469e7beab6ce139e65adbd71763e72113d2d5376eea8c18f4405fe82e9b632c2

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-06-2024 01:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b137b7f72f8c99c873d2c9ec6e3e72e1_JaffaCakes118.html
Size

105KB
MD5

b137b7f72f8c99c873d2c9ec6e3e72e1
SHA1

77f3a273c3d24c5188b731a622729729d5e09de6
SHA256

469e7beab6ce139e65adbd71763e72113d2d5376eea8c18f4405fe82e9b632c2
SHA512

c33f56fc23917268717137f7c986ce9a405e3b243b255169d1e4095744057de8510883b5817502d15d612a728d0452c130a55e20b7954a2a2f39ae9d0e97b3ae
SSDEEP

1536:jm0gT+3xj4Bcqxzfl3UcOYZfbREx/n8XNaFK1CbSg4ptBG7BUseTfT:ATOtMkj0z1NseX

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424664954"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DF8F7E41-2B83-11EF-9034-729E5AF85804} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1316	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1316	iexplore.exe
1316	iexplore.exe
2096	IEXPLORE.EXE
2096	IEXPLORE.EXE
2096	IEXPLORE.EXE
2096	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1316 wrote to memory of 2096	1316	iexplore.exe	28
PID 1316 wrote to memory of 2096	1316	iexplore.exe	28
PID 1316 wrote to memory of 2096	1316	iexplore.exe	28
PID 1316 wrote to memory of 2096	1316	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b137b7f72f8c99c873d2c9ec6e3e72e1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1316 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a534192b27ed2a8e458ff7bdbdcdf0bf

SHA1
14dc3ad6384446439ebe34eda9d8f43bc7900752

SHA256
372db285fc67d2ab18b72c8ba83ed68de33ac5423b16972a77f48b0ac279bd44

SHA512
f7c7dbcf53f92176fbdaa825f11fd78be39a2e52f97571fcc4ce6cc268e980c9e13a8920ab1c4021d18a773fbff8eb1bff6bdee1a64f9fd9fb111564f5a959d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
669d736b7f0cfbf93350a93b346f1c86

SHA1
e7191b13b4b65078021bca30b15506c009a30b67

SHA256
9824bf2acfacb646d866009e7854bf4e0428983801480c323d5b8847faa0308b

SHA512
fe3784ce141f49efd10c54968a67490a0ce1b6f67d868f6c249ed0a20ab72c5e9da7d5136e994f53c5e66ef89549251283a35b9f12a00e852c6bedb006f068d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3217f3288173d46b7fef43132402b95f

SHA1
f1feb22d805399d85fde7e55e7470b9d633cc2eb

SHA256
e8c272cc92908007e7b9aa920660f2ab2feeaa7e87bf0719108b2e8a493abeb1

SHA512
e0c4568f94b4c54813b0bf7d4645ab17d05b9d3c9418d6160db771263109ab9a64c172ca80277c0316bdf93d62b1b82a8fdfbac457dc780d277047deb0bb3713

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e1daedca6cf74996912a693ead672f12

SHA1
d886ab37a95a49672c4f07c1bab05c7196699438

SHA256
3f0501fc4e46ef0b7e0e7f123281fb9f302cf7b438a062d3e449a09408ea6b48

SHA512
04070f89d9546ba531b7e92996f2a94e8ee77ed545a2ddee9b66adeb488e47b1a6e2d56edb18d81d2f4d7bcbf470a141a800e13b096ce5decc0c28af40a702da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1a0ece49a33cfe5b213c2181016bdce1

SHA1
634ce28cfca391b058a362b7b42d6356d9449543

SHA256
a755dd6d47ebf28cf63c1baee4ecb4e4d63c914b3ad97fadbca0dac59f9da9fe

SHA512
fb4b9df744a569ebf008a027e83e4dec3e5d3e53d9971f30e063614458bd74e924cb26e06feaeac7a3035f9dec070ba37d1a6ecbc894de0b1e54c674ee014e07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2eeb0268c67f57b6dd93ae2ac83da58c

SHA1
c650ba01c9166659e1a3ad59d37868de72f19bf4

SHA256
aa4e3bb75e5c292bfc4a5d81ce35c8ddf98769bb72c2035f3f4f9fb508e62179

SHA512
36b440d295c118328c6abad0a189abad55c9cb6c3ab3866a08dc8e4dcc7dbd84f51cf6494858bf459083838797d8b187668c7e1183c6aad6d00bad32cecadee1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
de5cfb72005397ce1a4d040c190195fa

SHA1
5fc8d98fea0dc6538af2d88f2054d7c9b07b2aea

SHA256
c4a68b87490ffa1dccf030ec5b5e34ee5f7cb2c9efaba36d093318c035d7bc6a

SHA512
a0f755a7b847aef9edd4c8b65c3bcadd6596eafefeebe855710728574f932b8828f3b4943389e5fd487cca169481cf978ea139056da99e9fb4cacf3d24a025f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5d5bda3f80e152ec23fa3f31308ff772

SHA1
1d06b840b0d4f304ed5d6e464276c1926e845075

SHA256
c01df46f2b52ffd02d81c28e967a6b332cb94f3c665766f6588c57ed69f25f9e

SHA512
fad7f0873d22e0b4c3cb82de2831745d24306a7eb0faa5e3abc5de535398a4d43639a534be0fcb60bd2a51106154eb793bb2b1186356bb2deb61150dbb6f103f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d109a0f01140aa1f66dd24b8500df331

SHA1
5b37ab551212790c283e406444bc7eac5ae8ab27

SHA256
a4161a4feef2e71da5809e1dee2d0cb6612b36b2eab0f9301e178f672673b8a0

SHA512
d865253dec3e4f64cbccbdba35ac9eda3dc1c3be8d8424e26b268fbd45bb1753d256c42046a520ee22b03aa949874d2bb53c919ac963ff2f6ce407deb5b1f85e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1390.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1483.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit