b65bb7f9dbb83ff763041ea337a25f9e9f13765004e81f3f8b624f0c4985f4cb

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
31/05/2024, 08:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

865904553c0ecfd68bdc44bca2f8fe58_JaffaCakes118.html
Size

22KB
MD5

865904553c0ecfd68bdc44bca2f8fe58
SHA1

f70795200db3aee2026a5b035a14b5b1c7edf596
SHA256

b65bb7f9dbb83ff763041ea337a25f9e9f13765004e81f3f8b624f0c4985f4cb
SHA512

8d4c51e0d311e53baf25992de936af63ffeb4b934d93d8d1fa0ff905e0f519771b482cba4c2add9233acd149b1c124341e81885dd6150e76864f3173a059599f
SSDEEP

192:uwflb5ngYVnQjxn5Q/jnQieqNnTnQOkEnt9tnQTbntnQ6v06J4RnQNjMBKqnYnQy:t+Q/Cv06k4iiz

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D6F90E01-1F25-11EF-8C47-FA8378BF1C4A} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423305154"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1928	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1928	iexplore.exe
1928	iexplore.exe
1784	IEXPLORE.EXE
1784	IEXPLORE.EXE
1784	IEXPLORE.EXE
1784	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 1784	1928	iexplore.exe	28
PID 1928 wrote to memory of 1784	1928	iexplore.exe	28
PID 1928 wrote to memory of 1784	1928	iexplore.exe	28
PID 1928 wrote to memory of 1784	1928	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\865904553c0ecfd68bdc44bca2f8fe58_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1928 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a06ee8607b39fbb195a864767656ec37

SHA1
ee22920cfce2b76b11591012bfe63f7555642aab

SHA256
8df3ff3da3cc7e76404348ce13dd0aa49c325c59d5fe802a015377eb231e5077

SHA512
1ded4c287721621198b66a5ae27ed55886ddb9b10c82e3aec7c7d2e6d43470dc9e7ac961b3ad31b10c476fa5a0650356bd165464661c0d857361d74770a8143e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
df0f35183ef00958064b4423a34ca4b5

SHA1
1cbbddba3eef59fe525176ae167efc82a36883fc

SHA256
733541cc14a590ac45e3fe5f231592f79cf9d10cc9051c7b890816bfe47843a3

SHA512
67f4677387776e9bde11f7b7ecd91b14b078fd27851bf2a365e88d2ec356751efecf5ef8edc79a7f29e4f22c30d45227b557c9c0a4172d3918e91791fd07fec2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6c1732b1c9317b32d994fdbf3ffeaeab

SHA1
512e5aa2defa8179cc4832e23155bc7b11243ae1

SHA256
7975d56d31c2e0afc9a6072f9f5e58163e168c7803f2ceccb169a7f24ec02d73

SHA512
c310de3153a0dbddbc6103567836b1f4e731bd9fee67db04985e7c4c46d08dd55bf9fe9cc3326443ecc2657da9142e3cdc4e3f536e1ba1c5de92cf3a1de33173

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
49f376db10cb4c83af85538208482a5e

SHA1
4855ab5dd6c93c161aa83cb7b11a82ce899f94c9

SHA256
82fefa7d47f78287aee208431993009cc072308e1c972f3d7c0c439c88fe8416

SHA512
4de763ae20f840b941045a987d09fd76c9dac29153942b9c729c7bc4ab252b70304dbaa5e3b195203cc813759679d7943d93762b7e003ab5768a6962a8bcc985

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4567618dfd13df08beb023bd9cf58038

SHA1
7ccc9756bc16597e0e5d8aa61d8b03eb83aa4d71

SHA256
c1e5368a3f6823e6ee5e17f65da6ea089bc41c6ab9f2533a92620a23b01ce9f1

SHA512
5b2c8eae2051c111ac3041ceae374838bc2f46c7759b3928f054615811c8846724b2de55b87d72f12f4f02bdfe3cef2c03ae6e3ef1e2db3da0e82345c5e5c434

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e5b2778eb238cc088feaf67b7e4d7d62

SHA1
6fa216da7aa133aa9730abc4df7d64dbee4908c8

SHA256
ed96c3d72165f5ee983766f26dc0e29c97b5d7efc8e0e735321531229acce4cb

SHA512
d0521a369bfb41d8b04785129bf1cc3095aad93606e5c206eac5c107112d190a1160a92703cc4793b2a18723e45175f07cd5728b6898dc7954143b00ad294109

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4f6813856ba9ee7cf1f3fd0e13c1bad4

SHA1
b9ffa83ad9a46b9e9b1cb700fa5aad4a6b53ae2b

SHA256
a848cd8c842bb2d4a34bf42e69aba02559fff4d94ae0147e77a69c08df7467b7

SHA512
938f172a53f239e04dd5dae8f41990e1ea69f91ccbdb63909dbf0498b1801c5517623e305975b14331960af6c7f4f9190bc8dd89062b048316c9e907b6c2e8e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
93255fb69eff47233945367d5aad93e3

SHA1
0bda500089a9e635c13a0ff76f5fd35298ebfa86

SHA256
648bd1046507ca4b56d95e067535134e8b503e57f4b8721712b7860d62d4824c

SHA512
83b51381890482a2ffa49b048f2157d3038b334493c415da39b7284c6d8160f6756da04d79aa1584e82d2541637b50c19b7c4bc270110d50d06f51b650cf44ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
92174712d2f09aee424fb26e5d52167e

SHA1
e4689b0c3bd82ff54c5109d24a212fbc1dbc8543

SHA256
16c8a294c3d9152a922d4f6366ff587d88f0b23640f3a37e876f8e32164a149e

SHA512
431a383b54c47c6160af4f1f2c9b0865e2d39eb171c2993b163372197dc83bd50803808f8946b9476c20f40a75a2cae8aab72e1e4154892a8e3fe0cafc9f26ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab898C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8AEA.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit