61f851122779fc75eb5baa45342225ce442f945b2847266172aeec768277bf32

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 00:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69349274f47a827cefe152b6114f599b_JaffaCakes118.html
Size

19KB
MD5

69349274f47a827cefe152b6114f599b
SHA1

fcf8bad4e28fa82284e101d73ee7fdd86f2e33c3
SHA256

61f851122779fc75eb5baa45342225ce442f945b2847266172aeec768277bf32
SHA512

efccf9aa016eaceeb10049161aadd2bdc894b8e5e783d915926ce8ae9fe099099f332ddee3b2497d8de23e87abc18776af528915248d86251f71bd3138e2268e
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAI24czUnjBhAq82qDB8:SIMd0I5nO9HbsvApxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422587465"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D8392DA1-189E-11EF-BAE0-E64BF8A7A69F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1612 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1612 iexplore.exe
1612 iexplore.exe
3068 IEXPLORE.EXE
3068 IEXPLORE.EXE
3068 IEXPLORE.EXE
3068 IEXPLORE.EXE

pid	process
1612	iexplore.exe

pid	process
1612	iexplore.exe
1612	iexplore.exe
3068	IEXPLORE.EXE
3068	IEXPLORE.EXE
3068	IEXPLORE.EXE
3068	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1612 wrote to memory of 3068	1612	iexplore.exe	IEXPLORE.EXE
PID 1612 wrote to memory of 3068	1612	iexplore.exe	IEXPLORE.EXE
PID 1612 wrote to memory of 3068	1612	iexplore.exe	IEXPLORE.EXE
PID 1612 wrote to memory of 3068	1612	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\69349274f47a827cefe152b6114f599b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1612

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1612 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3da376f78cea2462aadd789f9c6b6f48

SHA1
d376c05e5301862286da00ccec13f8eaa289328c

SHA256
897e5ddfb03f968f3bfefba6f079e6b4033d917383aa2c86563be79557771651

SHA512
086f86b4c460fcc094cfdc525cb2c602a641e484cca6c6c84017a30f47c7605f1168eb2a78c625fe5a6889a9ddd0d6e28ef591b894b388b9627594378348eaba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
479c4a90ee98072a3d747145ca191f8a

SHA1
11ce9e797a03098f88567c31793ce80069595619

SHA256
f639cbb2605976f4743e3057e8d70f9eb42257d6fc1922cb102f8e52f54676d2

SHA512
5bf6d14d2891ae25903ff27086d6e671216b0729679cd6144a6f2b608a7473ed625ae0a60c6139ad7422119b99bcf66802072a0df3fd95f7b50e834ba5c68145

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
12c7fc6e62fbe03d21a6dbcda07ae0d4

SHA1
998aac6bafe4e4dfea83469f86eb8dd9dcd96201

SHA256
ffd00a03bccab1fe401976b4f38896b2c25e515878f89dd4467302ac03ec2c76

SHA512
ed49f7f4e1b50785979dca5c0bdf193d19065414accd788ec28e112ada66fbbca843fcd1058ac3a29c61fe9a54b3494baa0f0346b81c947257554b1a1335bbad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0fbe22adcb7843ab18f6127637bfb2e2

SHA1
e18afacb1a21bd0b8994d343e2432026c5fb2622

SHA256
0f998c1ff3d8d81779792ceb8b0eedffa62998fc75afcb89ca087121d10fc1a3

SHA512
89b26e8557024155577abdded87a4c86c93b19537203847ea2edbe7dcf5e381c633f8a044b1cbdd55690d96f7a2384ca85704d93fcde28cf1c42aa4c1794d567

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d85f9a996328c499455e0d4f07dbe8f

SHA1
133e00b87bff7848e698d1fd79294540a545692d

SHA256
0ff44e72addfdc49dc1a6648f61c501041b330fd495581583688823f7b9aab55

SHA512
6741afe03e1830fc706053fa9a0b94acdd59795c987ed2df1193bfd0297eb866a130c14704c6b94b524e36510c9218281481770aea5496f202fb8463e49b28de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be48aa1c331c0c7add1d23072101bd99

SHA1
539b06e6be79598abc8c7f8c6a365f92a3ca498a

SHA256
a5866db6430b64a9f2f693d3af21fc704822fafd4cb9d1abfb77d8c0df47a496

SHA512
672b74df561cfc9defc84aae267c41ebdb6d55816e93b6d2470990515f3ef436b8ffc919fdb613144e7dbc2dcd81f7cbdc3639067c75a0d24792755a32425ba6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4028881557c3984974b329829620a3bf

SHA1
888259679ed5cdd050b39d3e783562b811e18f17

SHA256
36668180428e1f25ea6371c6da4e4755dd0b8261871e5efabbc47563d70c89d0

SHA512
1cfa2c3e0d4a0a0e74d862b71afbf91b907589cc080f9b0387483328fec460488c6f7e606142082577c91e6558f82323a69db2dab27240bcac0e3e83bb7cec6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80aaf6b2d88a1e7295d6c488f58a56ff

SHA1
0584c081254f2a77bf8a12c9c4619228bc8db0d2

SHA256
84ae5aad187225cefce399baf4ebb2f7ad297db655e026d38921c470d2d9c2bb

SHA512
67b907966da23a35410aa1268ef11cdb8c7df69418ce34e6b93a61f29f91d25f5493bce25689a9d074714e4ce6b5e2dca15fe8dbb825a0b7ae425715e30cc69d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3a5dd033e4187cc60c64994d0e19b5d

SHA1
86099d73da5543b9b0b23cfa58a95b0a66cfbf88

SHA256
d2ce0ab83b64d3ba172bbdc1ec62559fc5e42b5ee57e82af69843f97b5d4f096

SHA512
b202a89333d2c5ae5f82078ea8b596df6c8f8e8f13861c4dcfd10477e02ed1cba41515a9e03948ea82e86315d051538f5a06cdf8d2c54d98ffa8f52e3f3d96c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab908.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar959.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit