510fe9605506327a4cbc55a3f8b5f7fac73395ddbff3eccf7c44ee9107e1592c

Analysis

max time kernel
148s
max time network
147s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 00:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69219d2ce6b4a7aa3f17ccf96714c247_JaffaCakes118.html
Size

27KB
MD5

69219d2ce6b4a7aa3f17ccf96714c247
SHA1

d0899c22839c63a054b0857c3fee3d83bf5c7b2a
SHA256

510fe9605506327a4cbc55a3f8b5f7fac73395ddbff3eccf7c44ee9107e1592c
SHA512

79f2a846dc2c498db628be4766260a8eb7e53d7aad1447a8a59aa5267c106012e6b80b2b67a002f4c9d75a4516b72f920feaa99c36724c35eabf52ba30ff09c0
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIHV4PzUnjBhJD82qDB8:SIMd0I5nvHVsvJ4xDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422585735"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D0725231-189A-11EF-9B89-EA263619F6CB} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2876 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2876 iexplore.exe
2876 iexplore.exe
1992 IEXPLORE.EXE
1992 IEXPLORE.EXE
1992 IEXPLORE.EXE
1992 IEXPLORE.EXE

pid	process
2876	iexplore.exe

pid	process
2876	iexplore.exe
2876	iexplore.exe
1992	IEXPLORE.EXE
1992	IEXPLORE.EXE
1992	IEXPLORE.EXE
1992	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2876 wrote to memory of 1992	2876	iexplore.exe	IEXPLORE.EXE
PID 2876 wrote to memory of 1992	2876	iexplore.exe	IEXPLORE.EXE
PID 2876 wrote to memory of 1992	2876	iexplore.exe	IEXPLORE.EXE
PID 2876 wrote to memory of 1992	2876	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\69219d2ce6b4a7aa3f17ccf96714c247_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2876

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2876 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f4dd06dc0328925b91343a6111d78fe

SHA1
c368479b030c7401904afebfe2ee9446fca090b6

SHA256
5380de007c0083a22d4ff06d5a4d0d47f77fb54e27e2deb8ad401e3186c62c6e

SHA512
47f80dd6d14d086528a57fb3292cccffab6acabb2baac2b68f5f54066015377bcbc0e5ef85aa227df94c9ba996ea9e592ec8be4f5e410307cda2a327cfc26274

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d490dc9bb98f940ab530653ce40faacf

SHA1
bf7d31c9fd271bdfa3e5add9d32ea298d1ca05a2

SHA256
3a87d0ed2b6e086648222dfa0b7d4d5270c4a5ed2fc8625d03582ef5b836838c

SHA512
b1fa63183d257c2cde557b873189bdbff1014bc1744bab6ca9ea0c02b2ca2fdac6f5b347399b8d56645e478fff80c56fe4b34a51028295ad73120015416bba50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
801d9f4631890ace2954521fd3bf5d9d

SHA1
a8e6641ad31e73574fc39ad46daccb45f6ab2706

SHA256
b5e4bfaa1104f01d91f18174d45c89063179e311bf41b826ca81e016b3092cd3

SHA512
9c9d800304640be0772b48f9d07953fe751e2e6466726909d572c9e3d83c7ee4c9ad84eaae170d89ad8aacef4055a062cc410e5e3f418fdabf7cc56710536429

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9dd1f54801be9bc447afe70ffd3cc0c

SHA1
725bcb8cfcb0b4ded56c618eb27918c3211c35aa

SHA256
ae78581cd785da46af892f62083a0ea96fb8dd09dfda0d6517942b1f7810c4cd

SHA512
4d8ef10024c388bc12c0d64ea470d389760203ba122ca212e341796e125835327cb0667b604c58607384cd814b4840532d9d108dc2551ea2a742e04177b68255

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8a40b1f7b35da3058f778131312256b

SHA1
954d6b547968c4bf17b703b1a3c1b06e73da4f24

SHA256
81c98057e742f35ce7046591c98db60b34d562bdc0a91261158d7ed18a59cd46

SHA512
912a9a904518544a99286e1b22f630d7ed4c6ddece9f054e603fa5a03948605b3d35bceba04a703e4382675675c70ee44b7d06265c8b612a838f163419729966

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
573267d0bab07452cbdad99346abfbf1

SHA1
cad82bb2184d7410fe1af2a2541acf5905e61ea5

SHA256
6b915654ec5f991c4972b0d4541c4c877d7705b8309b776d905d26cb95501e59

SHA512
3ee7af614ad232173ba3f5fcff75580a59a7d24b5fbf77a8ce11c14f5a3a97f84c56aec31743e241702bf793e12be06f84bd15a2a94a1746438d2e13cf4075b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
68169729475d1794d4587448a6163e57

SHA1
d4fe9e634dea2f4a5e3edf03c5845e4f9e088ab0

SHA256
a5b20d3370cbde1da8b5b5cd29b67acac67d96d9fa24677a3f648d6cb55ed49b

SHA512
36b120e21e974e866db65b039547cc448f59cde896978ed28ed92416fdd0c084b91cc4b7b586094cacdd884d6fcc0f6ac384c4e0c929178bade90fbc2e70be6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b2ef2151c35ba6bbc9564fd458ae2f17

SHA1
084c82bbfef6df6d0347ad9eedbd8460004a62bd

SHA256
a811aa8376212d4f0e1e0f3c4089317ee5514f3b7c35ccbd99c5a03bfef00a8e

SHA512
9ef20d8691dbfcb9550a63251389932e3003ab3b765c8acad44fd9ca4d7830a15bf83dea08bd0d475d9f0e02b7a59d2acfc916f9ab6f538678fa2ab43aefc3f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1130.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1223.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit