41f090e4125dd00a358757a7ba1d011d44fb096f73e9c7655eb4f9e4346f7e11

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 01:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

659340e7dbaaad2e33891edbb6aae601_JaffaCakes118.html
Size

144KB
MD5

659340e7dbaaad2e33891edbb6aae601
SHA1

5d1b74aa158304f264a90ae22912aaa3d71f944c
SHA256

41f090e4125dd00a358757a7ba1d011d44fb096f73e9c7655eb4f9e4346f7e11
SHA512

5ddead7a884b77e5c656fc6a039819ffd7aa0dae9245d0c5200a67ad0f986844db21117ad7ac625281e51df839a1faf4a6e29fafae2a2beb0fd0bdd055095a15
SSDEEP

3072:SIsYFOlwkRFx7dyfkMY+BES09JXAnyrZalI+YQ:SIswOlw0x7osMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422504282"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2B4A1F81-17DD-11EF-9BF1-5630532AF2EE} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

956 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

956 iexplore.exe
956 iexplore.exe
2796 IEXPLORE.EXE
2796 IEXPLORE.EXE
2796 IEXPLORE.EXE
2796 IEXPLORE.EXE

pid	process
956	iexplore.exe

pid	process
956	iexplore.exe
956	iexplore.exe
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 956 wrote to memory of 2796	956	iexplore.exe	IEXPLORE.EXE
PID 956 wrote to memory of 2796	956	iexplore.exe	IEXPLORE.EXE
PID 956 wrote to memory of 2796	956	iexplore.exe	IEXPLORE.EXE
PID 956 wrote to memory of 2796	956	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\659340e7dbaaad2e33891edbb6aae601_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:956

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:956 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b6109a87d2e0f69accde906031189c1

SHA1
f144668465b214044a9cc069f50f9c264f181cf2

SHA256
12b5be1291171c26be15805bd29e9e32038dfef3bba914636d2cb0861c2a0d2b

SHA512
ced600d143bceb7a75e24725bf312228d3416da82487f21faf3b37c547bf47acb802fe5d1019b30ed8f3c075d70b10ccbd5ceece991b10bbe5a497a7f89365b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c7a187ad2e13d3777d269dc1e642b5ab

SHA1
56eca25708dcc50ecc289aaff27618ad9e5e46d2

SHA256
374d81326cc6a50267df03094d3552fc6909dbda332965989d512542eeb8a445

SHA512
9d39961622b66094e19be21b7ad6d628d5cfb28da62afefd563cf870de581dca2aba02e4bb04eeee3524fbb55dc72639e7ba13ea031cbe27ab476eddf6bc2e46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be8f09a9e53f4630668fd6206eb1784a

SHA1
bdb0140d6f77b277a8a389e209cd9643a9c7a123

SHA256
3b6840e66532d6725ad04aa7f179831ce81fba42944faad76943fd8f2d2a46d5

SHA512
1a44446f4dcb922b18511fecd4d01d6d89fdb9b4a5197a208838e232c047b503f42437b84512b0f3c186da7dc7f7aced0d36a436f4c383cef5d75b34ab443e85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8bfe94ab24536845bd653d9f7c0d9f3

SHA1
36b7e8ade92610a07cceebe35ef9457bfee3cf21

SHA256
0817ec4773ce5971900fc197dd71a6877e5d8b0ce023e0f884b094c3e347d40e

SHA512
27561b1821a786a5dc0ab6ac20d1db82c4a5b26a5f46d71d5a43a32ef30f494b006bbc74c0e7082ba95b614255041ba152cdc58d785eccb45a34e7c46fc44738

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
236bcb67e1174ccdbffcf418652c314d

SHA1
0ed63ebde59a0fc8895f9c3ac9702a8a22f5c150

SHA256
72893671c07d5afbbd94e47ba87fb4ac60df5cd29d5d6177ed76ee1a1d9e2b66

SHA512
de9099df17eb0d417d9639b105c38a3acfac906598fae06d5d4f5a665a844d30aa59b87e8a069ae74faee4cdedbe00007cc4ba65360f510c8077fbee2928e90c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36b93d9c812678442e4fdb744374268d

SHA1
6280eb31eb983ede9d53676d6039fe9bbd5e4a6c

SHA256
37b2b2443c49646f544785e5ea086af994dc1b34e5e59a663306fa0d736b6b27

SHA512
a2e845b56ff80a0442817edc9ddfb1a8991cca14c6d07c013b4ca24a190a49b2cf84a6a6820f19bfdd4eecf45d6f3284c9bb3583b3586698fdc38548fa6c6b77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d2848587c6340caa115c189ec1113b5

SHA1
9f6a0d2b2c29a2385a5938aad43c102b0c1924d6

SHA256
dca7c4af114f38ade9af788ecebcf7cd9ca08317ec50123cd6faf87dbfe6188f

SHA512
1baeba8abadc46c2053d6de59bc5847e9e1b1dd9debfb5110681a09629b4795e70d46298bd1b98fd91300f9e6891a252c2eb27184165f0813ed1c7753a313ced

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2fc8909cbf910e60dd314a8054aa72db

SHA1
656c05008aabf2f634a8221865f714c35f953f89

SHA256
dfd76506a3d517978323a12458077a554902611941be3db5db7d9fdd1dfcbdae

SHA512
98fb697790ad87e48c935bddd6eaa0b2920ed6e12210e8339ebbc5aa30e32f278eff53d87ad746c2acee4453e9250e8cb82bfe6d985fe3a3cbc9a445c47419ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce4baf9cc76e79a8fa9da9a4daae4786

SHA1
62e3d40d4ef25b7736728e9e0b5153579b0d96d9

SHA256
d825ccc2d54deff5f9232a7a884eadfecdc3d202b17ec01288b45ee3891e6ff4

SHA512
367898cfd66fff550ef1261c17cea4304d7ca681a043c7ddcfc567cf721634bacabebd5355982cdc2787982353aeb23da1633c41e68ced3687fa38698eb34ca1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab148C.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar14FC.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit