2b69374af3fc9b2f8300ce8e5b5f305df2fa409180f16635f4ef1afb934843ce

Analysis

max time kernel
133s
max time network
128s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 03:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65d9fd65b6536cadd9fcd03256f3d2da_JaffaCakes118.html
Size

4KB
MD5

65d9fd65b6536cadd9fcd03256f3d2da
SHA1

c1ca1b43a8840532ec6f1612bbf4683041c93280
SHA256

2b69374af3fc9b2f8300ce8e5b5f305df2fa409180f16635f4ef1afb934843ce
SHA512

343d8a19ac9146f067b9aa679438fc119139d4b78819680573790acedfda7b1c329af2e7193e252fb55b00ba6363599276358fefaa08d5c8979fcc50995fa514
SSDEEP

96:ziE1ZmV4MSEPBDvV0n47ej/hgOKiljSR1QnyneqhVrbvpSf:ziIwV4GD8/h/KiZwQn/q/bvp8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e93610000000002000000000010660000000100002000000064da8fd3fb0ebc84406ba593f9058ad6ece27703e1d8fe2a0fff0e8e1fc66a7c000000000e8000000002000020000000429d7ccb135ecf87bdbb41f6617a2d28c87af9e6e529d7411c499d01d6d676ea90000000d911fe198314fa7f635fd0b1eab4042012b066920391fd7f1d69569d7de3c66494798124e275d5041628b43a1bdb6e0300cf6fd5cfd8610686469588a45e9552b2b66061b0aaa41941b92ce878c6d423fa23fc05e324eecce8ec5609d8d325f2563807f6ddc2037331bef9478c9cd77ea26432ae3886d75a217ce5a413149f50784f2eeb9b886ba262dadab0df0fefad400000005fb6aa81af58932454dbb7fb6f11963c841396fcdf94b02c8fb77006456bae2717004b371d12544c9bb93acceb143bf5f7a07f3f8a28f01af2e86d232f176e3c	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20aaf6f0f7abda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422510301"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2DB17A31-17EB-11EF-B195-DEECE6B0C1A4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000dde2a7a5c0325e8379e0a22ca9a3086fd6cac0748f7d6071113309ce47d3b3f9000000000e8000000002000020000000a908198f838bb68e88601adda676bb58768d07c3373aed4f89cd153f6ea8eff420000000dcb0f321dfcccfa8aae6d3321f166e3eadc6bc0af372cee974343f38650bed6c40000000f3574d4aa84a8707090ee4bcc086d0293383189482c4a2ce6d5122cb7b4a171af2f94008e3614a72eada1440b77bc0e839bac8dd8be535db454cb215d073ed6b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1608 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1608 iexplore.exe
1608 iexplore.exe
3056 IEXPLORE.EXE
3056 IEXPLORE.EXE
3056 IEXPLORE.EXE
3056 IEXPLORE.EXE

pid	process
1608	iexplore.exe

pid	process
1608	iexplore.exe
1608	iexplore.exe
3056	IEXPLORE.EXE
3056	IEXPLORE.EXE
3056	IEXPLORE.EXE
3056	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1608 wrote to memory of 3056	1608	iexplore.exe	IEXPLORE.EXE
PID 1608 wrote to memory of 3056	1608	iexplore.exe	IEXPLORE.EXE
PID 1608 wrote to memory of 3056	1608	iexplore.exe	IEXPLORE.EXE
PID 1608 wrote to memory of 3056	1608	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\65d9fd65b6536cadd9fcd03256f3d2da_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1608

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1608 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc9834d05d1a3701e7f8d8b09f1cf29c

SHA1
c1c2d9e3ceadba0d86e035a434ae86c62fb9f5ac

SHA256
9f6952c017b77202110bafbcc89f4656ced80213ea122097f76427657ec139f0

SHA512
36653bd105e1f616493b088d134c953924e9ef49eb808e3b468a7450e18804abf6f4731df4d505664c79e851e93472205c419962cdabc1892b649ea900ebea1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0cd68ea01e1a37a0ab91b3d326b881fe

SHA1
884a0454d0473c0b1ae3fca3776746d6df72fe59

SHA256
353e5a43e8b5aaa7d6686655248209c1702b120c547485a72c86d25b1e179290

SHA512
ca35f4e60d1e127e0577f7d64d6a54b15fc02ff7f83f6bd3338bb9e31912907f701b53995ecb8ed0382e8407fc9266559565ba5b6fdfcef6d017c67b34f6577a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e1e39572f98105ac7bc52cecd8686c19

SHA1
07ca52b988824b67ecf60874b63cff4182d2c0ae

SHA256
0f9d5e397919ba77702b8d5d00050be8af5a6fe5e543968d8989d171b923b50e

SHA512
b795d10b90cbe8a5bc3884a87456679ea2e0917bb9bd9cfa5f592d2f387872173af6481e0e8e66ce375844e32b366d8287e5c7edb3a10df1e5cf88e30aff9c89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2da1fcadd310fb615214a0dc16b33c1a

SHA1
7a21ccf17d0fb233bd703265d3ee1d0b0d184084

SHA256
e419c7f66c77c9185bf9f3faa3b5ac1925b41cf36ca30d7af9c6ecd3bf877d20

SHA512
4c735c9b6b9e8fd19a4b811c08681646d72a9780874891314f28c3dbf44903e8d50eb4db06e6ac7800efeaa5ae2767b3e737ca5a229c678b10ffa9e47547f25e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17efa5fa9aca71a684a6fb518eec4200

SHA1
1f6c4ee77416cc781448e7cc0e21b22791b431fb

SHA256
d420918a7abd4d4b234f31f595e2ea0ca657c9169093c8ac64dc286dfbeba319

SHA512
f66b6304d51d9687999be8b6045c8c2ce4336240bdf16124d12ef0f06ecc30d856893a9fcfe31c06229316d6f2209273e9af5768f07ffba61d2e256d0362b909

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
feb74613af19236ebf1fe3608687cdb8

SHA1
3f7cc8cb06688aaa99f8c111f9d7b94112c726fc

SHA256
59860097df7f897c1aa9a88b6499a250a18f2d2dddebc0a6f8586c1bd301a3ea

SHA512
7e0441ed48b30aed5a81e344ad55689dcab86fb33197d858f50d42f1161f6e05bd8c25be7bffdbf85858d993eaf2f77ea72df10ae3ec9f3c3907a399f32d60f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
353d7f18fea979b751ae3770a175450d

SHA1
9bd020d0e8c1aeee5fdc289004314cd4af18fffd

SHA256
e561342f1251b49c8ea1c2f6319aa2dc28022beb0c32e816bc62198850ffe374

SHA512
54285b7570e423ed29e3ced454d04f7d566329797dd0d96c992e5b0b2ca5beabf26ab9493d032f06c95430890c97a0b601f0617b467b8afd219ca202243a8943

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5691e4f5e73a4cc2c08960619570cfd0

SHA1
436b54615fe4871c450e286124c7174e0e0622f8

SHA256
cc9efb1f9e579d7aa76343550e40be690234b9c19c6dc465a78687bb7284e062

SHA512
08f4ecfd76d2ed9057a11613194ff6fc636dbd74223e97e95198e9c9098649ea97364b28627b18e54dee91ac8be6978c2d4f656e179a91a5b7e46dc25f071736

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f551ce0d56879990a4f92619e1df0c5d

SHA1
ad01349b0f5344d4cba9f22fcafc1a1e7ecdc024

SHA256
2c96bb69de8c6aec268aa2c19c3a3a1914609213adc2ea977c442d350c7be322

SHA512
f2758938129f4a9dba5995b99bc4ef83f5eaf88e632b9585f6d4e805c6a858f11a383dfd2bd194da491cbb816fa85b046260fa4fce219f37fd86a656820f864c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c40d896fec59139d9489fdfe621986ee

SHA1
6dcb25d3ae8fe1d180b64812e0ba7454845580b1

SHA256
d18b39cd37f706230b941699363ecbe07f90f17b440c9a1c90f6a05b9f93f36f

SHA512
8ec114fedea62b723ac2c88886656e422ca6913a33b7a36948ee5fb9ae9141d985306b4ec12323ae49a97ce96c616c3ebbd97955baec889ef4ec18087130564d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ab6ecc538b5dfb137e512d7c56f85fd

SHA1
966fb0e5303180c555a6b845e3d3e1a7a1dcd780

SHA256
8a8159d696fedf0e34309d411a9bdab98c5ae195c161332d76cb0f67afe55134

SHA512
b0239edaba2cfb5f06584ccca62af5b50a9773e81ff7e51eeaabb6e2a1f85b94318fd3a222eab7b447bdd70b0b932f3172af9487b1a92852be505a320d12d64b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d8ac87e3efdbcbf147303db835c0948

SHA1
bec1b94258b4ec31af1f79d0acc953842720ffc2

SHA256
4274abb126d2d9f05e8e1722d78e3cc60667039c48c7725b7278f446fea4a6b3

SHA512
ef236925620b30954cba0386e5cf285de4004ce220a42c6616eaa38be3d5e0b1aecc59f760eb3a0dd74d385683f757c3b82f19e2426269ed8cd1ee76a7762f15

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3DAE.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3E3E.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit