816d4df92f0432a82a121fc77df6a94ce62baca41bf9b802fd3233db518bcd0d

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 23:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69042dc4dec1e969c522aaca4c521c7c_JaffaCakes118.html
Size

460KB
MD5

69042dc4dec1e969c522aaca4c521c7c
SHA1

4852771866c1da0089e7ed471320d3aafe89825e
SHA256

816d4df92f0432a82a121fc77df6a94ce62baca41bf9b802fd3233db518bcd0d
SHA512

b288e769c73acb3fa376c6e9b029321ae753f50d74bcbe8c211b119ccac24106606329daa39d6fa84a4bbcc5309a3271501e72ebffe9d6788d747761912045c7
SSDEEP

6144:SbsMYod+X3oI+YYQhsMYod+X3oI+YVsMYod+X3oI+YLsMYod+X3oI+YQ:65d+X3z5d+X3r5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{09FCCE61-1894-11EF-9F9F-D600F8F2BB08} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422582825"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000015c71d622f3f34993c9ed19790b842bd00e2ddacb83e62f8a14c4baf25bd2493000000000e8000000002000020000000e65923c01114d67797d1ed6277a16230fd3af3fbf09311fb75fcf99bcdee021f90000000bc0eaff5cb3d6c62ada8d0c0488f0a377e000a8566c6189a9632572d4c2ed196f9b4e796ebc7bf8dcd0c1f329a4b0b0f6c6d133de1d5315a1ea099e304992f3a66726c4548cb91f94051f7cb1e76c1da5d874eb86f0ab0e6c232aa5b727037926caeb20e6fc75eeb953c068caa62635dce19fca4033333990d598e1e837aa59594e28ad9c60839ab1f2f90fda19fda6a4000000050798ffe235cb75b44ed9ef37adb2d42af5ef03cab44a9ad8ce3d7edde996bb9c9b65ee13ab31f34ba50774d8920faf12c0a326c70468439d3bc23768d58e06c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000e93c7f4935a6e0739e818858ff4179e2122eb38098aa640b00a4535e6365f026000000000e8000000002000020000000c4131d27e1544540ca3f311cefec686cddab44c3e786573cc4af95ee1cb0d62c200000006fb2b88aa72df09cdf0d7a5bc63d39932fd97e99b09cb30515aeca5a5eafd6b7400000002021972d1d23fdc244ae7f7458994f046abaaec2e635fe45cc128cf65bd4aa168fc201f6cb985da6c4ed1c1c589c180ea8e3dfaf3ef3c3897e3769a6a0c2c9e2	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 105e94e2a0acda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2424 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2424 iexplore.exe
2424 iexplore.exe
3056 IEXPLORE.EXE
3056 IEXPLORE.EXE
3056 IEXPLORE.EXE
3056 IEXPLORE.EXE

pid	process
2424	iexplore.exe

pid	process
2424	iexplore.exe
2424	iexplore.exe
3056	IEXPLORE.EXE
3056	IEXPLORE.EXE
3056	IEXPLORE.EXE
3056	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2424 wrote to memory of 3056	2424	iexplore.exe	IEXPLORE.EXE
PID 2424 wrote to memory of 3056	2424	iexplore.exe	IEXPLORE.EXE
PID 2424 wrote to memory of 3056	2424	iexplore.exe	IEXPLORE.EXE
PID 2424 wrote to memory of 3056	2424	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\69042dc4dec1e969c522aaca4c521c7c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2424

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2424 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c3e333d920b9e21bc8bc9c3c271b576

SHA1
2aaefa9442f7f0867f5907eaa7f32aaeb296646b

SHA256
b2ed27b3ce276fa4d74fb38d54391439485be0ec8d546dc9e0e1691cea51122a

SHA512
626a4114d537dcb3b01250f94b799873c052c14da3cc9af3cf90a14e17d8d98a4c4a02fb3a5f89dc3af62bb1647f1f1fa43955665521622475d13aacc49cd985

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8afdf4fc0640efe3aa19c3d81780c92a

SHA1
c11abccc33081f87cd5ab2c450534e3eb3e68994

SHA256
e1529b470a228857873f172fa5ff825d2c9ccfcec4556d786dffe7335b3e21dd

SHA512
f8b9b84d1d20fa45a3abf713e7aaa3c8407238a03876132991e9b3c67d57fe3324d5765a1975f5df3a914e2ac85bb4b5d6461f8def42ea439a9f58192a24f5ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
189b49e087121810d73b9d1c57b6f00f

SHA1
0a9fd1016a8366d23b68c1ab9751c5338009fe02

SHA256
bf717046a44e032e8eb022eb976d22def637ca605d2be3219a5ad999334f7616

SHA512
f0eb5c4eace9577f31eb3446afac7f4607ba7e6df1cacf9fc5e72917615ddf831d0e46b03572761e9d0a01c90966c6e4a721d6eeb2679b7c75115466b647503e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4aaff359c61d49c2a4ca5ce78d23a34

SHA1
c61c438a2010e81d48594f4170e5849310f23794

SHA256
cb8537d6bae9f778f0e6d6775d153a7d5ae39db0d52460dc87184baa49e81d09

SHA512
6d086b5e6b904e1de5ea230635b15353786e788c5a335d1efa94a55033101253d0cacb6d8bd68c75dc342a766181c5e0dd33f796ca2fede40363b8d047fcc7b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b989db3fd347a85a85b6b221881f0c9

SHA1
0abd48e708e14bd7b6725116055a75313a8780cb

SHA256
1a2b72566639e2951ae32519e492036ce383fae2e671ca9d746ce6783da8190a

SHA512
60bca1800708638e40cef3b699a3c5a7726f964b2ac2e1a42cc1bcf2dbe90f76c989f9dc0aa883e1bac3dd1b9c5887cbf2afc37f64b1aeecaac71f80cf981b30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd69f6b5595a0648eb5ad2600a0f9c62

SHA1
eb4f0d61f6fd2c8742771ea3c1adec84c0f0669b

SHA256
055c180ea7b0fd48b131251eff774bd0ccc558d90c5a91a667e630bebb70ea92

SHA512
43001937716d386c0d1328ec6a90e5d45a8aed751d5579d47eb1fa7d7558efbdbc1f67bd6e08621be227465ac849cdb428204f5e89cc5867c5cf64a695d3358f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56afe1eb93f55b70218582a4266dd3e5

SHA1
dc32e253078a3ab774107a65a661b892d78fa416

SHA256
63960d667972593b36afea09aa985a20c2c974e1c7340bfe68df61accb34eeb9

SHA512
2e4e3e9f2a2cb9a92ee00e53c62e680f3b158b874d8a915768397dad13cb1c0c9813711bcef769ed31ed9b0d70dc65009c56b24f3bd9ffa559c60e8b0e4a0c8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba6d8fb575d2077e126f673cf920c6aa

SHA1
6640b4ff318c8843061a988ddc17c198a30c964d

SHA256
8e30cc3fb7796e3082608f7bd5695373aa9009d08f6519e778b53f5982e66254

SHA512
37f0c43d5f5d568ed862d65a2c292470412e8c9b56743390b253953d07bba228aa97849b070664d853c535893951267112cac6abc2fae1f6bb7c15852a874030

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a8e5b36af0f2f100f33c2d65bdd9c37

SHA1
c38576277d9791f44467ee199c91a7ec81acf6d5

SHA256
81cd640c6af193b7d63b0f95210f766c161fe9b9ebd24ff43f1ec7546dd30beb

SHA512
2d6ce5ac35306a1ffb99c5efd9c2c2de334bacad669dca89dfa57e73f22ec236c6fc11fec918e321e2d2a0b0e0c98c668d2eaa3561bf5ae15f09782ea0ecde63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f35893d0b7f76b7f21282e66108ea1f

SHA1
d4f31ea57b93246b78b659939f9f2a123265d487

SHA256
111f8cddfd69da35c30416094fd9f13fed8fd93d0d81ac5182f6c49dc70af7e9

SHA512
c835b248aca6335e693fd9c81b4af72025347b6f99997037ac552f9b069fa7e063c9db7d6de65f06e6b01ee449536a3a1abde85799056689565f6eedf0be1a6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4195.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4206.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit