75b67ae7f00b17c5b9866cebbd0162cc3cbf888629063ce19554682af2973272

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 19:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

684def626c2b4ad8939a9941056666e6_JaffaCakes118.html
Size

19KB
MD5

684def626c2b4ad8939a9941056666e6
SHA1

08be580e3444bce6b0e355b42e2930eaa69a3bc7
SHA256

75b67ae7f00b17c5b9866cebbd0162cc3cbf888629063ce19554682af2973272
SHA512

45cacf223e23cb25600a90c55a25cffd882f0e86f755a3bc27288a515ac32e53f92151e6238c3a6c6f429f0adf9ebc6ed99c6da8a1a69a7988fa6462fa335bfd
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAI/4RzUnjBhj182qDB8:SIMd0I5nvHFsvjOxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422566678"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6FDE5E41-186E-11EF-9001-CA5596DD87F4} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2896 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2896 iexplore.exe
2896 iexplore.exe
2996 IEXPLORE.EXE
2996 IEXPLORE.EXE
2996 IEXPLORE.EXE
2996 IEXPLORE.EXE

pid	process
2896	iexplore.exe

pid	process
2896	iexplore.exe
2896	iexplore.exe
2996	IEXPLORE.EXE
2996	IEXPLORE.EXE
2996	IEXPLORE.EXE
2996	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2896 wrote to memory of 2996	2896	iexplore.exe	IEXPLORE.EXE
PID 2896 wrote to memory of 2996	2896	iexplore.exe	IEXPLORE.EXE
PID 2896 wrote to memory of 2996	2896	iexplore.exe	IEXPLORE.EXE
PID 2896 wrote to memory of 2996	2896	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\684def626c2b4ad8939a9941056666e6_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2896 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
082167149cbc06bcf9fb97b6d4f2cae4

SHA1
e0eceb0aaad73b847d4596c5c6fbefd5cdfa8404

SHA256
55fe31f7797c75b95522103cd84c4da3d1c8e846bdb899264087b0d0b00f08e0

SHA512
2064f12cd93f4370a1b57fcc862685b69a7dffe4e5315185a72a0aa68b7283a732095dfa1c73f1834122673be1ed2bf2424647c26bcc2f2a1c647f7ab4c4af42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e36f8d00a963f10653c0f2bbc87e736f

SHA1
558a03be79dca05047c7d1dbb103f96ba82c310d

SHA256
9b4dd2541b4dd7eef8b82ac1c4246c7f0bbd58c34f0d266024371d23e064c3e7

SHA512
a4832026b801813f4b6a8e24cb65762f8163f38bd0475166fbb99ce423bf6eaf6ae793899a0aac1dd897c8445744e649496ffb581cf6caf85649034b08d8f94f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e7bc8471c7ec177405c9adfab796d06

SHA1
6d3e81b48a705cb12e52020bc02b9a9f1bc02c4c

SHA256
5d53cec4d76674c4cbe3a4bbc004d324ea0801fbfc437321030000ae4c197963

SHA512
22b5f01c2a88c775b63140fab40d3dbc7872ea8c6de183dfd4f400f6644c33f714d93722b90ae09f383dce6b994d5da8408cd2bad1d732dffc1b81730b8014a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58bb2e483ae2971efc8c01782bf3290f

SHA1
fae17d7df06c7e500c67eacca9af1e3c85b49621

SHA256
178d698887da887fc2f1b6b64859f9ae85959419734098559ef02d8a3794762f

SHA512
69e1c42ef3b25f2a0e8fde2bc22586d13aa871c7c973e40378dcbf4c276ed00499ca9771a4fc1d52f3ed12bf94d71bf4d19fe3ee4604ce8fd30f0fff7f8313e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba18e1f1fcd31fdbd79f28f1d30a27db

SHA1
2dd14dcf9ff731b438a3890d268097078a686da5

SHA256
8480fd7f2c721ff004f15c286bd6324d65d95200f8fd93f56edebfec16073283

SHA512
bc4c1c17f870f2eb1db60c670c547675dff875deead8dedaff4a53449030fe744e6cb01fe88212fd2612f1d718e22d5001ddb6300097a4ecee9c96cd2e0c079b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5022afcf4b5238271448e9c31b40081b

SHA1
351a0f8778198d3f271b56b26b218fbb85d257d4

SHA256
e905af4fa5bf04b478673f2e1e107970d8fdee93d5d7595eed041e05dc8c54b1

SHA512
2e77cc320eb34b594acac70d5438276218acc1debac3a7636840104c53e8fedc6eb58c5e9c3d73aeec44c382a3820a847783117fd127336ebe5fa355a47be3db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ea2b63b9da08b1d43664e29db648a9c

SHA1
400d358f656f2838b1e956171b69e408ac60173c

SHA256
944e2901f1fa789f7e6de6ff7f7683e66f551ff27be4b53ee538c2b02895df04

SHA512
4d4d918f65a816242f64f9017566443d761397314afcf5bfbf4554183bb4f9a980749d30a69538ea3e7d49d8ee62f0653c2af12567f8396c2049be86c4712871

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5241a6582ec01b9db55031f7b8588415

SHA1
a7018061d80048e30232789f5973e582e70e5cc4

SHA256
78f6e6b6e6420b064d6c5aaf2f32e96de56c1cc5456a5dabdb9bbb7143dde7d0

SHA512
86f627525494cb354910e0195d1ba5d5c00aee6b32b0c3ba121d5b2fe6dbd388d1a413e4d348a6d25bb7c0186792bbf375b3a4a094a27a0411c27a663ea80f36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8a58af724ee9bb418a18f9b3165dd3a

SHA1
ba5c79b5ce827ea8e8f81cdb78894546d62a42ac

SHA256
d0fb87c28758083693114aa7df642846bd3ff8e25a4e779457d01d0365090eb7

SHA512
f0a1b810537ef2f7070726f059c2f8e6bf5451386b50607cce98ff97695f5d4e9e5fbb8cc39504a35277236ffe61ed85e56cb58f03467e2fb40cbce7a34d2ccf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2982.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2A94.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit