b59f65ac325b46f8f42d99811cf9783fa1575a051fbaf6c297ffdd82623d5fe5

Analysis

max time kernel
149s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 11:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7565c95fd6d70035e2474f866344e9f2_JaffaCakes118.html
Size

25KB
MD5

7565c95fd6d70035e2474f866344e9f2
SHA1

e72fca6afc2ead6786191a29f65c11c994fee95d
SHA256

b59f65ac325b46f8f42d99811cf9783fa1575a051fbaf6c297ffdd82623d5fe5
SHA512

eb76e07865a5073cb436b46ccf9c4e89ac14a3e4c51e1019f2153f5fb4e1ae05a737a139fd935c95f9a0b1d730ad88c0e96e16917cb166375be9e245410b9a99
SSDEEP

768:SUUOd251qleNSeQPeYcep1w2ZFweMFZesFeeOFfejFEe71U51tCM20L:STOd251qleNSeQPeYcep1w2Z+eMresQJ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DDD0BA21-1B56-11EF-9988-CEEE273A2359} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422886407"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2328	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2328	iexplore.exe
2328	iexplore.exe
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 2520	2328	iexplore.exe	28
PID 2328 wrote to memory of 2520	2328	iexplore.exe	28
PID 2328 wrote to memory of 2520	2328	iexplore.exe	28
PID 2328 wrote to memory of 2520	2328	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7565c95fd6d70035e2474f866344e9f2_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2328 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce6ba2b344899c17c6bbcbf09d064078

SHA1
345bea5a3debc83f967837504c4121015cffeee9

SHA256
37d88e2e9890ab0b9e166d1a0e132036a19b2b49c1d7f8a3da54c75e48c63a51

SHA512
ebdb12e75302ced5306467c051ee774fd5c7b3f036e15df049e8850d5cbd02e275b5c662865d91cbf093774174e24e15376b8b5e916804c713c9651f3d0b6e5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a0e43569c27ea4015731bc97bec4152

SHA1
ea8a3acc43a40f0f0d79a3771c51b04e5e2575e3

SHA256
436acc31388c7e817f64f55dac32e5da45dd52004157358d3b5a1466edf6f3fe

SHA512
8920040a1b318fde43282644b78b42b100f076a0bc6c37fda09c4076197232f37facf169fd2c0f7ab52da2f7b788569ba252c57c7f2aa1469d56de26cdf29fc2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d42649badeb435e7f2a7026c55c2bcc0

SHA1
b040bcaec3bc7481fa97173cb882dd585f344dea

SHA256
c2b18b99057cc0e1154fa96315cf0b1778e1fc09cc7aa31b8cfdb9fd8fb49704

SHA512
fe1f52c67b6bd87b40cd04ca6b8adbd9bb90b79076f95647768b761878610354b9d53d89f478d281549da63280c9be6456d97f959cecd477ec47250b07596879

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf85a2b41d241c90efad83548856b17e

SHA1
af60d237fee634871e10bb7690b776f52f539e7d

SHA256
788608ded124e3fbf0bbe7020cfdad1bfb375c0b121e4b0c90d554ca8f54d82c

SHA512
dc84ae166c9841c064759defac845413bc7bd193d7596dab0d59f8394dc8794530bb27f2959b621b185486d1bf619dae55d00308a7f40d6d6cfbc4b8cef4522d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
08f1410566fd0a2fd9016a7bd14a2615

SHA1
4a06a7a82c5ee28f6e927f3bff35d5ad9ba65338

SHA256
f5ade5b49e46b861933a3b0e7daacf98d0ffd4bf3cde88babede338e8712176f

SHA512
a23cac946132a586e81d5e764e87e466d1a331bc6a49231575adc1cc972548f101dba07a71cee120fe27697f64777f00b27f2320606640d42a4c38ecb4c29fab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2162ade2c0fcfd1281e6d74228b6ca76

SHA1
23503aff3fa251af60410c53515a37eca4c829af

SHA256
9ce808a6b0657590ca305f4adde77ff27c595634bb6022a8f692f09c4ff919f2

SHA512
d5391de27abc08e51acd827c333632ba32c0fcff14a0da55e8ce05ac0f73a037a25630d7129bd0276aff9927d2c3e48fe02826ccb991c070d325f7afe13fa0f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
597673a7c024bcefcfefdea8e377d43b

SHA1
e1247f6243235207b2ea17e85cfa9f997a678d32

SHA256
90d8838bc3ef9aa4b28c8542b13d514e7c18227706c582a074c590512fb8525c

SHA512
82b70645f3b3d14a9c7a33747e578a289f771fe83901160934eed60eb43bc7ac398198855b2a62771520059fae3fe674b98397ed019e52cc124d548655a4b2e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c666a886d9fec47d6bc2b1537ffb2be

SHA1
8b8bfd32728812cea33ca516ee1623b54717c821

SHA256
002ef7ad733c9d23cd42765eb351fee774d6ff4edfb2bdebfa7504f7c8f89e8e

SHA512
968497f3d5b2c4f7c570fbdd8d9bd10da5ac4113a22f7c5097d7be0e259fbf0d7610c6260f33eed3ea1ba4ccff7101edc3974a7b901b8d6b1eceaeb2f33b30a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0df375cc80de56c65626a1fd41f7e55

SHA1
0c221e8fad1ccae31a9333913655f9fac0e782ce

SHA256
b4d76dae2997e2e0af2c97e8ff73056de48144dd0e8f005468bc91dec6589f5c

SHA512
7cf19e021bf379f51370242595927d7936a4dd3273628e2074266cb04fa0478142ff2cee8f883475a9e11f2135f27b4705b5e4d096165832b6d93c0fc1cfb7a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab32F4.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3414.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit