ae98ff198e5ddea5fe410ce4f1691f6c824e58b6bb89d88710443a27621bfe36

Analysis

max time kernel
145s
max time network
146s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22/05/2024, 04:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65f205a87f4115d51ae09694173a5399_JaffaCakes118.html
Size

22KB
MD5

65f205a87f4115d51ae09694173a5399
SHA1

a42b8161beb2b1d5718f33d95b0bb5ff97994921
SHA256

ae98ff198e5ddea5fe410ce4f1691f6c824e58b6bb89d88710443a27621bfe36
SHA512

dd6caf0fd61de00d9fe59f808b7ac6b4c36fc7b7f5c2ae9388dd84462bfc7634b3446c2b465dfcae8584dd3ce3801d35bbe085323e0a14a19a531b88313c7066
SSDEEP

192:RsHo94wb5nznQjLntQ/EnQieuntnQOkrntK1nQTbnwnQwR4SnQNjManFnQ7Xn4nQ:uHoeXQ/KNj

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60457b7cfdabda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A7A6FF41-17F0-11EF-B8F6-D6B84878A518} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422512652"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000cdfceb4c17ab0427bf9627ccb81030af7f832fec80cdae95016d33da1a5921e0000000000e80000000020000200000008c1e7939a899ba2bd51814792cc673662edc2a861f9b293f2587a3b2f20424bf200000008193311d93944b9030ec55199388118d7099cb55507bd7ec0b3caac1f64ed7c740000000804c05a12028fdbfb163972aea4b3bb6730ed5a16ccab9de8b7ca210cac47124d3434aa0b7091ea2251e65eb4b84d034bf2ba8d3328cef972d0d2483697c381c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000001b8fe96ebf02d15a9b8e322f068260289e6fc472a62a3a8a3cf6dd79cbb0140a000000000e8000000002000020000000367458b6c8d8e376e74cfc5692800259507f3bc5355dd7a8bce0578bfebf7e7390000000c15fa27aa7968d54dc6aef54bf824ae0c5933bb6d6aa5bbda326eac78179a75b254eb3caa1804edcb9e3fc9ec330ea997467933be0c193ec751b4b94af248811a69c1c5999f1e3a0819e082220a93184488ce33c00be1c114ce2ffea06daec74ce44f7a2c9af8357b7f931878c94cec9d5cdd14b39b2f036cbebd8366c00beb5f4b2339897002496732f58b1d7df7a8c400000000638368e1a6cc004d7d7dfa04d0ba5263743ba902e4bbcc0981b91e850a4869508a0517699d0b64f6e9f7ff389a3b5a24be20e6003640b619aed046b060fae37	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2928	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2928	iexplore.exe
2928	iexplore.exe
2812	IEXPLORE.EXE
2812	IEXPLORE.EXE
2812	IEXPLORE.EXE
2812	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 2812	2928	iexplore.exe	28
PID 2928 wrote to memory of 2812	2928	iexplore.exe	28
PID 2928 wrote to memory of 2812	2928	iexplore.exe	28
PID 2928 wrote to memory of 2812	2928	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\65f205a87f4115d51ae09694173a5399_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2928 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed82aa417f341a91dd8559a27f2f2d8e

SHA1
ef2e63763f159b6b7b2804b24ac65f27cfb0ac3b

SHA256
de99d06bf70e962c7dfb28b2d76b984f227720c8f1743f543fffdab545fbc7f1

SHA512
bb6da0b08cb5d2dfba74111e7adc48f4102c13af12763a628e5f689cb6672907e37c97bdae28078a5f91807183505d1c1f7327c8807cdc11952f9ddbdbaac438

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b900ffad877369704a22c849b0a053c

SHA1
a61033c956966f3b2eb8437ba538d5a8bdb03e75

SHA256
3e80a58255240fd4d2c254ed29120bbeee7c8c4fa6788567bd4afb22f3a81f43

SHA512
6d9cb55d2ac4dd4394c94d92bcfe819054bf0bf0c8312ce6bf7304e45ebc5449eb9bfc95969c50bb7d200968792d686c12be7731e70be6ade757cfd2b09502fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
595331c7ae21bc8b01d41c1a2c4d9ee9

SHA1
2c396a079643d3eb5ba97cd0d2102bce626cdf12

SHA256
2bfdb0709f2e91c2a59e421c54ec2dbeea34e12d9ea6fb765bbfcaecf7797d6b

SHA512
6954a1584ab77eebd648a76c243eecd8326932e489f49d5085b550f9ca17b4fc38c8697e019107e9806926348b6c2ceffad549acdcf38f38e79b609fc1e48253

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
500dcf09781a8e6998573159098d0973

SHA1
11b9ad143b390bbce91f99fc2f407bf1363f7ae9

SHA256
f21eb7c4e91cb07a4a4dc6f7ae9d2414ac49ea682eac8cef89e0c582b76bb5e4

SHA512
f51390ed8de3e123e14694f55b01b713f240aec91afc698bfe03a3f1cb4207e0655fbd849aef2b8ca7af4f6fb8ab9dfdca4e07c0f211c01d5d54b524f79e2230

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
edef9cbdf903cabfafd34265d67a7a27

SHA1
7f3a888fbd64ed155e98af23619acab5f7bd9411

SHA256
3d6200de1f3e4bbe05349b48b8e6f51616009bd1915a6fe56e2b3ce04346e461

SHA512
d851eb22b12f5dad501bc0a7262481c4b0c9debc0064bbab18842b40cfe33a9d93bd98e7ddc122d45338f1fda79e244d6bf3cc9857a7ed8877c19daa36120c39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b9229b6f5687b7b09dc5d5f56d15fe2

SHA1
286a439bfcc49f0eb5085a0e659a18bd4a979c90

SHA256
7a794a3656168c95f966b3e547186256fda4082d3d9258340cf34acdf6a8d99b

SHA512
07765b9e9291ba2370d147de8ec54a8d376441f8fd23d18fbfd22c2e59614bbc26b82119ccf6c4d1560f1829175993c5e903fe865cc8f32dc6b0a61cca4a90bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aeabe33f0d24f47c5f639644a9e31b8a

SHA1
b427f902705c4de66fc31bd4fc5b34a53c1cce5b

SHA256
5e2ec5dd55dbd18a342488b8db13ea2d1653ea3a1dc6eb3ff558a96886a89c50

SHA512
91c594fb160810f189cb4bf2e17368ea6a1425be1803eca45769feb2faf7b2bdc072434747e341f9b367853c5cbcd8ed27f55593a0eb375b8b0269640718b8ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d34120b1f39d20f575b3c1402306fa62

SHA1
15870bcaf5d2d78d8c48d29fbaf1540641453c6b

SHA256
f598567f0173a24076da13626559027e507d11b027318f71122ad15d50f829a8

SHA512
17abb413c4cfc2422c0dc7416516691597e26fd312cb5a9e45dcbe35ceb7a9726da388a36d529b1aaa71c96a95414099f234b744eae1d4f8dc1944b6e139f5ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
236915d743cb77e0b00f1b4ef4f6b7b0

SHA1
38b0fa12510a3d6019ef75b24a16679e93af3326

SHA256
9e0af4e1c297909818a57ff4715dcac8c346e0d53d134b4e62d950c0a67cf193

SHA512
226fe6d28c2751239b0ab3529ccb49ceb4c561ff15dda903b2eeffa03b5ba5492c1d92e08bb2b3a308240c43e1ea6d067e2e123743feebc13c918b5a51c2a1d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
527c333ef3d1d6d00de5bdef6ccb13fa

SHA1
9bde68e98383962a6d3f1d4fac15c2e2944ac83b

SHA256
40ca790dad559b37ecefa596a64154d12f0115b88fb14dc19357f80d4e53d769

SHA512
63fc2d183a63f981d68a90f374cc8b4cbba33c0d40cba4eb4ccbc16a90a091b275d702966ba300783b564eb0117cf57570187ec038c3a8b7f0bbe298f9fc15ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6ced1b895c27cf7ad988ede316aaa65

SHA1
bbc26508a24ad8bf35dfb2d276d4ad93bfd8befa

SHA256
91d0e0cc8db041cf8b7f15dad84f64ae6517d9e688aca89e638b9440cc666d10

SHA512
7f556bd9ec2579701ef78eecbdb902937809ab6e871d7e597358494ea18bfb2d43957845fe59be4cab1643b9b7099fcaaab8daa50e71e34fe090eae61ef80907

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e90f5948888c02d02ed4eb145fd8c8b1

SHA1
bbbfe3c86ad5a3f426498c19b760706566c2b892

SHA256
d4e7388e3e6df66e1a2c133ce0b658f6efc604da090a0a9210e1b33176e23569

SHA512
a8df2d69ca1f17ea60738c1967ae18ce0a3cde3fee6cd75d370493933d57cf21e0cde81791e7227e36c8c4960ce2bcb94c0ed25e95a6a7a2610e16fac1fc15b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
158ca7a3f4bcca9e60f2777046c5a8fc

SHA1
2f015c0f6393f2aa128c9cc4fb00567f71f9291b

SHA256
ddcf8ca7256bfd622850562f5180b22cceb86e0d9fbc083fe0d4e5c75adc2e62

SHA512
a881b1ff340a962e8bb5aa29fa117b6911d5a05ed4308eaffa47c5f9919603d6c46595fe52f1f6cc5814b0e2aeafe7cc3aa24fbdb6caadcf0ff22b4cfe4dfe03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ceb55450f9c1bc7468e36038125dc29

SHA1
4463bc4b112b0fab2ff59a2a93583d5938c3421f

SHA256
05a49706ffc548dbf6de430076415f85dc8a10a42ce424e3319c28106cca2fe1

SHA512
f03f12295db8633b41ee93f0e648af2f262ba216a1e7e10ce89cf56d258ea7c5ca7e1334c40192b99eb9f49afae97a4463b7cbb3b04440fc587b61473916f26a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3630.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar36C0.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit