a9c245528718c7589c479f3f8e3dbeab711658c057e987d253acb26b583f777f

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6945d9c68242f10a3184b0e7141ca1b2_JaffaCakes118.html
Size

18KB
MD5

6945d9c68242f10a3184b0e7141ca1b2
SHA1

a790c12d09e16a4a3844784eeb6f99ab1f488ef8
SHA256

a9c245528718c7589c479f3f8e3dbeab711658c057e987d253acb26b583f777f
SHA512

6311797df9d8bb90e245a0f36831a8a797a4439ed50b9022c31241a9e795f5c97d0714e641dec41e2db61a0e2b6c8258840c46fe897fb8f9e0c9771b4cd67860
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAIG4AzUnjBhM282qDB8:SIMd0I5nO9HXsvM1xDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422589251"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0026A821-18A3-11EF-9AB8-560090747152} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2824 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2824 iexplore.exe
2824 iexplore.exe
1336 IEXPLORE.EXE
1336 IEXPLORE.EXE
1336 IEXPLORE.EXE
1336 IEXPLORE.EXE

pid	process
2824	iexplore.exe

pid	process
2824	iexplore.exe
2824	iexplore.exe
1336	IEXPLORE.EXE
1336	IEXPLORE.EXE
1336	IEXPLORE.EXE
1336	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2824 wrote to memory of 1336	2824	iexplore.exe	IEXPLORE.EXE
PID 2824 wrote to memory of 1336	2824	iexplore.exe	IEXPLORE.EXE
PID 2824 wrote to memory of 1336	2824	iexplore.exe	IEXPLORE.EXE
PID 2824 wrote to memory of 1336	2824	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6945d9c68242f10a3184b0e7141ca1b2_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2824

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2824 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6a62add744632f431572d227e838248

SHA1
568ff79ca2f9b2856fe75a586ded5e437c42f4d8

SHA256
238a806b8af0dcc2887d97d5e88e00b4c92c377a973d880d3dae969857514cd3

SHA512
ca3a080fb4f4afab134f510d833e7ee6b67cc5385d9b68eabcefa789ead9965fac4c126ef5ab95bec209c513cb760b49b34f832ea1b4d6d00acdecdae884502c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6cb30cc23cf357eba6861ea1d1db1fc8

SHA1
e1b5fe10b7e2f67ecfd6ad7dec17dc4170b549ca

SHA256
22b209a0f609f910713beedd200a1c8aa6f1daa4ddb6fdb9d1c2df82b8de8b4a

SHA512
50b16a9bd67ec697214304bde04a32e95467541cc5baead4e4caf1788b12835538a87d308af676c064f58d64ba603624bb465fa19a484f940f50e193ff2b4634

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d516c905b27a1da61db60ae1805eef7c

SHA1
6d42cce6347cad709cbd54e2a34b75c99770b395

SHA256
e7e32d76f98a77bf462a58a58cfae38bb53de2086936a4166a9089e79b4e1e4b

SHA512
9d1db7d6d2b80507cf05b6c633bf3c01e5189b724af3acd99e3cab746657dc67a40cf90d0509d18169448a0c395c850e3e1fa586d73dcc1ff4fb01779f4cf29d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
09377e29387a70bf509bb109e0e41765

SHA1
6bee7e08d6039b6ec23aaa4bcaf59d5e2e22aa93

SHA256
c11fd02b4c33396cc54ba9bfb5808bb705a8d3974cbcc0bb4a0eac6b980a8a3b

SHA512
3ff3d85d60e0b509d9da2cdb1ed2ad1b749a16420c2c7da55fcd7749e96e563ea1b3afb2985a154519dc0e95d6e0f62ec6726ae394c76ff900da710e0211ebea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d66eed9903f45df5e9958db5f8fa58e

SHA1
f7ffe815401033dca1e7b25a614105a9aa46bd51

SHA256
d776f066fd0b23d2f60cd12dd082179fc473c99847feabb6d35bed9b4c539ddc

SHA512
07b843bda9a4082accdb58b10acf3a94912abebaa93decea94bd832875711e27d6e7a3aacb73e769a97d35b385d4ccd60cc97b660d474d6d9f93fe454688b41a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a762158ce429180e6df77a4a1108962

SHA1
800bdf71a6c73af5d6f9f8f2f95cb0d5268720d9

SHA256
dbb75c80c5b9b2bed90a526bea3855d6dda5aa4b9b07d239aa3f2f5c273a9f28

SHA512
85cfc451fb26306661c59d3538123aa840756477c60be3efd8b3339154039b9387e4d90c2649b29b822eab07bc11a4819aa7894a08916b0ca25c0a549ca0b457

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4bd5dfb7bc77f0215060108b6726c50f

SHA1
e372726f08472292c129370af7fdb9149fcfa139

SHA256
3531c65c8fb454f4d2b8b14cc8bd1acd05a058cb6380a1c091ea0cd607c4c170

SHA512
cd9011c888da3acb0062518f007a4fdcb755a5377274c5a1946a3b50a335312784a75efd9812fbe0f929b31b1df13a7d2afa79f451ad447451ce72040bff6dfc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1884638c7e0719cba596b89a0189d44b

SHA1
be88961e05596c27fc1c2fc19e82ffa51ab9ef35

SHA256
189abf5f59a11f20c2f5364950e4e80097782c56ffdc764d5b4a1b112692d557

SHA512
83b6819fcc933a728cfa8fc6308c42f44c9ac37027556179ff7df0c64eb6d5c6b6f3fa16d0c7a1d7b59a21600284ac28226073aa853feb93395fd8ffac7c2bf6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51129b8f8dcf760a7f98eb876e4f8432

SHA1
d287941baaaf00f1286dad8f411637bdd689f0c1

SHA256
1771c3ff5e64753ab95b35f047cbeaa1878ea5f155386371157773e4c20f099d

SHA512
8c84df2d56def1a3d1a1c1cba7f54e75d7f3d280a16de7ee3fcc5e93766a2a6e468716e78d0db96f6076190286da0779b757c3d081b152cb195b496fc932d1a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1057.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1149.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit