3ecc72048e81b2ae9379585f54405a4cb957a87eeab8fc02c778530f7124825f

Analysis

max time kernel
149s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 03:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65d18e23a963c157510ee62f525fc0f9_JaffaCakes118.html
Size

18KB
MD5

65d18e23a963c157510ee62f525fc0f9
SHA1

c1aa8222902d6e33db5e43270442dd8b42f1bc28
SHA256

3ecc72048e81b2ae9379585f54405a4cb957a87eeab8fc02c778530f7124825f
SHA512

f5aa288c0f774fb7a83cd143864f5179be4f9a3479e64ec36829a80dc6115f9d619351a653044b35c4b9ab68d52b2e31b39a403abb370e3191b2ba6f80f4036b
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAIr4RzUnjBhDF82qDB8:SIMd0I5nO9HVsvDexDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422509574"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7BA23EC1-17E9-11EF-BF06-56D57A935C49} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1252 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1252 iexplore.exe
1252 iexplore.exe
1740 IEXPLORE.EXE
1740 IEXPLORE.EXE
1740 IEXPLORE.EXE
1740 IEXPLORE.EXE

pid	process
1252	iexplore.exe

pid	process
1252	iexplore.exe
1252	iexplore.exe
1740	IEXPLORE.EXE
1740	IEXPLORE.EXE
1740	IEXPLORE.EXE
1740	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1252 wrote to memory of 1740	1252	iexplore.exe	IEXPLORE.EXE
PID 1252 wrote to memory of 1740	1252	iexplore.exe	IEXPLORE.EXE
PID 1252 wrote to memory of 1740	1252	iexplore.exe	IEXPLORE.EXE
PID 1252 wrote to memory of 1740	1252	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\65d18e23a963c157510ee62f525fc0f9_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1252

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1252 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1740

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
36a5386863930decddd0f4c8daee621d

SHA1
f14d903073993249e530e94d73248cc3f85949d6

SHA256
56b9cff78fad239c7a716d33095b5c7d05c21a93d65203bca320c7e7260bc159

SHA512
a2d252445304092fe13a29fd7476423a542ef60c01aee78170f8bf88bb6357275a322a36b216cb3842d6dae0d1625c99feadeb2713b7bda6e96a34c1ed662441

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
634a2d7e75b6d07f7a080d4af9d3412a

SHA1
23981a6395a72b500f2d26c7cb3f3057bb1b7163

SHA256
0be6f37333b7d169ade327f8944956f6b427cce470e50ea6159866e88e9fc273

SHA512
5eb5ec156957237f3ab4211057471680f6ce1fadea872c71ec6a6efb4db2014fdd91cde0138dfb179425da9a7031992f5f169821fe6b8b3687a866c02de7b5f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
85733aa82052cdbfa593378093390dd9

SHA1
a0aaab3ce31d3500504629b40d043d076e89264b

SHA256
59d90e0ecc41bd131ab63b501eac07476a2a9bd1c6e3c6a372fd518834545e9f

SHA512
c1ec50e4d835e8582bbb80c53109da5e9ef2b1873c88d45af515ea866dc73670c1a5e872915e32fb0b12fe2b3ea3298b1c3d2ee1d5ab3969cc362ec91a96d2de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
5f65ccc768d28733c3ea44adcbd035e6

SHA1
5cb44ef1b5578535fc51894ff582ba62fdd1cb19

SHA256
b4cc6c03b2099c717ef8f8dd33e99f77fdf4461d441d2a2a2bea6586402da13b

SHA512
4c3930dc3ef0e66a84015496d05209495cee9121d711ed33ab3dca67fb4bd9174113006480c193cb78d81f795f5f8db44f263d6d6db260bfd04f5b9d286f51f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
bf293e44c2eacb743e89af9228bd75f9

SHA1
a7f187349b1ddf1a96ad1e1df4f156b5d922e11d

SHA256
ba6f3cd08410d4ece5f0aa882d958f2985f6d7c0c334e83e446e52ebe61c56e3

SHA512
107690d05cfbb4b6253d2007fb5de8391c2b9759fe82afe7f46c02ffdfd3525b2ffa4279fd951a06dd1509e1c6df2bd4dd57d9e4f6954c4065646126ad848d2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
f1930e3ab36a0811bdb8ac847ce7a3e6

SHA1
7ce9e8dae6816e2d57de97dc6bc2f2dd54ee71c6

SHA256
777f4f1ebb808adc82a5d49a265f3112854743e9b77fa6ad8d569252d9daafe7

SHA512
90c66672a18d00669aa89048ab649b9cf5bd89636fa03d752298c58062b9d1d245420403c0c2b2e6002588838880b1c819b4e3f2b4c55bd88e0e524554d53d14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
e044f2ff7475f7ad3b8adbfd4d70de86

SHA1
912680b307c7351b302630b457f1c6def865aa3c

SHA256
1524284728b0ed61e4be98757423a532866a6a025b2288c534b37a19b26b0439

SHA512
599c20dda713488808ea89c4ee4fa86a9ade2b9335107a4e8f725a748897cefbe3860d7ab6621ba979f315701888c3be8a726375d889604a5e366f0b6bd2279e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
0c38f21409afba37f224d0b70d7c2e80

SHA1
3b0b9c2f4cf7e9141345e0a049aa12045f281a56

SHA256
3669398e7009be8bd44e71670df14838d761317a3b29c89f8ba90179f15cd08e

SHA512
f7e01c2478f5448395a4da10cdbd1e01e383e8fb8894ad3b53b76a098bc17ac81f376739b9b7080e9c3270f69d4cf9e518f42583aea5f5e45375572e3b81940a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
fcc3e7e195c5c88d74205f93adb621a9

SHA1
2757f2294105cfe59f3f979efd12264d48e973b4

SHA256
4bb4e7a5eb035eda89defa288a5fa90d90b5891c4216bd3a9f49437b8be0bfac

SHA512
4ae67eb7d538a6393fae0d401645c8be35ed4d7d3519971a1e6a976f9a593da4ba448001a4c1e1818821c6540d5062e549a5dd96dd2c6e3721f43b581b6465a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab785D.tmp
Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab792C.tmp
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar798C.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit