bf368216be82a3381b4f0fa37c639dcd8eabfc5b2e6b07e92908eedd969610f8

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 03:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65d5e232a6f26b05a8ca24456785789a_JaffaCakes118.html
Size

156KB
MD5

65d5e232a6f26b05a8ca24456785789a
SHA1

0c8d4700beaed24b8129527260fea85df8194bc8
SHA256

bf368216be82a3381b4f0fa37c639dcd8eabfc5b2e6b07e92908eedd969610f8
SHA512

3bb97b4621e63f3eb38a9622bc7cebd810f08dc014369bd96ad5d3cd7572ad98da16471f078dd52fe8776c8dd8dbc3d34b5e4afcab49cd92d693e70f19cc41e4
SSDEEP

1536:S+hOk4VCVHCOri73H5HCFWYcGdX14BFNbiBpPgwf3WuynsdOnJhdveOlfY4k7RAN:SL

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{72810961-17EA-11EF-ACD5-4635F953E0C8} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422509985"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2180 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2180 iexplore.exe
2180 iexplore.exe
2924 IEXPLORE.EXE
2924 IEXPLORE.EXE
2924 IEXPLORE.EXE
2924 IEXPLORE.EXE

pid	process
2180	iexplore.exe

pid	process
2180	iexplore.exe
2180	iexplore.exe
2924	IEXPLORE.EXE
2924	IEXPLORE.EXE
2924	IEXPLORE.EXE
2924	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2180 wrote to memory of 2924	2180	iexplore.exe	IEXPLORE.EXE
PID 2180 wrote to memory of 2924	2180	iexplore.exe	IEXPLORE.EXE
PID 2180 wrote to memory of 2924	2180	iexplore.exe	IEXPLORE.EXE
PID 2180 wrote to memory of 2924	2180	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\65d5e232a6f26b05a8ca24456785789a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2180

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2180 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f2cf275eb756130f8cb88b085074e9b

SHA1
7359108d794672ec715b2854fc881644146876cb

SHA256
389243659323d7d56348624deda62e5788e06a0d66a49665d609cb696771b64b

SHA512
ec2e249bcbe0dc4e6bef7b7201b3b761ecedf4ec46163f6a4503738a9eb040a49afd6eeda0b12dcc0c1773f24c29d2ac40856c02c53455cdcd6582d4c84898bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44d8f95cde1098a27afc248f36d06413

SHA1
79fbf7e93d2e399fd54f4ffa077702b67d63c565

SHA256
de5da0508dd0874d8fc0c8ae011d5fa08093384ccc71f016db3dfc950bfa42ce

SHA512
18b72153ed3f824977f15e0dbad79234df019d11a56c04d5aca026bc35bd035106dab915b8709a7c34914a3c64ce5685022a45a4cc5111f91ede5a8e94d158cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c596802f5d6007b9ded96e266b89855c

SHA1
c2e58d8eba2af77189a6bc5db37e23d72f30d741

SHA256
40b4c600ec539ac7f25dfc1fffbb7aafa22b66dabada27b2f5ae7b56b3ef4552

SHA512
ee055ad69312ffcb3818e5556489598878e5c800d836376d99c7a7b4cfd631bf1cc06d002701db446d32de4e2993960e5791bfdaf6d649843f2523d08f6edcca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
982ba2931248c2311ad8a6402987f9b3

SHA1
5f2d86650277af85653f6555c0c4526448fccd60

SHA256
6e79d2ef89f71955bd47bf867a2bfe40baa8c907d426c2095ddea60ee6a5190c

SHA512
cf6a986366b5e7b2bfb249b1e0839a686d63e0c31ee7f8d41d5ce4944105b20c242a34ec6fe1665a4ec29abb46ff458972fb71b19e51186d77117ea010f8546c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5cd3abd009bb1f61cab7f6ec283a4f7

SHA1
d94e48c44dfac78eafa3ce432948c5594445adaa

SHA256
79f663ba09903c46c61bf8da4867fb55e1efc95b8febace50a61495ef89d1610

SHA512
bc379a60437c69e39bb1776064ebcf4c9ddf2bc23899098e988a8bd82c15d3230fd6dbbedbb8afe48a810e2a4399118156960f18f58a586c38034e4085fff96a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46823b68b34f67583dc525f7be1822b3

SHA1
c34973e5ec0f689a64fc67fe1dde20f494d488ee

SHA256
54cce5206f5858729370045369a9f90f090af170be564168bca1d0121a3b622b

SHA512
beaa1ed77332efda1d4b0c74087a4cbe64c5734d6480998e9fb7db31056553180500acc94113e23cf881a81eb353a54268ed49388e4946bfa6955f1e74793ae1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4624edb384bcba926aaf895e7df4102a

SHA1
9f31f0ffd6aa62866c3344c2e49134edc17f4edf

SHA256
87f2dbe03d97def9fe3041e8c9992a30ac09875e86df5519afc8d4757e47cddf

SHA512
7531d83ecd759742ba3f7a5ee6de598f8cb80a21402b8e561c01870852ff0c74aa27e3b6862591a935594fc7a1b83348d342e1c058706a4cc42a933d917c2ee7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e66d502e2bf8212bb0ecd0e1c5d9a50

SHA1
63b1b5436d8e6cf31aa7e228da0d67562f3a4f70

SHA256
9228caf3231cf0ccbde43784b2ae94a9154dd2afd0268883631086883cbd537b

SHA512
e66ef4a7262d2aeb385acfc80724feeb07cedd7c7b657472c1d31c6bc60914eaa440d068a42ad01de9a844002622883788a35a91652fc2d7a000d17cbe6a8739

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c25c87052a098a2b7e8c5e1649b5e67

SHA1
65e18b55dea1e2ad5fe6d829ae6f636e4638e6cb

SHA256
6badac7ad035a2e8978373cb48421c5f0b8cbf3a3ae0b00eb2a78f7c683ffdd4

SHA512
c56045cff8470b3aeb934d49f879a8e6ee73fc2c94b867d8c9531f2d85d2d5ce190e54ac5adb469ccdecea85295fde754402869c244effe309074ad4693ccd10

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1844.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1895.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit