abefa589d72cbf05d31d4d770c5d26cfa175d0026c430dd5b171b0300dba7aa7

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 03:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65d1b876c9e1879e484ad3c0671ccf45_JaffaCakes118.html
Size

242KB
MD5

65d1b876c9e1879e484ad3c0671ccf45
SHA1

a1e2cd108f1e33b0487bbd1b65b0251e7c6bea6c
SHA256

abefa589d72cbf05d31d4d770c5d26cfa175d0026c430dd5b171b0300dba7aa7
SHA512

3966258a9a1672fe9d308363a3386a87e578ac026853d99a14ba9b3701b7f880c8df227a8705ab657344def6a6c033640b976f35b5d7c2ea49aaf12a7782ee6b
SSDEEP

3072:S5zcGbICbISTcYB4GrhB9CyHxX7Be7iAvtLPbAwuBNKifXTJY:SJz9VxLY7iAVLTBQJlY

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422509587"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{84B4D8B1-17E9-11EF-B1CF-5A791E92BC44} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2156 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2156 iexplore.exe
2156 iexplore.exe
2128 IEXPLORE.EXE
2128 IEXPLORE.EXE
2128 IEXPLORE.EXE
2128 IEXPLORE.EXE

pid	process
2156	iexplore.exe

pid	process
2156	iexplore.exe
2156	iexplore.exe
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2156 wrote to memory of 2128	2156	iexplore.exe	IEXPLORE.EXE
PID 2156 wrote to memory of 2128	2156	iexplore.exe	IEXPLORE.EXE
PID 2156 wrote to memory of 2128	2156	iexplore.exe	IEXPLORE.EXE
PID 2156 wrote to memory of 2128	2156	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\65d1b876c9e1879e484ad3c0671ccf45_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2156

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2156 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a9a13833bea0d4fbfa30ad7b4ccfe0f

SHA1
c71880ba867989aa33c5136fa72becd95630f765

SHA256
d5245ba8115bf06443371b628903d9422dadfeb31689b7dddec2856a9f60815f

SHA512
33946d7d96256506fc07eb963dc34d2b469426d95e31c4b3aa0c7f09d890939fdb0d391ccd5e6e3a037b08dfcc30704dd16923ada6a8acc9b8b67648d08b6bd5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e59b10554bf5934353f82bd384251643

SHA1
18dce46330a9be1289366d805a1494bd02f7d06c

SHA256
72e7585e80c6bbdb533d42b9bcf3b17c122e25437deb40384f49a00d276a9a3d

SHA512
c85e341b8bb320d656b00451477956cd346b3017a1bc3576bf5e36e3bc91451ce08ab42e44d35982bd06f348c80090d971c0f4aeebb07d723fad1ed29bfe375a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2fddd61f3abc59ec44133ee995361c7

SHA1
20d0bfed6b0222b18b2bd251416027e34dd81e33

SHA256
70508b8f304de40ff807cc8c5d5593461bcf5ff22d7ae142924891808485e862

SHA512
6652ac9658c6523461fff325803f2784c20bdb27db8b456e6f93a9093e0fb2603e52ac0f603d6ed4c157512983462b9c44c1be9139c28ae9c8e2414db67826b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7876086e9751f404b08317b1b91893a7

SHA1
fbf17b1ceb6206ba57fce7bfa5b2ab00c9e44975

SHA256
f984d45b3884bda757228093de5ffcca77695574366e37412bf46abf9fa08091

SHA512
a4b34765a8c2a45fa9268f59adc7af7a6296c7a1d07a56f4802a5cd3b9ef3058df6aef2a0493d3fdba08b0619e109b393c1e1d4279d24582d21fc005962dfcdf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5fe2b778796143fc9eb749beec419d97

SHA1
1073eb051b6d259d9e9c4d3b7ad9abc20b85be05

SHA256
df6c4cb9238aaae1c77b5ee6f2189399364352ad1571dbca2724a160057a2c4d

SHA512
126024a7aa0ba32a93c0b282977253290abcd580b7b4adf601ca8407e8ac9687b9a0fe8edc96b36452f616581ea5b116a1d4d9790c65b6a6ce3e13819864dbb4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5fd49ee6c934b3a875ed32fde49bdf6d

SHA1
cd833002ba69a7d889e380fa4fd593f62d73d6de

SHA256
6d21008e8384d5acc84e33474a68d76ba1b457962c6c5e2b34137307518f93c9

SHA512
fbfc6dea1e297adb9d4ffead9b259f8bf64d2bb29526d171addc26e08fc72f3a53502dbce5aba9a39241c782421a7a99d10c28214136831b87b6673ed7cd6be9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7495cf3623fa01ee639d94eb7127bd55

SHA1
303c85dddd316d00bcd25c42da0d2356d7377ece

SHA256
2432f0ace70634c611443dba449968e733b659e08c69060727fd00f148dc68df

SHA512
9364960b6deeedea07e379dc17a90dd1fa2ec352e27f1cbfb8cd62981c144a102950a97d20ef7f6d29a42ee5f5979300abcfc13cd513f4bb51e7d4509462ddd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e75b688ea4e76fbd68d6891f48b08c9d

SHA1
7a26bc557afef385acf07384692c907fb50e070e

SHA256
19b81cc39abaaddbdbf77d8af464d633639b9334b424f16283359a1be46e9872

SHA512
7527ea46e96fa2f84800f7dd2ec464b9844eb2ee517a1f95ac282b1378f5395a5fc1f6c00f21eb78c053cec17550f96273a2ed21904fb7a0d8e3bf97db269c0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d2a17ffcb40fa567545aabbad986889

SHA1
7d2673dbc4f96fa4ac7e221f9ea9f0ba44fdf7b6

SHA256
2cf315828b0513f84b9c7d14629420dd32461588402731b8ded3630ea76789cb

SHA512
daa0def4a5352dbca36420a3ae0570aae1ff4346cb88141590654ad16fea19d60363bac9ac2472d86ae037505561c3c8e370d9ecb333e04bf1c24de01ad85052

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8ADCJI8Z\c[1].js

Filesize
46KB

MD5
c88d219b745a0a50d0059022638b027d

SHA1
2dcebc14d9c4d81049d3de5269688846cceb3c44

SHA256
1f8480f8def1083ed6ece9ae35b61015e265363797e21687571f88287124a7c0

SHA512
ccf6a3cc8a2bdd6d8b9fe4e4dc325fbe5fd46f10508630f125b3bd679b19f71c460ae51ff8336e84700743dc832ce6e521d17d4c0c6db58b7da42bea74f0f9e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1C2A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1D3A.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit