05299a932b20e8bfa6e90c85c137c857b9b33ec8165394352185645e72d4c82c

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 20:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

687f4f59d7d0b3919db4ae763e9dc829_JaffaCakes118.html
Size

18KB
MD5

687f4f59d7d0b3919db4ae763e9dc829
SHA1

a95c93a09a555e9adf56c71fb8f3326a948c270a
SHA256

05299a932b20e8bfa6e90c85c137c857b9b33ec8165394352185645e72d4c82c
SHA512

d4477e4054e2ff9f1bac50da0dfb4cffcab8fee6b52ff2028d44223d4497011fcc145a035509f71890c88d881cf77584fe77d930a87776301ec1a56bfda5a306
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIbn4TzUnjBh5j82qDB8:SIMd0I5nvHpsv5YxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422571093"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B5A905B1-1878-11EF-8A5C-CE787CD1CA6F} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2080 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2080 iexplore.exe
2080 iexplore.exe
2036 IEXPLORE.EXE
2036 IEXPLORE.EXE
2036 IEXPLORE.EXE
2036 IEXPLORE.EXE

pid	process
2080	iexplore.exe

pid	process
2080	iexplore.exe
2080	iexplore.exe
2036	IEXPLORE.EXE
2036	IEXPLORE.EXE
2036	IEXPLORE.EXE
2036	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2080 wrote to memory of 2036	2080	iexplore.exe	IEXPLORE.EXE
PID 2080 wrote to memory of 2036	2080	iexplore.exe	IEXPLORE.EXE
PID 2080 wrote to memory of 2036	2080	iexplore.exe	IEXPLORE.EXE
PID 2080 wrote to memory of 2036	2080	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\687f4f59d7d0b3919db4ae763e9dc829_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2080 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4e768e15cdb5e7453def639d9967520

SHA1
22ddea9228a14279a9091762a9aaafa9e6133c17

SHA256
d53ae027ee9c7f7ba064b47662d6a5b46c5c1448baa8473989158b2d96f8db07

SHA512
a61d4193192e0cb3caca295a7e16c6c52ebfc139f5b0635f9f56746597398c0a34850885c96e484304e1207d4c0723ee1db0d89d6657ddfc7d14f4e215a4248c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ef7fd55aff84eb8fbeb453a08af0745

SHA1
62597189020f0864d58a0dcec688e79407355a14

SHA256
49eae6586059a5cf7c1f6d311f6d52d838666eb69cd73f6fabf2a8356d8f8ec2

SHA512
9e1f7cd11bd81f1c139da616d40be8b7323c879f010feb7df0250e1b7798e581d35a02d8c6de1afdf552a1e2ba1402cd9fb60857b3a6db8a9e21cd30ad0521a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b1ab7e76e653eec9a7971bf2ff5fe864

SHA1
867fcf940a58dd63dd973959f014e59f7f046b2b

SHA256
a9f8c72792105225d8879700d878f0148645dd3700348c0bab3b3ff76a9f2ade

SHA512
89e5435fb2f152f092d29692526861fca5f46c6ab84e659f3fb8a250bb500af56801911ae105717b0065158aa032a5b1b1c59effdf6351fd2599a9d8e1af14b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ec91259347ff27e813bda95df8b8048

SHA1
29eab18d114b67074e51a296a693c8e115a2a043

SHA256
a2406dbb1b1ded343fab121c4695f8940af8c4d39ea2fc6b563847bd9a85f809

SHA512
e0f23557f68e8b91dbb8372c7267e92953bcaaa78511969ec8ce6e9883a8c3f50e4ee4a5ceb3b03b191f61c276702b91712a5bdc65ecb9bb2152bbaeffecb015

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5758dd4d43fe98e810d2871287308a5d

SHA1
4c57aaeae1b9f896f20f993e97dd274459d67115

SHA256
45799928fc3facbba2c885b50b975ffc33c1b0e86850e6605cc54798f59dd21d

SHA512
2fb25ce2b6f4ebeebac5e8330787e6a567e58641a4e122adb5c7299dc799d9b8c3b265e4c45ea4d43d9839d2a9ed25ce01faddd8e66b998668219c26975c5f17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
036d9dc85c85b2323e20d33dbab99c67

SHA1
4a18640b2afc4f543bed56f21eded59a2b50d564

SHA256
7e24f6bd05b1183a7646d822cf823862991c78d083a0b95ef0ce225dc69f6e78

SHA512
de9d611ba4eace3853b06b29e44b99a0e5217bfadd1e66b2b825bcbb71a82d002cdd5d7296657f42c5cf3d8408978851b19cac2186bce43db82679ae595b299c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ecb8ac5e243035cb8746871a943ed2fa

SHA1
a03945aacfa1414fc320a225ee536e79d9afdf86

SHA256
65576c51e887f4315c27b41055c1aa9c895bffacf55f4080d964daf247532862

SHA512
990660cf2cc60fc7f12f5b3bf3864e80b19ac01aff27a13d7b55ff6bb1199c72caacc2c817c83a5b57f0235d32152a299b43caa7dcd85086a09c1b838bc5dfb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91afefc247bbc5a4bc730634d822d2b1

SHA1
ef5027639ce9db802c699295a8a515a8cf73f396

SHA256
094544e44f1071e0b33c1e018e174320251d5c7881823ef7499de7eb15a20ef9

SHA512
a92e2c28d752e04707ef2c550ca1e69d43598d8e8600cb07dc50ed90162937edcf616cb22b366bb8dc50a409581f135822c5a3ec470f02224bdff77b11c9f4da

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab13A2.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1C8A.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1CAE.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit