198e39561987dd44f66118b4e60ced6664f431d8cc6990dc1331caf54e167ba7

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 00:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69266cf4e71584a7045cda6e38dccc1c_JaffaCakes118.html
Size

18KB
MD5

69266cf4e71584a7045cda6e38dccc1c
SHA1

ce8737b0cf12f9437b04f407d00b2c96195f5062
SHA256

198e39561987dd44f66118b4e60ced6664f431d8cc6990dc1331caf54e167ba7
SHA512

0ee20976137c8e1ccf0c93dd131016babfdf432e5ed0a560d77598e08bd002a81ececf3164644a12be02cd6c8766885c39a6b718240724195105d6cf977592c2
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAIn4nzUnjBhpT82qDB8:SIMd0I5nO9HxsvpIxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422586155"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CAD2E8C1-189B-11EF-B54F-5EB6CE0B107A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

3064 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

3064 iexplore.exe
3064 iexplore.exe
3044 IEXPLORE.EXE
3044 IEXPLORE.EXE
3044 IEXPLORE.EXE
3044 IEXPLORE.EXE

pid	process
3064	iexplore.exe

pid	process
3064	iexplore.exe
3064	iexplore.exe
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 3064 wrote to memory of 3044	3064	iexplore.exe	IEXPLORE.EXE
PID 3064 wrote to memory of 3044	3064	iexplore.exe	IEXPLORE.EXE
PID 3064 wrote to memory of 3044	3064	iexplore.exe	IEXPLORE.EXE
PID 3064 wrote to memory of 3044	3064	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\69266cf4e71584a7045cda6e38dccc1c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3064

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3064 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3d5444e8272c658758cc192b98e965f

SHA1
3879874409be900fa007ce6ef113cd0a9b25a69d

SHA256
81a45f1c90c603b09b5ff0122dee80d6bf2eca8549cebaab09f8515e0c57b92e

SHA512
4f4ba1f9af0c6172bbf75b77fe4e79d67b257966cd0ad5e41cbc139283f47605da833ce88785dede084f32c2babf944725507e687a40a480ba01a9b9123249df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73b036561ad2cac4cf3465b1601313a4

SHA1
1a13d7a7a58b547d653fce4dc6d84df920a48040

SHA256
d526cafb1aea36be79ed372c15fdf54af5130a9dffe144095abea700be5e6343

SHA512
7f1a4a7826baa29f82f73f3a5c1f062a8b3d60971afd4e79c14d5c6bfdb2941570bde4ced093192449b4585d021cd48637697387015ac207d4b79d0268e03090

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a30fffa3b38bf7c539ac43bbfe0130ac

SHA1
794654915d0698a37934851d8824c31f33cd2fb8

SHA256
429b580aad45b2d1e325b4e885f10f37e8ae3edd529c352318576d5687e6bbf2

SHA512
24862ee661b4b07637d433f3ef306442cab2e1cc28b0bf4b5e830754bc6274db4a9e95d332a3a363d9a6a59397dab57c064e65ed2bbb91d42695525bcf76485e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b1ddfdc54c0ae06704c158c471be5976

SHA1
68d0b862ee60f749fc04467179a18be38ed75271

SHA256
89c0837087a97a5e76fb87731e104b635f19b0961340b3eacdb9ad1948772963

SHA512
1c070d801a92405df40528321fd9f93645b66778db7fc75433012ab5e116018fc946fe93d29da77be0867957333a50377f307e94a77806a2ce5d297c01f1b9fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d11e1d5a06b5485de610ad0a7784fd84

SHA1
c7e6f6ac4e839378244ad21a3212bab77f502bda

SHA256
6e42a60c83770f0f228d85f2e6de1134e4805933d8c69fd14136a6aa27a955a1

SHA512
2429f0ce97dfd3078d01c831d3c0bc28f655d1074aea690eb46ec5d328ed34193ff383aaa29e6752edd3f9ee8452caeabd0e3e1235f7fb7cdbbd7388aa9ab8c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dcfed4cf0e7e7be4062864b564b3ac8b

SHA1
b26a7e5a714f5cbd1e2ff2d34d429254903eb4b5

SHA256
4acb733cf7c0b42c32d8c8ce52ce95c4568c9d568d571dfe0fdf060b091ce891

SHA512
02dd55b7517690926c3f4b5f85588276c2ab1e0892af625bfff3e6e93ce86c94c6ed6c85b1f577da668692fef41a1f5f6601df1bf90050abcea5dfe8811ed650

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c9b16f003915db04c521d0c6cff7739

SHA1
e7ae1fbd6b69d6a7babbd20c0615014580aff610

SHA256
af686b0a476b6f4e63a22225cece59cfe5a0561e2d7f18c1c71a43b64dc693a4

SHA512
633d9478e5b86baadef92bb363e372573c164283b8b31320daec24019bdcba22f4b6ecc9b1cd12de9d1f7a42e326c845c5e9959fc8abd9f0dbc73ebd4c65a2c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02bd7a640d126d9b48d6b0526141c00a

SHA1
009ffed19c07195596fd8bb6e5c48f43ba5a4c9f

SHA256
db512efcb7a1ac99d0a1d910dc98683f2c9a9fc1b350c619e66e97bb107e9a1e

SHA512
72f00b32822643296095b5a4be50b291d50b3f55fe134ae2496e31004e00712507df010e1554d2e261f3e196b345d4b90e812a22a9e4e754f39742226f2fd7e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a900ff267326963ba1692c3c4506bcb1

SHA1
bcc414620cbfb40b49397f6bbc01c6115f7a29c9

SHA256
1a662ac4dc1290ffbae3c4970ebe170553c8bb783fe1ea9af56232b8872a9965

SHA512
60bffab9cf4b13e8fa901f61526c12578ee7238fafa55a2b5d574987e6b5fcee513238d33b462d884dbc7da267351d4f5f4c4b5f0ea2d6635a5c2c01f440c842

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7FC.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8EF.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit