817124b4d16d21ce7264d60e68f81fa6cd1102763ba2020b1dcc92270b698850

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
13-06-2024 23:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a7166ade3810591e7efc29a402aa13a1_JaffaCakes118.html
Size

41KB
MD5

a7166ade3810591e7efc29a402aa13a1
SHA1

c6d4a0f79a37909f563a16e18959c3e72ccca72a
SHA256

817124b4d16d21ce7264d60e68f81fa6cd1102763ba2020b1dcc92270b698850
SHA512

e585d451f995e83e42df66b4e0f01869dd878eb8450cd33b4f37efcf7db15ba83e27014ba3adb7de0722e52a594ae24d670cf04e42a4200f1ee9e74e08dd8349
SSDEEP

192:uwj7b5nldnQjxn5Q/MnQiefNnVnQOkEntkOnQTbnVnQmSjxbw5PkgQllzPfvQsTN:eQ/Woxx1Ys3SrE2lbhUskqD1g

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DB271921-29DB-11EF-9EC9-FEBBC6272832} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424482840"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2240	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2240	iexplore.exe
2240	iexplore.exe
2644	IEXPLORE.EXE
2644	IEXPLORE.EXE
2644	IEXPLORE.EXE
2644	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2644	2240	iexplore.exe	28
PID 2240 wrote to memory of 2644	2240	iexplore.exe	28
PID 2240 wrote to memory of 2644	2240	iexplore.exe	28
PID 2240 wrote to memory of 2644	2240	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a7166ade3810591e7efc29a402aa13a1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2240 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
74e912bd92c59faa313f365747bc05ed

SHA1
c310f6506b98a266e345f7fd8e8eab16ccaa2410

SHA256
aab0abc6f8ad68d99b4c070308ab89686aba48ab95df6fe6fc320fbc8f400a6e

SHA512
03f22068283b08058af2954bec8a96ad2c9bcf4a41dd415ef17ef561830d79d076a78e3fd30bf4dca5044a4d3d195dd4df2b05b9e2ed855aa4b926e0edd792dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7511bb80dac4fb2871ead556f8826da7

SHA1
9c988fc6050f839889afac486b17f735cc2bcd85

SHA256
50127e5509080cd86364655dc990e1bd915fd833713adc2990a15052a8c4500f

SHA512
b75335738a5b8e9a13b72744b9c9066a9d393648e954d0039db8b75d653a886ee68cced18197a203a47b0d6e0b8628dfc10dd13d1cce54991e069fb352e0b573

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
15a6b913f1e295317c64eeaa1b2177e0

SHA1
c740087e35df002f36d2c7105223249613444531

SHA256
1168e97d83c813b6c95c1ba2b09b5e61b7f0081f0cd39dcdf4e298c0d0047709

SHA512
778c18be7ae0c8d684304974137d6e12805b5024c4a40ff2df15b4ed00f5c5adbbae015578d7811d38a240701f8b0a75bbe71835ff9bf285581ffca6b0f57279

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c6ade919c9bae3525c7f407aad15dce8

SHA1
c089ab97caa6d624344885df35b5c1967e521f51

SHA256
6dca84cb7a59e4c698891363b077f45ae4558b575a340f8bdceea2cf018a787a

SHA512
2152a2e41d24af144d03fc5cb03e2bdf0cb8694c6482c2cc1f8bd7ff7a81865cdb51dc10c462cc3e62269436601b6580b956dac7d5f43a71f53c191a43b9f6e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d46ae8281728197bc15b093bb771c7d2

SHA1
4b33ea34447c466701c976c91b2533e7e680f5a4

SHA256
418ea3e563a8353f5016b5bc9ba2264382e3c702af47a92409aff3607a99789d

SHA512
d651e53c99ac24850e4f24eef15964e34760340940d82a4527004781a4405013a5cc835aca9cc780cc0be64a5c0783b37d9c738c93d6404e3444e8c40bc39e79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b88253f2dbabeaa4f76dbd8cced068e4

SHA1
894db8729dc6812d4c7ed1c0d1471a4d24e3a163

SHA256
569edb5130b6389273a81c4301e19df57ce0205f7718f150ad266eb5c7e25517

SHA512
a34e3ff8176123357d81048987b886c920380bf5c6aaedd56f1f58554705f3eeaeba929fcfe6c820316beab48fbfd76ae1da32fadaca9f61cdb9c426e8464736

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
97bd275b97c53a940c43ae97ce5cca96

SHA1
0971226e009f9575f408ba468a98cf14b88fd91b

SHA256
1dc6bd1dd860466dfdaea69bcb893e60e0cd49cf9929c579a98c2085201484d9

SHA512
d33348a1e794e807268490fa619bc473da8b28a53fe51580da22a0dda745902fb2c96f6ae2264625ac2e77c6ff6058a54bfbb1cb14ebf07d9c49a576f3e38419

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a1666fc5a2c654d28cd7ed26a6320d5

SHA1
9c0d35dcded42eeeb14cbc4c8888fcd137f55c4d

SHA256
aaa8bb233bb0363ee17cd423754eac4eff30d8d3a24cfac0fbb47d7f380c3ab7

SHA512
81f06943efab0649932a27e0bc4d2250e484f6c71054cc6a00d630b82d04bbe6921b08f4825efdccafaeb77fbd69b1f171c0fb63179e12ff88276b6e70e9728b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1BBC.tmp

Filesize
67KB

MD5
2d3dcf90f6c99f47e7593ea250c9e749

SHA1
51be82be4a272669983313565b4940d4b1385237

SHA256
8714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4

SHA512
9c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1C6F.tmp

Filesize
160KB

MD5
7186ad693b8ad9444401bd9bcd2217c2

SHA1
5c28ca10a650f6026b0df4737078fa4197f3bac1

SHA256
9a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed

SHA512
135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b

Download Submit