13feaa524f646a09cebda8925d89d6156cd7d8b7600940693fe1a4caf35b51b5

Analysis

max time kernel
150s
max time network
156s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 14:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63a268cee7c9732d48516844bdfeea5d_JaffaCakes118.html
Size

101KB
MD5

63a268cee7c9732d48516844bdfeea5d
SHA1

4ead693f03c0b923444dd113cc8ea6c51ae05371
SHA256

13feaa524f646a09cebda8925d89d6156cd7d8b7600940693fe1a4caf35b51b5
SHA512

f89053e00c5c281e3bbd879addb685d4445daf2b2c0e2c4ead9c0fe17cf0714989767c11452168d468eefa73bfc035ffb487f3176f2f7d68bf8d607160a4ad1c
SSDEEP

1536:BSG0gTUVTsHwm3WLcwhOR4ElSJRExnuTXSbkKOC7SZccXTLYCUmjq:dT0+p2EHOeme

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEiexplore.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3BD60D41-177F-11EF-B2DC-EA263619F6CB} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422463941"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2904 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2904 iexplore.exe
2904 iexplore.exe
1960 IEXPLORE.EXE
1960 IEXPLORE.EXE
1960 IEXPLORE.EXE
1960 IEXPLORE.EXE

pid	process
2904	iexplore.exe

pid	process
2904	iexplore.exe
2904	iexplore.exe
1960	IEXPLORE.EXE
1960	IEXPLORE.EXE
1960	IEXPLORE.EXE
1960	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2904 wrote to memory of 1960	2904	iexplore.exe	IEXPLORE.EXE
PID 2904 wrote to memory of 1960	2904	iexplore.exe	IEXPLORE.EXE
PID 2904 wrote to memory of 1960	2904	iexplore.exe	IEXPLORE.EXE
PID 2904 wrote to memory of 1960	2904	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\63a268cee7c9732d48516844bdfeea5d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2904

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2904 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1960

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
1a7ff8ac0fabdb1c1274b9e568f75e0c

SHA1
b7774117be05c3e213543bbf94566f3d416589f3

SHA256
00e25802f0908da6b23a841ccd0d0b82df73ccbbab9a80c548c8fd91213544d2

SHA512
0e5a9717666657ede39c986f77efe332c914e2221f12ab04a1bf772f88dae7e00543841b461e9f76ba29f2741f89d19d09ce3be9980485b70fc134e0d8ddd5bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
9381d118b87b582f4876071745dee672

SHA1
bf2926d790a551520861236432c4c2676ad32cce

SHA256
c7e9e8fcd1cdbd2b4aa8b380fc646c1ae9e84b6c0193f3e0204ac2eb66af4661

SHA512
3075e1645200f6badf9f4f808ecaa7c1e3be289dcfef995151fa201250f47988b14a5d62e80c24ba8cd8fd62d43f458698d89213df1b1c390323cefa13009b8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
c48def1e2a66c61f5383fd7a850f6281

SHA1
508f370518801a84197233ed303b7ef931e3627f

SHA256
bbed7cf101dd7bd600380eddc7fac2605e3646325164c1aff625c41bde165048

SHA512
d6bb8e4e510f1592f4b742b6abc543793b3a16c99d5f46d274e5181ed2b899f97a480d0b9dbffd6726fee16ab59da74cb73557ed16f8bbc8b81f7e1f6d5f857f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
0c599b0e440fe45a23de0686b175a90c

SHA1
4456e20c0d3dddbe4251b3fe4eb3bc36ac63acc0

SHA256
891e1ff5881921b04f9deaf79a72c368505bd381baa68f2b018878834338c1c3

SHA512
146b68814e44e3629c40d1114cd06204fe79b362c355779c9ef21a307470c648965b46f581baeb46b38432efe614992167df560e93983941e8619f955e2e97aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
52e4081daa55ec17dd8f8219a15cfd6a

SHA1
d3b96ec0993f19f989b938a731ec86b33040f7e5

SHA256
6062a6ca3fc51d05b103a6d9dcb039e0cda0811f76ced16022da6302ddc08775

SHA512
f877ecbd0e57f0e1d705f43e612f0ec429d1aa3a5e19079c9a6376918a8514f209684595f74b45c70adce7578262438c2efe082d19d12a4ca846aaee1d644143

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
56048d822c6d786a0a51bf5004f2a54a

SHA1
650e817144c5bb7e78f552add5aef5b148d7db1d

SHA256
64409a9d57a20045af9c275d98748561bdcc7d79ad5639c0dcc83fce1aec42cf

SHA512
b827d8232937c4d86a63d8c770d1a72d780a66a5a5767d4c150d8d95acfbff57b06d6014837bf3fb60355e5f2bbe4abd7206c44ed01871ecff3afda959461804

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
aa3450bd58af990e7c983bb29e62caea

SHA1
9dd7abbf262ae795755d52b2e79049c892dbd627

SHA256
49c667e7698a8b0de50ed918fd1ba368befb777a253afdc291384877c32b9808

SHA512
1ecaac40ae89ab5f0b79853a13e3409521d845a51e8f8f1e4998517a6008c9d2b7c5def576caca6a567d51026c85e1e9f2c70504ba30b07230e0cb873e5f2809

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
9ac62d3dbe18d1cd1424af2d200e1378

SHA1
28ce0acc305f2594f7cb0445ba2d413242e659d1

SHA256
ebe9b392b21f49ff46fafddc42cf550defc1f24222d2978866660c5914e0a81d

SHA512
aa8dfe607baa5a151817c71c767988b4d4ae25501624261a2e8835f10f08bb6b5bb7934fff02d78afcbf74462a524ae32285ee0647fd9724261c7945503a96de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
ab24b0a03d5b6c5fbdb6dec8b2bfcfe7

SHA1
70aa0e835f21073367d0cd1007ca8a1ee95bdda9

SHA256
641bdb37576cc5699c263b1101158354d240faaebf4e187bb4d50f5cbb7faea9

SHA512
ddfae9229aad2a45c7f0a275f1baf3220f652d198a075ff1acc41ca5c46ad116a049477449972cd5ec21ec4281067a7a49000f42ccfbf58c529d719b61eba14a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9731.tmp
Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9881.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit