170ff88c640929efc6dc3b6f92430d6bbc7f7861992dd11960de3ccf341baf9b

Analysis

max time kernel
148s
max time network
143s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25-05-2024 08:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7165d97d608e654572f81cadb484e51f_JaffaCakes118.html
Size

19KB
MD5

7165d97d608e654572f81cadb484e51f
SHA1

bce4a1993a02b158db8ebdefcb8f043e556cd60e
SHA256

170ff88c640929efc6dc3b6f92430d6bbc7f7861992dd11960de3ccf341baf9b
SHA512

624c5dfca6ae1b386255700c6cbd5fc6aed81f78436aa06f7e8438d2d00256e12884ef029a20ef0c5b77c838a07cd61cb2ec14ec4c0843ebfba94e8ac65904ba
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAI34tzUnjBhPh82qDB8:SIMd0I5nvH1svPqxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422787859"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6BB6A021-1A71-11EF-9911-62ABD1C114F0} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2024	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2024	iexplore.exe
2024	iexplore.exe
3040	IEXPLORE.EXE
3040	IEXPLORE.EXE
3040	IEXPLORE.EXE
3040	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 3040	2024	iexplore.exe	28
PID 2024 wrote to memory of 3040	2024	iexplore.exe	28
PID 2024 wrote to memory of 3040	2024	iexplore.exe	28
PID 2024 wrote to memory of 3040	2024	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7165d97d608e654572f81cadb484e51f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2024 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
980321bfda7e652a313e461f5a100d70

SHA1
29d119fe02aaa4373bd48a888001f05ed1ad2c32

SHA256
58b9bee7a02ccf45c2884d87710db69848165bd2be3c32bb9723bc4cc2a8421e

SHA512
70d9a690913fdfbd1af6362034b207eefad8581a0773a8a3ef70bc7d7ac91d58ccc5d3a4f78fa3c731b10615b6045eef13dd78dd3b85642bbe5b78aae7e058c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
043641c0653c42c31e18a3a1bb557ec0

SHA1
918978dc9575658774a7f5fd7a45a80f98a07224

SHA256
da916b58191696e836f0130e75e00180df35acaf47e44b4f1ce05750753d4e97

SHA512
42583619644c83d16f389c60dda338ba673b74605bfd8a3b2cce1b2f3cf26fea1dff0be2f16f5a56960fc9007a775a2090f29559a977dd100f694ebd1b8f14f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e5b56d8438f120723f18dba74d95c5e

SHA1
ec884ad90a754edf49faf34ab6a57ba4f0b90c6e

SHA256
0b29ac338512d5de76662ef1362b89ee4e6af48f3202d25c9d7aef54b8c6637d

SHA512
a833f71b9b23daa992da799fa152b5f7de09804ea555225b25ec92a170a49af0f9dffe6fb22270cee6f42e36c4e019945070ff4daefbd125c7765f8cc9a47141

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c7eb58fe34d9835fc595ed0901661a73

SHA1
fdc2bcb1110243d265a78975b2bf274ae1f7818f

SHA256
c76192bbc6eb7dfde8b0e32ec111e28411395e6ae7e66442cc353e95816f8b13

SHA512
c0d519ca96c8ad4f8ec64f048fab77ac99a19a70e43d4cc1d68c755edb2c080c3af7bd65bb9ec291ae2d2db0d1dbf608db979828df1258d1267d4338afb9850b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
abdf85e96400f07bbf415b5a6bc691f4

SHA1
21ebf93ceb9677860a1bed04e342ba8e673f9c56

SHA256
91ff745714172354a15416c80372f763d64cc5293814080946d65489d26470f0

SHA512
ac0a2e5bcb5c1db78773d02488a80f92af955944337460e3cafcbaf3289527ea941c846d34e60c2ddeae610e81928542010cce6369ded6f61446582ba5efe8c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f891797dd42c8d83b950be9f82447d57

SHA1
6c64153fa0e8000c2d12d41e8b56af960baedea2

SHA256
5337ba0c146c508d5340026d4e07cbc960fbc5c9da65b50109f00d3430ea63a8

SHA512
eb075649fe2546e7414e5d568bbe79433756698e04247e617f7a89bc0601362110af18bd52023b597a96b55f88cfeced45d1b552dde9dcc4b6ad91d82f9b9848

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0c2d30dc2ffaa6b2323b57179fc14f8

SHA1
2b4d4ebfa22419c09fb876ec69681bf618fea884

SHA256
d8fe005c70613918189088f890222acaede1304c72e7f47b9324403c421b8baa

SHA512
2c684e1123714aedc9e04e8eccb1783de8025dacd02707f95ea1881244f685d327448e190401e01b020fce9ebbb30bf5e112ec1c3891fcf5fb13e0f24fa639c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a9c2041506d925a27f6b186249fa09ef

SHA1
a3547bd8a6c089e2f19bfd8592f29192626605e8

SHA256
df5992a69a91d43d723c302885c9a519a058c9c10b617295049321e9e1c6a131

SHA512
470cb195f768b3fb2850c45e61aa40ea471e02827a6cab9dd626d63aa4a41dc057f8c7b10d97d471df0a3655a4ab60f2d90fef2ff75086bcb280961def8bc171

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
96e56283430d4ed712994ceb98abe10c

SHA1
c5bd00b64116c003cad028cd41f2be953deb18b8

SHA256
295f1012e94eb3da89f4600f92ebdaff30808dc16b34274adbfc17f875fb8e5b

SHA512
a3b3574431b45476f999629c29ceeb6ac2c2e9ee513310ebe650588b2ffdaf8afa551c2eef04186d62f3b0fb61271c215aafd77b6496cd71b8755710697a3ed9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
189fdb18a0dd4764b0653a66b79721b9

SHA1
228939c7b6f0da4a4caf1df5532cbf4d3b792320

SHA256
c1784ee214542d341810d3df6712587d0b66530937c570ed9f18204a2d6a3933

SHA512
d63db850ab0b5086c0d63c73eecac3b9439ee87a64e5ac87989cd75412f7fc594364e3583c58011314d3fc244f7b15111a183b1783481309916594691b4d947c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
494c8c3a9afae89596c88effc098db5f

SHA1
2108cec4d6f62c421890b7b97818f3ffdc1be1d0

SHA256
19e608d13589a2d8ae74b6b7613267b02058c58c622548b1824a94f065130711

SHA512
b0f442950736e10aab5f3c783c876937f6ec035186fd052bf16ea067e85339c8e1930de4095b2cfc69520a8e6267aae56c96dd6c6da369b83649a58563e01717

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8FB.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit