ba9393ec4b68b77bf0172c2777e7ecd6c8c765a72745cb4c8bdf3d8efc1dcfc3

Analysis

max time kernel
149s
max time network
152s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69566efaaa83df0e6f72b4a004421a21_JaffaCakes118.html
Size

18KB
MD5

69566efaaa83df0e6f72b4a004421a21
SHA1

1d833650ad80e62b918df8607da7d38b97688261
SHA256

ba9393ec4b68b77bf0172c2777e7ecd6c8c765a72745cb4c8bdf3d8efc1dcfc3
SHA512

df1f45f882df85511c571c295856b015fe91992658b9217d62794835477078d84b9b9eb93be32f086a85fdc564fd5776abe763c1fec20b103b2b81f7b9886401
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIl4jzUnjBhdn82qDB8:SIMd0I5nvHpsvd8xDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5B88BB61-18A6-11EF-9F01-52C7B7C5B073} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422590694"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2768 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2768 iexplore.exe
2768 iexplore.exe
2892 IEXPLORE.EXE
2892 IEXPLORE.EXE
2892 IEXPLORE.EXE
2892 IEXPLORE.EXE

pid	process
2768	iexplore.exe

pid	process
2768	iexplore.exe
2768	iexplore.exe
2892	IEXPLORE.EXE
2892	IEXPLORE.EXE
2892	IEXPLORE.EXE
2892	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2768 wrote to memory of 2892	2768	iexplore.exe	IEXPLORE.EXE
PID 2768 wrote to memory of 2892	2768	iexplore.exe	IEXPLORE.EXE
PID 2768 wrote to memory of 2892	2768	iexplore.exe	IEXPLORE.EXE
PID 2768 wrote to memory of 2892	2768	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\69566efaaa83df0e6f72b4a004421a21_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2768

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2768 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a605b7827099ba6aea45fd64e1d0523a

SHA1
1b95632484b27b624ed7e81fd44584b31c58c496

SHA256
1c49ce757b17fb4514c197c1807bc0ce9837677b23e55a13f29c67755c717ffa

SHA512
949e12e221e9097a719a264e10e58d339a6f58d69ddf463031f4eb86c8f6d5286200fb6f64542773380ffca25141b2780acd2967dd4a0453443b65dce75d7a48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6b9d811e91a587f201cceabdec9ae48

SHA1
aafec4c820cdc37e67c08a1aa9037a4039b5760d

SHA256
6824e97ac2dd7a53e700c5c599a8ffa8839cdfb30b1dbeb82129384d912c1265

SHA512
29ddb6d9f8794b0e23bdeaf3ff040836b436b212190b9d0d755982797991af974ba9553d2647a4d8542560a2805a2582e17e08199bce6d436e2860762108e47f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a0c33840660a7cc744905ae45cebbfd

SHA1
ddeb29aa6389e9bac5e2ab9c78aa9eeff9e6f2bc

SHA256
7fe22a000f5ff45d3764193ad00298d8a6b0b781e0afe936a486274736fea40c

SHA512
40bb4f272b0882bd8b12c1b238a498563e49a48ac3f69ba9d7e787a182a8ee7bf9923dff8d45f13045659a87d837b44223b38dc44925ae9ce2aab8c51d6d999f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b67078a77233747b70bfa20153127c54

SHA1
5103b02acd63ca5831a6ec194f041cecae937410

SHA256
2650a8c9ae270baf49cba3e2b3388dda00c6993607ac38a730ba853220a64558

SHA512
e1244a73a8e7a6b2ad944e5b6904681aced1472c49952a65a58502485aa92a7a41a434a04ed240a9d6c970618fa48d4ef1c9c3b5e5e5de1ac0818410e14aa2c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27aa4641c3e8f49aa090f865e0e090da

SHA1
59201e80b76fd1331b1ddc2e2242a4d2c909a7b7

SHA256
161d5a96c0bf98a5cad8c9ea7ee3cd875be12e1b5b1aa5315264d79dd9ba5280

SHA512
73f38095348b7ad5b97cbb4cf93fb6009cae05de81cfb9a49c57eae60deff30a41858bbd6d215ac4db3a8885185670465f8cc947f276f419c22f57e93916b608

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5974e0433a5d7ad0d776460bfce8349f

SHA1
1e6aef94cafa214602568471bd7608a48bbc5720

SHA256
8bf3c7802545a3a5707408f8f4059870e4a1d5d86881225d33bb0bd2470a90f8

SHA512
5b89ed833cdd1984ac10f51042daab26f94fd94e24861a444d399ad1cbae0c0ef70631d6aa29e331cffeaff61f32ebf80f6a1182430f71facaae20c4507a8e72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8982500f6cede165b03c53a281629120

SHA1
a92bdcf5e2a17617ff133db2cfabd126415427a7

SHA256
05402b4f4ca81cd4fba17398859b98443a0a2b3e3b8a2337c350a6548300f44d

SHA512
7890b2cd663b378395460fbcab06924a1520a14a9caa4aa6ffe8644612109d42f69122a87f80ffbc273fe47607b580322ceee0a52b8204be512d7bbdffdd3dc8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5de93af6a5f7e6ee5d9045269da7fb99

SHA1
722a94b59cfbdeba571c01fd77c5b1e57184c432

SHA256
63e92cb51a27763d2fdd26645ad99f0cb6ea0dcf254292b948ccef7a1ca599b4

SHA512
e67a4f5634d61b84fc45aa36f610a7222e512aafa8044b1e81e54a44e81ae120032aaa11b41a7d6d78c2646161d7d23d49ccc5d76006781b55a1bb6c671606c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9CDB.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9DDE.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit