c4d48813a22e7e67e63b0c4525c635a5b813a8a6490333b1886f668a83c488d1

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 03:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65e5b305e5cd73c32024e8ae347f9a26_JaffaCakes118.html
Size

29KB
MD5

65e5b305e5cd73c32024e8ae347f9a26
SHA1

73e39aca56cbf449ce882f979a5a52eb62830779
SHA256

c4d48813a22e7e67e63b0c4525c635a5b813a8a6490333b1886f668a83c488d1
SHA512

ae93f8c043ec0644f019ab84567efc2aacf54bbf9b94515f4ed62d62faed73746bbdcc98241c7403f0a6ae1215877ea7b895c618f87ffd4c1c50cb5f8dd27187
SSDEEP

384:SIUMdbYJUYh0TrztCz7vSVQaSpg0pOQ+69xF+/uKgvpvA:SgWmSjOOF+/uKgxI

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E2E75491-17ED-11EF-AE27-76C100907C10} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422511462"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2052 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2052 iexplore.exe
2052 iexplore.exe
2480 IEXPLORE.EXE
2480 IEXPLORE.EXE
2480 IEXPLORE.EXE
2480 IEXPLORE.EXE

pid	process
2052	iexplore.exe

pid	process
2052	iexplore.exe
2052	iexplore.exe
2480	IEXPLORE.EXE
2480	IEXPLORE.EXE
2480	IEXPLORE.EXE
2480	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2052 wrote to memory of 2480	2052	iexplore.exe	IEXPLORE.EXE
PID 2052 wrote to memory of 2480	2052	iexplore.exe	IEXPLORE.EXE
PID 2052 wrote to memory of 2480	2052	iexplore.exe	IEXPLORE.EXE
PID 2052 wrote to memory of 2480	2052	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\65e5b305e5cd73c32024e8ae347f9a26_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2052

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2052 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1cdf2b8b3d9c25e31fbe251ba73201bd

SHA1
f68859cab2abbdd73b16f81346c82dc4bf7d0094

SHA256
36d46a408af5f2a209157c392b87d805aa5aaf6ebabdce40b2329a78dcf4f08d

SHA512
2379ca416ec15d834c385bd27835ecfc46dc161268f49a204664aa953194f2db274b0eaca1d90670802bac92574eb5515ff110db780490d0b2a61c689e01b266

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0bdd714073402b5cbfda14b68b1c5e1d

SHA1
1f7ef636fa890b110bcd0c9f2c8524115d3076b4

SHA256
dfacccfda7ec37707d9758169653423c69159f74267288830b370d556b8b3df5

SHA512
e1125c321995391c9b25f5cee40c13b824bf420a2e5608e22e1512f15073627c7d4f4a90fc08607d8ac35966fe353dc508ddfdeb5d5f1374c7b4964ff03d0de2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
01e964d2316ede6d48b754da04d20161

SHA1
0fef0f8fe2825d903cfe0905f042427315742081

SHA256
e18fb65e9c69abee50e20ae16c15d40bb0d067cdaccb921676bd2000ebe7a058

SHA512
e7e031ba05d3307d85fad70e35c54197d08f9777364efa655e7e5a2939d8379d73179a8a755d929ce8cc4aa59b70e0f94d5b60e409d978a8a4712c02db0f5002

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ee9018b1919e4935156f91ff0581cab

SHA1
2a76bbc64fdda0b76691d30ec094f446b2cba4df

SHA256
8e4d021ace886de1e0707c74316b035e2296e83b5e891857b0711be40c64c42e

SHA512
9af5b6f1f2fcbf2cb4d1d170190df6c5344102153cb910eef867e7689c39184d632082532e0a6f469964edb53b68d2388228c9d400d5adbc947977cf169c552f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b0ec76039e14fdedf27cf92f5e342f6

SHA1
f3b8766719933ea9dddfaed8c839172f61cdab18

SHA256
65d6aaf862b61b30eebf990a5d87a868e86c29a7c4b7fe87053ff1d0f31eb814

SHA512
8267b4c28de2e9bdeedcdf497b0646d0f1d0f8714921d999a7c114acbc7d725f7be93e768d9ed4feaa3793a1620eeb39f620fa2b7fb84f46a871b8aac8eaddd8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ecd80ed289ba4431c4b8c9312d8690f

SHA1
860b40b58ec8ea1fac9bb8ec3497c5e734bc38f5

SHA256
7c11bc93cd428f6ee6888d89243943090da3b5e3fb6c9c330086f2b6a6ddd3cc

SHA512
540f7c21ff0f2de1653dd71e21e97524cdbe5b07f0b3499d00272707365c6da48b878ea60f06eb3906eebec42d4ae5c07563d49ed004ec78688a02c4f6e83246

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5342433213d81cf2c7039003bda69f4

SHA1
371de291d7f3f78c5452cdc4159b81cba82c06da

SHA256
68d4554a76f40c9b3532c0829fec5740de902d823452db550436815bdae3f66d

SHA512
5e02fb42f5eb8f0fe735ad331bb1d491530e61b3bcb58e208c56f24c3e4a2e19ea61cebead9af2707ca49a5b687458f7ea43c7672d78ad436d23e1001b4ba23a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
981882dcfe8516155e932c7b0ebab962

SHA1
8f739706c63b5e92afa253c271e802aae68fd07c

SHA256
f30f7ac961fd91c997b23153440d876690873f79d95b57b0c7cf199fd3b52112

SHA512
51c5214dcc1037e41dd3cfc09574ee440bf854875450980c051f253bfa2ca173439b6f3d9ce5ab5fcfab0f6fd25fdba9b3eba58fe1f9926f9345ded010860ff5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
30a75e9ba86871f10a32f09005ada9db

SHA1
bff4d591d2b3565f0c27d688700100abb6e98db9

SHA256
b7524799a7149cc5dc9cdc2c1fbc734178228dce597b7d60c15c683f41c4ebdf

SHA512
ced6d6a8ec25838ff99901d50b69618466b9e3dcc4bb2bdd2935b4aa973898b6a31c612be463919bfb4196fe7a02e6d0607bd3e3a596416fd6efd6c44c061861

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB18.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB7B.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit