694358d1521d50f53346f83a193bb88bc

SHA256
76b37ba288dd279e22a8140ee4d0733521d5dd78ff05b925d6cb70ca8e72cc6a

SHA512
d9a245c11b45101cd3986017bc2000b3d3b49fc195103eca0a2460f929e561200ac29bd80e1a62abfd19093f6ed9e939501ab8068190e4f7013fa73e4c30038b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75628473138109ceae57b605902f5d09

SHA1
64444b6f85183bfc0b41aae240ecde5443c827fd

SHA256
d6a06e55e0c8fb705fa761e06bb90fd306698d551211e80ff30cb88edf1986be

SHA512
f6ab03b715d06c6ace19fac72d5bd50260d52a23ce9a71d0d0c0590113b60c7d1e875a83481fe9a0f9937a47d9bd123f4c8ee1972faa790c3decd8019c522f2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
45155601ac05b5232e162137c0ea4a09

SHA1
65158a1e02e859d9a62954678796d6c5ab67cd92

SHA256
363dcbba09276985a7cb78ddfcde1c44d8a3fa4509572729fabacab32e5c274c

SHA512
27955b52c3b621ffcbad1061090e35456b63991faa867f72fa77f5346adf68192ae1bbe249a67c89a2383ab1c2c82b417b8524b38b53c2dd165bb75e55011491

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
152ee05c45c57fad66e7c7bffc6eb407

SHA1
f5576297be24d21a7dde0d5d7ac73136c35b6438

SHA256
7e17400d7e2787a0b9c4e95351542f45e4eb7c8378f6df19e1775e9a7f31b74c

SHA512
ee25d8494d9e28972f9207a8d85f057ebdf3fb02a54bf51febfc1c65eb85bf88b6463771c8dde1b819d72ffff3e1b7e2dbebc6ddbfc02d974a8e6dc904803314

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7edea46eb827bc95cfb19fec6decf605

SHA1
9da44d4e2a8f31ece69ba930e73cc67b6580aa6b

SHA256
58ab3a095045184138c0dabdfd432bf5ab935d091c90b1ba2717e7b9d132f5c1

SHA512
e23482478aacbf836e2643665f4c09b59aad190af5e349dc89ca63abbed5a6ac7cfbfc0d72d608eeb82738183f83cc2048fac30f1b1f284490207c42381f0893

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47b07a7d224f49e4c14dd7673e15170b

SHA1
600046cb4df298a92837768bd1138aae660a7494

SHA256
3c29dfa357d84827d8e54c9be98e33ea3c30732b7d9d8b36ed359d1f96fa91fb

SHA512
adfb4736e6a576f0a3fca26c34c0af69c566aeaf338227835458de435958dd0328a6a093f8a693f0febd2e251f3abfbc012fe5f2898b737a578be51ed8c1fdfa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73e0de918aa8b7724bde80f672152aa6

SHA1
f9d98f6e50a3b0282548ac5a4af0b5815edd69d0

SHA256
950d118802e5d3353a0566352bfe7c74a0697eb9f7510977fb4b713443eb5e07

SHA512
65524cba76b0f333831a841b596f175ec791bd2cd6295d729db9ebd56fceea014d41a1f6310282c9a4869e0dd93a131a38fb185395586355f95ee8fc4b7ccbdd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
934f45c2c48af06b84ab4875e308d8fb

SHA1
6cd0ca65c831d3ad4c3a502dddf04e481db6b422

SHA256
b15687209b5d0e8f93563d6ba3c6f07b0fcbb0cf39b02a738315d1cc43575370

SHA512
b0adaf32fe9d928e82ba9eac1f04e5727d10f38a04af445fffb76db75ed68b66278acd6c0e152781f08af726ef3718f77e61214e697244afb97c22a5e83375c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\H2EZNG0Z\55told.xlimama[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar13F1.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit