aedc3f1c7f5a70c470f1272ea9a438d6fffc70bfb3c40f0e9e45c514c8c153ad

Analysis

max time kernel
148s
max time network
147s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 02:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69717de455a7f11a9cf930e1b65eeb07_JaffaCakes118.html
Size

18KB
MD5

69717de455a7f11a9cf930e1b65eeb07
SHA1

975b0886f0144c6b92ea4fc0e7006e89bebb0398
SHA256

aedc3f1c7f5a70c470f1272ea9a438d6fffc70bfb3c40f0e9e45c514c8c153ad
SHA512

6579f6baff5eca35ecfb9e6d705ca73817a8ea244e77c7fbe4adf8a67cd3d8ed00f4511df11f281d4ddb771a7ad83e1a94af19f752c13267bab1a5f527315160
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIw48zUnjBhMm82qDB8:SIMd0I5nvHJsvMlxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422592998"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B98CD701-18AB-11EF-8004-DAAF2542C58D} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1340 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1340 iexplore.exe
1340 iexplore.exe
2260 IEXPLORE.EXE
2260 IEXPLORE.EXE
2260 IEXPLORE.EXE
2260 IEXPLORE.EXE

pid	process
1340	iexplore.exe

pid	process
1340	iexplore.exe
1340	iexplore.exe
2260	IEXPLORE.EXE
2260	IEXPLORE.EXE
2260	IEXPLORE.EXE
2260	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1340 wrote to memory of 2260	1340	iexplore.exe	IEXPLORE.EXE
PID 1340 wrote to memory of 2260	1340	iexplore.exe	IEXPLORE.EXE
PID 1340 wrote to memory of 2260	1340	iexplore.exe	IEXPLORE.EXE
PID 1340 wrote to memory of 2260	1340	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\69717de455a7f11a9cf930e1b65eeb07_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1340 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2018ee483e9730e4d7721ae197da99b

SHA1
a986ab7a595ea88736116db5f81c454e68ca16da

SHA256
cfe8c4ec76ffe120cbd6c6d9f4a6fb5661563afccc0fcc0ef61836a7bc63bbdd

SHA512
043d278a785cec4c6d378c01c281e71cc08dc4ae9650a96e39e9f658f13cf441e738b04ed7bea6db76060817424b5145a5ae5860ba6df7e71f06e19d58964d52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a548a3ce82a7c19c3b153d753e33b396

SHA1
1d1a11cb86fb874940e98af60d58f8b03e59fb44

SHA256
e259abe13004b7ec4a4daabf065d68d04855f6196f05c5790c96c9beb4494a5a

SHA512
d12bdf98204e67de7c163c24944dedaa7dc8d8bfa1daf534126f3c3e38050dda46ed18de703ff63036fe07880f18cef6b757333e55ad9ca263c7cdab0c0c86ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
79562201bdaca1b21c454dfbe0daf381

SHA1
2bff828bfe8a95251a6815a74c4fc8e63da9d311

SHA256
f579d00541e93b24f610b1673daeee83862fb4b44dd3debff05a862ab971ef25

SHA512
8d645c8c8bd606fc36ae0e0977c26d1bf0ef6a8db7a315cfa436f8a23cdce0f3c645329515b4ef6ede980fdd15d430f171979f7c937022297383bfbe2afca7ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
98541e65344d5838b9400b34dd5e8ff2

SHA1
6077c56aca24b35cc342cdc322cf6994561f683b

SHA256
f32d525661520fa83076000a7dadd51ce6a86537de3b26a0dc60f61e37ee56b6

SHA512
53876af76368450dfa0b1c3a7b7af8449832a55e46b662cf764f435d48cd8472e159251888b33831cc49df486e70e6d0a282c1856a726c9de1facdd9d5223f09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19b3ddf8bed9a6ab6b14d22c95f11d41

SHA1
fe7ae0f6dc265cf0688e5876ab7370cb9bbb89f3

SHA256
c1e2d8895d8f762728950b9d01a993430051bdaa1ffe5804ee46327d431235ff

SHA512
3ac8335e7a509e1eb80a8ddacd2abeff978525671bd8eee44a9251dd6b704f052d3e63d49185d33db370de469390148f5533f829bad5a39e5cb3111522065ec9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7173e23d5dfba6a0be1a718283fb6a15

SHA1
66114cd1561c7ff30d060cc5196ba6564b333483

SHA256
314ac11bbab7b25dad610332b299aba3581a34b6d4384cad479518ab65868025

SHA512
80327eda306445b570d57cddb0b8e0492652eec324b2df7ce8e8ddd3f8d04ef9257c37cb35745c03df04c28d73cc56e27cfc850dcb677ddfd2b3ad7be0d0fc5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
29f168ee4bc1092da3a2f79adf7c26f7

SHA1
0910306a1b426cbf77aea8b56d305a9d7cef38a4

SHA256
7651b4631bd0879599a1ed064e05ee42e87bbb68acf51cb651c8d7cfe8dbc999

SHA512
5e7c0379f7e3044c197665232f5e712682bab9b1b237b9ae6e0d0cf676b8949b59693bb450cf14a4d0b23f61adc9f63b914c7ef259a833dc1ebb11b21be356f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be98eeb0d232c1b6b2d4732a534719da

SHA1
e8185aeab90f0e86af8294e8e5338a31327475b5

SHA256
9237a2f8035cf6d40d066147b87e43e4c71432a404e82acfac55eca0e37d55f0

SHA512
620b04f5c32435154ee97d744ea1470c96834823e9eaf966442ac9cf141ac99ead30dfcf924c1337df84f61fd7a5f30322861f022c5841e5b3867afe540e495b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
45e446e64d93914b593bd843a4f7eecd

SHA1
a0e92007f0ca4964c90345853b4cca852a8965d2

SHA256
d75f17733133350d7717b4a20ce615cdeefb82c25b0e4a94b68232c149cd479f

SHA512
2dd24b86b93152e10d37be51882d0118d12a5d1076571f889d9d29f7c5807204460ccbff66d165a60e5687c542c01062d77b8b5cabe284f0d2a7ce1a69efc1f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBE3.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC36.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit