165f89a407ae912b4bbf10f03304f477d175ee6b57b903c2bf86dd7daa6475c5

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
31/05/2024, 08:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8665dd24bab71e61c0558dd0b194b7ed_JaffaCakes118.html
Size

18KB
MD5

8665dd24bab71e61c0558dd0b194b7ed
SHA1

8d0e7acf43b73b4d710117e06bdce8147ad23488
SHA256

165f89a407ae912b4bbf10f03304f477d175ee6b57b903c2bf86dd7daa6475c5
SHA512

dd752dc3c6ed615cc3530f134e03e1f020520af09c2374524b16585c284307bde20559326303390086f1bd6b2ecd8df3a982222c643d8d3a0775487cb336d284
SSDEEP

384:Bb8FUEKMqU/c3DurBBMUcBLGmP9Di9IE7C7tl+vv3b25uOz2kPW6zAAnJmGvxYQ:2FUnFU/ci9CX9+9IEBv3G9z9PW6zAAnn

Score

6^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3348	1296	WerFault.exe	28

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D44D6EA1-1F28-11EF-B1CF-5A791E92BC44} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423306437"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2148	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2148	iexplore.exe
2148	iexplore.exe
1296	IEXPLORE.EXE
1296	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 1296	2148	iexplore.exe	28
PID 2148 wrote to memory of 1296	2148	iexplore.exe	28
PID 2148 wrote to memory of 1296	2148	iexplore.exe	28
PID 2148 wrote to memory of 1296	2148	iexplore.exe	28
PID 1296 wrote to memory of 3348	1296	IEXPLORE.EXE	30
PID 1296 wrote to memory of 3348	1296	IEXPLORE.EXE	30
PID 1296 wrote to memory of 3348	1296	IEXPLORE.EXE	30
PID 1296 wrote to memory of 3348	1296	IEXPLORE.EXE	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8665dd24bab71e61c0558dd0b194b7ed_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2148 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1296
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1296 -s 5124
    3⤵
    - Program crash
    PID:3348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5a0a1805242d6bc1f083b72ba6271e47

SHA1
be60a3c46c3710d768a9f24891d46baf8a5207f4

SHA256
fa8b3ff0d3982794136f877632e2049a615d7caa58330ad14f3353d6d61cc242

SHA512
d2942ca6076f28125af50e93295673f15610018184904f7bf61c9677c7e839060c496cb4ea802634ba652bc22c4063d63bf75bec6310e656132d7f0ef6cb8e51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
73fd33a0ba061178dc4d9534c6186824

SHA1
56d1cb1c602c55e5878d7e53a8f2a114baa52157

SHA256
c173562043e392961c9ea80e988e27ebfb3fe5f952e28c38fd4cfd86530825a4

SHA512
d9b18a2fb0dc6c42fd25231abe57983aa578889e82b08a565f78037a5290ff18829967c3cf7952ac8bd7332d02a06375f0339c0b4859441017319334421d9dfe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5038d255c8291b36fc8d8cdd15ff3938

SHA1
d8eaac9fa528f2685faabc16862d06cdae052cfe

SHA256
f1d5b51078a8b7048342b06492267dddfad6b87da259fd1bd1a5bce060987693

SHA512
dd38dc3527906c0b7053f99f08da7c0e43e9a242b1ad3d7acfb12fab8c9faba1d494e0c5eea9246d7f0389d88539e4103dbc01c409c6aa99c7315b3319815ba8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
03b0c214f39518279111ff3af9988ee3

SHA1
2ac4a21a8028082e35109f008497db10a65acf0a

SHA256
a9bcc10b59a624f87c6bb54e9bd9c67c24b3a7350889c831814476dbe1073baa

SHA512
1b16db0f3e2f2f9246de155e235bd500e9d4eae39323515aef873810b968dae85a9d82723db0f179fad7f70296584b67f969cafcf2268f2042f9622938e6cabe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
36108bef4e07dba1bc09c29fc39084ca

SHA1
e882861251b17f170547f658838917175a27fea8

SHA256
7e10873662b68b926d32286a1c4ed7619fc00de437b06f78f8f90abe0344eef8

SHA512
8aaef55256d457ab1e6bcbba790dee7be8b02b72e00f77e8fb7c907703e4069075df96a34aeca02811c29993e8ae684e38343f3b8797a3da7ff49b1dabdd00b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
77456d01d2adc5e7b3c50f397c2675ca

SHA1
91062eecacc9f4b774562c67163eeeac2277a3b5

SHA256
06e66701d438104eccc1ec630b523244fa399bf9e907399d09a52f4b66ca9d5d

SHA512
ea24c60be9187c096a2e06dbf259c948102d7a9183bbf793d8f18adab1c94a60e246fe89a64960bbb165a58154a87baf23ae35401dcebdede5ae0d71d5c6aa3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e7e0708616def8d0efbb02d43e5cf3a3

SHA1
d75978fdf28796db7644ccb00735a37706ea982a

SHA256
4f728720ace17c4e93fada5d359b37850b3e24dd2df865ee8057627214c27b6d

SHA512
2dcebb38460267bc9ec2c87aebc14fc752f7e4ffa074ff6257f5bc386ee424dcaf432f2bbbfaa6d21ce27805b53de3e2c08f1e3be38ad9d13951b50a061939ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e224bd07f13cafca0f21e7dd0b7e7747

SHA1
099373eeada341310f0416079dc81799bfd845e4

SHA256
5a5a7f302feafb4812f9425441e10917227a4ba0073eb3fdf3409365ee949e7a

SHA512
d8cae7852e986faa585d9fba9b3e333f87552e243c2b0082870fe5b49b27a5a7b8633aa7f523bd5ff86bfa97363d9b7e0c956271ee6daa533089975906b54179

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fe3d7ea7c04a7e82f9a894bbbfefd82c

SHA1
32e39a6cef4bffce65a7787a497dbd25b82b524b

SHA256
4e9d5cef1d3510e57f34c698ec0006058465203d9066cb756f447dc129eeb29a

SHA512
9b121ac35ad4c4b809823f20838f326c80a79ee1f77884e1f5db747c2a89e445260f4e9dc839474aa906e7b2ddda5931ae79cef8ce6e19ea7580ae0df6298172

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1D72.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1E91.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit