6df867e7e205ea4431bc2904cbe23079c3d4f8e01fa9124b4d2906fb73f13833

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 00:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

691e3aadb41ca1658146f33129034b86_JaffaCakes118.html
Size

19KB
MD5

691e3aadb41ca1658146f33129034b86
SHA1

92dcac7b293c002b5d175a033a1e943464d9e87e
SHA256

6df867e7e205ea4431bc2904cbe23079c3d4f8e01fa9124b4d2906fb73f13833
SHA512

cd39f7104b405286c6370d42830758909d7ef5df9e90c23866e2bcbd2833d49d745fa3f1e3c91a08ca6d5fafbc8c3e5e9244bbd9603749bc8e5647bea669006c
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAI74RzUnjBhD182qDB8:SIMd0I5nvHFsvDOxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0B31D4A1-189A-11EF-A3B3-6A83D32C515E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422585404"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2276 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2276 iexplore.exe
2276 iexplore.exe
2120 IEXPLORE.EXE
2120 IEXPLORE.EXE
2120 IEXPLORE.EXE
2120 IEXPLORE.EXE

pid	process
2276	iexplore.exe

pid	process
2276	iexplore.exe
2276	iexplore.exe
2120	IEXPLORE.EXE
2120	IEXPLORE.EXE
2120	IEXPLORE.EXE
2120	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2276 wrote to memory of 2120	2276	iexplore.exe	IEXPLORE.EXE
PID 2276 wrote to memory of 2120	2276	iexplore.exe	IEXPLORE.EXE
PID 2276 wrote to memory of 2120	2276	iexplore.exe	IEXPLORE.EXE
PID 2276 wrote to memory of 2120	2276	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\691e3aadb41ca1658146f33129034b86_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2276

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2276 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a995551aff7a1dd355377812a8b9edc4

SHA1
15cf347c2b0161e93be1bbc86a6f77aa3aeaf4c8

SHA256
80e9114c77da648b8084dda079eeb12ac91e9ff94d89074eb4f3fd55408c7d65

SHA512
010984058eb24ab157d9a7c050f67b747da004bec81908d6f9a7b4f7125320a70c51b35dcec4a9ffacf3be26083603a7c5153faf7646ced3e7bb7729901720da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4e0fb5cc188ea7257c9bf42404c6a38

SHA1
5f9b9732ce0c76fde5ccc6d569204b0dbb4105f9

SHA256
8b5bc69a2c16d8fbc732c6021ccc4fa036da28dd09161438451daaa7e8d4da10

SHA512
cb8a5a679669b130a2188d536700cff20201479278861ab2fcb9a3be2d3cc094ecfdeba859153e70be0749d8174c9dff4a9cd31f4371030ffe1313145fac1ed2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef856e86ed766868467628a1a59e83e1

SHA1
5a9df5fa26b00b8061d80bb61dbf9f5a87433d8e

SHA256
4a317de5ac4f7b331b1a952ccac406a73f05c887c3c6d4cdd031d8526823a0fc

SHA512
c9a7dd277513cf2b22fcae7cfae0859be303c52534ad18ec4a4f2d889cdd7ab5cefc0b21011173fe9df6d85204798d74699fb54e13e43315c622889d6059aec5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
11d227165b538a299b2efb3ebbe8f1fc

SHA1
ddfa492d33de16f3baf604c90de52876720b82c6

SHA256
e9cad4fd1e86243a671a1ba45b0df0db4f4e3630e2d8dadbf58831322ed2836d

SHA512
05f359e899f9ad8384f52fcbb7005498053050a6c3b9685d71fde99b63785909bda83a592dd39a50ff5299b5ecc62f5bd059308a84af60ebe6dfea77e2ace3b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b57b834bc67025cb24e5e7beda92c62

SHA1
dffe693e6f165d6a1cd0358aaa2d26d3572ca0c3

SHA256
773a8853312257aabeea9d7b47eb806d6e45d6d39c01568506a538165ff4acbf

SHA512
2a94b2583bfb5b53c184763681cc7a5033ce440b726dcde9b27f91b23505ca0b57dbdfc9c1e573fb736a2e84f085cdcc9dd0279b448b7b5e689cac2bcda82f40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
caddc8d1c6e43ca07c6236de946d2d26

SHA1
0dec49ddda18826bb079da0c3333364bef00393d

SHA256
805745c84b965582f8531d66e01f2fd071dcbe6841c604136066d123969af2c0

SHA512
85ce1d2ecd2f1fd391e131704185ecd1d5d264c968561ad370eeeca57b236feca88c8c31e60b8f3b186de723f284888026a4c248c1571e080caa08c117efe90f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b9ebaf5bbeae058ddcfe5dd1a702a52

SHA1
ba7a6b53b58287f7b1e3db0b718d393918c96994

SHA256
6c6dee154bd10c07d48c7b18726605e1aece791881e917d8b5764288485d3dfe

SHA512
4ee499676e4741f56ca534d5ae951f393909ab759955f9ed2e9312b6d337671cd41b7dd92511ddf086aca08d732ac4412a796eec2fa9e73dcae4f081d9678c08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46b1ac6331e7386abdc3ccc218044fbd

SHA1
15ae5ffab3d4cf10c0219cbeef43935fa099169c

SHA256
c56b8248f09ed53378978e02d49f28c33d8aefbfecf956a0a3a1307c309818e2

SHA512
e4c8954b51a43287ce1be9c2825b369d31fd90ea71b057d259220d76c16c54e9fae52c3730646119f643e70e30de5977b5ebe1d0bf115ceef62423f4986c77a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
307dac0a58df7949660bc4d4d8bfde9f

SHA1
9e4ed7f508da457f9c1ff8d9db07d50bc923af29

SHA256
f1769cf85f1d2e3c06a491a39c0f08fc79b340b7e6155ea1c337195e4be54b10

SHA512
bde0dcf2758170009bb90c0549b4e804133c92d6829ad5f2a59f66b6e85fe619101210951d854af9fa773f0f8f2f1f3c532345aa23189e51c64e00ece88ada62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
724bea91faee33310f0f565e0f6e25b3

SHA1
b574c02781115763d864f181f880c972e51f5a27

SHA256
7447870935bc5fa830cb0334963dded6848d792c502c9d7f181cabe5bb031540

SHA512
079c38a2280fc8c424b0d61f9c144658c440ac07497ee28ca580cbec039c2955381071acea38257746fcb845255996a78822d98fa00a6054b93cd20be8930f8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1A93.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1B76.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit