a4029dc80611c4c28ddfa27948ebf1f1f952d5e6676be478aea6cd93d910aa4a

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 12:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6e8725e9ab129a6f2b803159c1c93688_JaffaCakes118.html
Size

23KB
MD5

6e8725e9ab129a6f2b803159c1c93688
SHA1

c65495a7b38613ede85c0215051904ccd5831b09
SHA256

a4029dc80611c4c28ddfa27948ebf1f1f952d5e6676be478aea6cd93d910aa4a
SHA512

b8c0d9a5291276473b65bfb7af9c35a79cd69655935de592662279872a567d7a57a6de2e632f573dcf79d58f6af2f2be046d41c29132d110fb2abdc48a3095d2
SSDEEP

192:uwDAb5nGunQjxn5Q/ZnQieMNnZnQOkEntHjnQTbnhnQ/GLnLnQtaqMBsqnYnQ7tD:fQ/xGHG4

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{484132C1-19C9-11EF-8C71-D684AC6A5058} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422715644"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
108	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
108	iexplore.exe
108	iexplore.exe
2132	IEXPLORE.EXE
2132	IEXPLORE.EXE
2132	IEXPLORE.EXE
2132	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 108 wrote to memory of 2132	108	iexplore.exe	28
PID 108 wrote to memory of 2132	108	iexplore.exe	28
PID 108 wrote to memory of 2132	108	iexplore.exe	28
PID 108 wrote to memory of 2132	108	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6e8725e9ab129a6f2b803159c1c93688_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:108
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:108 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b19c16019cd0d8d693b8e31fd4573220

SHA1
a87c2d0fbd51361387625c2f0942fa43df4006e8

SHA256
80aa38b580bf53d0ba7336a91192c321828f7e7e9a54366ee8fcedbbd5ecb70d

SHA512
922662705ba8a45757b00523fc7122b904d0ac8b849b563db381e8ad74ca150f776b671e10abb5ec6cb441d431fc4c50383eed4ab50d9fa5ff531ecb9da10f95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a5ecc45ca27e9bccada3e2a11b6264ea

SHA1
a212dece04302861745200fb10b7039c839478d2

SHA256
603e19ed1e457e5764aa5a959489235b748a097dcc903d5286886922e47227f8

SHA512
02a62a7625b1fcac93e29823bcf99f5a14cf1056ff9e88e78ebb802894f2e00d11328da4f0a42d9ab4c725e7549ef3250b92b226952f5d6f4c7379d9effa6d88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6673909799a74ef8dd9333de0ba63394

SHA1
f28e1db2d3401e10161c61db454e86841a0b5acd

SHA256
2ee7eb68ffd6d261cbe7ad6fc4dde25d16ffdef59866bec767ee84ba0cf213ff

SHA512
b5770deaff35e9ecd799d63205049c741ebee287af88ac18a4dd24d0a2e1a67989be5612e0fad1bbc43d175cbf60d68c5a0fd6d78be0a5240e7e184abfca8136

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c70a67adb0430013a8c4fba8cae8fbb8

SHA1
83983912fec15d8f40c2ef0c19ec943b879a0531

SHA256
6a518a3a78f97bfb14e0205924ef52c3ae2c5993e4666fa78606ce2c36174074

SHA512
2090cce5da948fefe23d4b8778b76ab507167d5f40adee969bce1c5edfb2bbfa2c78e2ba0a5fca161d744298aac669cd94fe37bbad580ebeacaedbb64e50f6aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e6d1f67aff2b4aac46ffe7461dedb7d

SHA1
01c7a2d28f608907bc91175c01a2e94707b4df1b

SHA256
429c7c1343e7ed626bef54ffc954a82f3de9de9d48c02f5fcb9a28b4ed1b512f

SHA512
c516f7e782688867d11a1540810c4f138715c6ab897a29fc361da4d0797b858516e95aec382a07e38f3c31f4558b4a236fde66e234b0341c5b66a22e6e024ab7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
98fad772c67335dcff70a7f81a1e91d8

SHA1
867950bfc9d8dd42afdaf9be5e2d8a6f9e78e98f

SHA256
316d23f0892cd909a938d8eaddfa1547cac41452aad8877f6209f564a6f43400

SHA512
49fe81b61ee227ad3db95104610f7789bd1f1ae73a0d568e79af5696227f13b6ada7bfc914cffa9a2e536006ec2abb9598c71d8b19957131fcfe9eb01f32328b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07a0b223a5bc74c08b3443351cdcb1b3

SHA1
125bec54e6e1104426e7ca8e68ae1a64aa1d94cf

SHA256
30a95a56d90c76237a19f863a9b93acd6a05ae2570c8bd455d3328e584c678b1

SHA512
743412b22bf3b8c2a9c3549f77f73511cd63e5d0cee725237202edde35e7d8815927f926de56332a729475146c0115925fab22f22ade62c7c2ede3538582b0d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa0ce7ae4bf2998db5de9bd41257f9ad

SHA1
72388e68b40ee34a8de17531ce5a76e9e8ef4f27

SHA256
f77faf133e3063866559ea675498aa816f8558940ea1009ebb18b34b19d7f7d7

SHA512
6a810bf3bbdf68d302e3142c8b4a10125ae7171b2edafc5d8451fc654861ebb76fe266ff1f4c723a663b6afb4ea11ed3c703e33032e319de8e9a210d0d0f9150

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d4c1e50af95b1790a8ed86614979c20

SHA1
85a67139f1a90afde4ac5b770c5debc3d7dd9967

SHA256
b20811b5ff62134b7602633d2f4e4132f43023978abb6a77f3682a7da6134053

SHA512
7ada1ad42b9e4134e5abcee3eb59e4c2f64bfffdb4a7952d76ea027673de88e4a8e042a69b339768b740a6c428f83b7e0ef2a99f01dbafb0d32c34b083bd1d64

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1EC7.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2071.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit