465d07896c0ee5655356b7ec5450e4a4f753dc8a2ba70604353fc6bd35031e06

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
31-05-2024 05:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8615ef1bbab5d870277ea0465a7eca9f_JaffaCakes118.html
Size

23KB
MD5

8615ef1bbab5d870277ea0465a7eca9f
SHA1

cdf3da0da796d09b0fb4e21265b5de048bb3f85a
SHA256

465d07896c0ee5655356b7ec5450e4a4f753dc8a2ba70604353fc6bd35031e06
SHA512

8f86fb50cd7c81dfa406898f38d29e866b15eda1bf1d43d53fd521471bec930bfe4a61282f9345028672fe65d88ff4d19144e12d7cb190f88ece52daf4c709f9
SSDEEP

192:uwe26PcwzKHHob5n5LCuy6X9uvFW3bwnQjxn5Q/MnQieT7NnLghnQOkEntIsLnQx:sQ/nIle

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423294906"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FB5106D1-1F0D-11EF-9891-EEF45767FDFF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
880	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
880	iexplore.exe
880	iexplore.exe
2944	IEXPLORE.EXE
2944	IEXPLORE.EXE
2944	IEXPLORE.EXE
2944	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 880 wrote to memory of 2944	880	iexplore.exe	28
PID 880 wrote to memory of 2944	880	iexplore.exe	28
PID 880 wrote to memory of 2944	880	iexplore.exe	28
PID 880 wrote to memory of 2944	880	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8615ef1bbab5d870277ea0465a7eca9f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:880
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:880 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a6ecee03aa4b2b081261be931d138c81

SHA1
daa16d5005ae8ad3771b40d2de52748a8adf4989

SHA256
5ab89b28cc4b1a6834cae11917db5a87a519d7a9b6e632d5d8db6feca9617e9c

SHA512
0736b0a9d5f4c9920a08cf386337605d84222fe53fe2cb0e2d96c60c2cd8e1febc91dcaabff08aba3ac7aa0a297c9d8e94221e10c99584aa3083abb3e1b1c00e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d75490d97ad418351f19b67f9b97fab4

SHA1
c6e6eaf2a18be549bb5c013f450ba5551e7296a2

SHA256
d9a591441aa04745359db0725f62e0ae010c3eb2826d228a7568f910f26c9989

SHA512
0d20aaeab0af7a7b1a3c22a35e96ebb35e756674d7a28cfac6e1afc318093c9ae40bc5612a4cee3e9f6181b2dc5c44da4a8b16c5bf15c716f9e497527a45b9a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
63af868a34acf871bb83537f4a90c878

SHA1
9628ee0ea7b960577d7d1f87ea31b02ea90a5746

SHA256
0edbd0a72650f87297dccced28f79b67d823af63b8e40e9b5dffceabff4da5c6

SHA512
dcc66dbd01b9f9467d0bda9c26b418b664545b4e3ceeb676379d38ec53ec395b39924ab1c1eb36e369325b8eda1b0b8bec48b797dde33c12e33820b609c6d7ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
85684041011a27624a5c8939207645c7

SHA1
55e512faf3ccd2dff93c5be537d60f723d0878b4

SHA256
721a76bbf300629f4ce8969958edf212b66c1228fd27bb35b8b3d95fd81191a7

SHA512
ce9dea7fec9442090cc478ec899b99a9b1e1e140b19bfcc57497007a006271debbda069fbb9471d376c846a711f31d4604b04e5a62f80d079d51632c050955fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a344495676e2a436e525bf61f02fadef

SHA1
905017c2b2e29e2b1c3cc2ebe9d4dacbda0dfc53

SHA256
cd6a33adb5d8ffd6a025179a84f9a9f586a55cbcbe43ac1a9746e53565c9d0ed

SHA512
baa7f51bf0e851d0b6f38776f697cddfabaac439351070ed3269f4ad987892049ef56bf8ea063b3d46bdb0da46b8c08ca2f0e06db4bca5a51271902267896383

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
896e4ab9ffba7f2b2cfa5b4e72a86476

SHA1
53258e49f20bfbf66c9dca01162ca85589e22408

SHA256
2febd4ee029e44abea97d45ebb3fc8e91913a0e1cf576bea4cf9542ba7a9074c

SHA512
41422657a410b6b3337acbcbe8dc99001aa2bd3133555ca710e04d9aec3949eeff76e113c06c5c33e5173153b6aadd60486f125360b9b6289d220ff833e382f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7d0ca3a3d0cdb0245462195baefcc030

SHA1
aed178bdd28fdc643afa3dc3ae5b8509afb0266d

SHA256
e0b7188a59ca7d1162aac5e1cacee1940edef90069162f03fd38797272ad997d

SHA512
7d7ab7b86444ecdfc06584aba499d662ec7c6587d62edd90d99902784f8bdb80fd5362d70a210fa427f69dfdc937ab1798d269edd07edff0570b177c15f12c17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
63445186e57ac39c422934a66b0e9d83

SHA1
1d98dc9ee1a8af1185415d1219badf0b9fb027ea

SHA256
efaefaf857c7adb5da28407398e6ce3e90ce1d9dd7776965ce61e5e9fb6bd590

SHA512
7014a9433b5af854d2a6c45dd8f069b5e704dc2bd1bfd252b3519d7cbea3f53af6d7ce7547df93a640cb1764258f91b3f452a3462cc646b6086ef780e0d54352

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0634197f537b0f7727145d6cb2ce5c3e

SHA1
ba57156ceec2c42416c063d2d783517fa2ab2b7c

SHA256
0c41a7b893f34331f81e54396000d83bdbf6c4afa768bbfdeef730984cbb48f8

SHA512
f46f02054cb2d954e7b014e58fa9e2a87f5970378d275179b8f7227836c1e7d39935577ba53688587976bb30f378a94e34013b134eab8172e88bc1dd837ee9fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab24F0.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar25D2.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit