4c4bf17e858662cde00a081fb6edf95ac3ed1830ce2d70953ee6c80da0bf8ef8

Analysis

max time kernel
134s
max time network
131s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

693c8585ac7b5e3cbb4097dd95239a8d_JaffaCakes118.html
Size

12KB
MD5

693c8585ac7b5e3cbb4097dd95239a8d
SHA1

a3fec1668961edc37331fa7ce7bebc66153163f5
SHA256

4c4bf17e858662cde00a081fb6edf95ac3ed1830ce2d70953ee6c80da0bf8ef8
SHA512

42182dfbe70d0b426ab97a9dbb7820c5e35ce49cc14b36f165bbab83e6eacf15f93323faaa15e7c4d9600afeee6c1e6785a17c6ff6bf77b7da23ac0b5cbddbb7
SSDEEP

192:FBsv6CGtAlI2IRJq2xgP/ttjihVFDDP3RMJf5Y:TsvAtUI2IRJq2xgP/yP3R2fK

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEiexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ADEA0DB1-18A0-11EF-A8CB-6EAD7206CC74} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422588255"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2220 iexplore.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2220 iexplore.exe
2220 iexplore.exe
2380 IEXPLORE.EXE
2380 IEXPLORE.EXE

pid	process
2220	iexplore.exe

pid	process
2220	iexplore.exe
2220	iexplore.exe
2380	IEXPLORE.EXE
2380	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2220 wrote to memory of 2380	2220	iexplore.exe	IEXPLORE.EXE
PID 2220 wrote to memory of 2380	2220	iexplore.exe	IEXPLORE.EXE
PID 2220 wrote to memory of 2380	2220	iexplore.exe	IEXPLORE.EXE
PID 2220 wrote to memory of 2380	2220	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\693c8585ac7b5e3cbb4097dd95239a8d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2220

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2220 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de678f81d3868d1f5976a9a587e8c47f

SHA1
c4482c929c5908e9f31fa281fa2700233f377a9f

SHA256
b7188f8b41ac59e3793e8ead6911ad066bf0be1e369837abd258af58a34aa475

SHA512
b4c977d840cfeb8007f5dfe1472f1eb98e8270a0dd7d7fea7d71e8deeba2eeabd0a89799321699669f45f5603f010d7666b9aadda350530b3095bd7fa915c722

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b51f88283ca83d31604e8a44e4135093

SHA1
06b755ef2013b93a18884173b8e6e6a22b0eb23b

SHA256
823029b016470d8e89675ee60ff1c3137f4dec8b8d2ba43069935f3cc3873872

SHA512
afd023298625fb7c5019278f5ac1c51eb403079c1df40976f2205872d3168e83869b4faed88dd23f880d1886260905c46ca0c32ca9bd3c4cbd1f788689ed9de4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a426d23486fc2ac5a631e62e6ad97b4

SHA1
cca72532fa70ecd75998f0ee60b1c53d6a676935

SHA256
a52acea7992190de571356dcf2af1253697628a75df4dcf6d5cc826901698311

SHA512
48403fad69053a6bd0605144c542d5d7cbfd6d49e61501809d10386d66662117aa07631c0e9637b338cd71552a60cb618bc41c2b0a7470f4fdd6c9dde7a8cd84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c76d3c2f32ea4008b2a3125faa399331

SHA1
d4f7c14725604c1b913be321349c0b6af9ed4660

SHA256
2c31aa1bacb15fa23f883157ed2f16a2a981e8351c12802be6dffbd75aeec6a8

SHA512
535d4854b2968331cf63d5f400809520cff46b7bb417c7f550fa6bcfb961d85b5116ffd77d8963d432dd5af23104d89bc9f90f7c7dccd73c223eaa8d7b7a0db1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f5c789e44ddb85b5b6d675c4696d1c0f

SHA1
bf83c7d80ede23065a349d5c8f86f9926c07ce1e

SHA256
824d30a999fc20a013248ff84ea209b4b4af4887ba791b6b765860e345e44425

SHA512
eebbea4d1709bf39a176a5294603e8cb0e9f74a7e900ecdc2ba7ab0b44ba863c15cc851ab93c29b771dc2d6139484c69e260ec8125807e23d2a3f4fde4f74201

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da07723dc5fe6917bcf75617dba55a49

SHA1
10a84827cff29df5dddd48545716be6d29366349

SHA256
ef6ccb34527d2c7dc5261f75d7bd8c2b3423b1b7a95f95fa7a7522d247475298

SHA512
905ae101a68c0f0dc257279bc65645efc01a34563619b1261cdcd5495aa8e9cddcd489b5e9eaa5e9b4caab31625e87851a48f83ad89920e2230d6ebc335e5a76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c2e94e6909faca85cbe57e7a9745c0c

SHA1
4112daaad993555100059086ea5e7e33dd8caeca

SHA256
656b9f6b83943df1535afc1ef2cdf9cf09b6b3a7f5bdb23c6036411abebf31dd

SHA512
761ba85ae14f1c0b40a6d01cbdd7714dc69c60384e3706aef080e160e2a3dbee359531283b37ba57a2b27e4504c3fa790fce85d610311a2dcdca2b9331d38b5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b802d5c5cad57ec1e938a31cf0b4b796

SHA1
33743d7f32bec65d279123d67e917cb3b41c0285

SHA256
9149909fe376103e70d09fb3e3a167046d9b4cde21153da79163c8a25d9de0af

SHA512
cd331cf7c43b95b464011d1e3405a4f34e01e14e70c8cf7dfa6caf63db06f4da4d05bf68f65afb5763f0fc7fbcd8d925b8bf6938b30a50dbd4216df6024d8fbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e98de57c45b13eeb4692f06f7586a168

SHA1
e5aee74d13565641dc2a6f774844f0391e325cdd

SHA256
87b23a6f9c5e609e11eebb5f5f083bd77645b71ef59971fab70d8af7079b639e

SHA512
f91c88705a66c7bfe32c941ea1ce32c05410de56de067caefd2a14f98c38df4b14d521a045f084a7e5b04798a9a7111380659076e9dd338b40ed042f71fd1bfe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1CD6.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1DC7.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit