06231e6a6fdf94c243df1ee175e13c1a93625da1baa63a57ebed04a006fafa6a

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 14:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8e5c2255659d00a27174fd66ab263651_JaffaCakes118.html
Size

23KB
MD5

8e5c2255659d00a27174fd66ab263651
SHA1

a234f86cca518e0e4b34c30cdb4b9595964a783b
SHA256

06231e6a6fdf94c243df1ee175e13c1a93625da1baa63a57ebed04a006fafa6a
SHA512

8c77c43ddc46ab8dbfde348c03af47f90c649ce16e771ee7f9129e74727491f62183ba7e5e1469ec9432869f344fbf0649b33c1d0d845e75d2e55f17da3a2566
SSDEEP

192:uwvgb5nEOnQjxn5Q/znQieSNn0nQOkEnt5RnQTbnBnQtBXQvMByqnYnQ7tniY5Oc:1Q/KHMcL

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D19EAD41-20EA-11EF-AD38-76E827BE66E5} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423499705"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2236	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2236	iexplore.exe
2236	iexplore.exe
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2548	2236	iexplore.exe	28
PID 2236 wrote to memory of 2548	2236	iexplore.exe	28
PID 2236 wrote to memory of 2548	2236	iexplore.exe	28
PID 2236 wrote to memory of 2548	2236	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8e5c2255659d00a27174fd66ab263651_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2236 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d4a6ea9748325dc637b6ec656c6ba602

SHA1
28b0410a8c2b62fdce0291856aef65be2fb67921

SHA256
e8df71cc96f59d34e993169d6a6fc4f6cf84238a1d349c302ad7acd5e0f2f52b

SHA512
100a07e300e5e7702d794e7bd190f80ed4199cd9c4b9b52bd0f58a55416a4611c17de07202eb66088fc4ddfcbbe4e5eb8b07c8deae321f1ec6aa5eb00bab2319

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7e93706b553ec97842f79f6ea93cff59

SHA1
d368332e0473382b46d58e7cf76861f3c04abf2b

SHA256
4bc32c1e300a3d115f73d0d62269837265440220b4295924b8df33a46ef43c26

SHA512
da18adca8e851c223c96004d8c1497a6cd97890eeebfb29c0e9ded419837f738904252db4a5e7ab2b8a2e4fcf462823def2e4a95b3abbe677e8bdb8be448b38c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ef56e72241bd1ceab5d50e6f65346ecc

SHA1
e1738da14151f130d7e2461444d257e460fdce5b

SHA256
90ad6aa3385f7a736ee42880d5ddfdd39e096122da8e177d6e0999140e3b510f

SHA512
21ad00db690479f90050656a89ec85276b0268c6635ee41c94b816dbeda4ebc9e2d30207622998f44ce9cb3b0bbdb330dd62e3a4d9e0a67783c17d8e855ecf85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c4495406db2d59f19341449f914ec6cc

SHA1
1d869002208231f4d198a3c49203706c7932b5c1

SHA256
80d83740c36b37914723b50629466efa452a17867f0919a1f1be782d45d82c39

SHA512
e6054d14d013201688a8f299186f9e506e495acd5f11c228da44d4d1b727a616bcdf8ef14974defafd0e038992f5382508b0c593d89a567068d1f700232195e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
72abda19d70470c55b20c47faafeb140

SHA1
50741f02238b03dfdb970c2cade257a104a836de

SHA256
dbbe07e71dea7dfd6bb7196336789adff872442390a90414dc9a9f602f7668fd

SHA512
43bbd810ed20af6e0c412957d8222a8c02b367f8f1299e37629c78b2d0f76f7f01fb0f1670a81119a36402d2c479f1d1d7741168e65ae235b2fb0b493c0c3518

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
302b7899a98cedb76b6c1125393cc07c

SHA1
676f08e99636460feef1a4e4117ffe3129fc3371

SHA256
abeb4b48971c7b2ce1c0fb6890c05fec07b874856ad957df2e9a451e1f4af430

SHA512
1559793894a46b570961d9834ca295f78557ea55266ac47384a9402e11ee65007e43de43f373a132ecbb00059ab0d7b7bdc691b8165fa03af5b214d60c67e6ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
175174fc7476ece001089f441a79bb7a

SHA1
e410a4fa582f900c1beea5931775fad4b5f1c89e

SHA256
24d338de5798d89bb3f1670419587587e1e4961f7f6ce76d1a7745c8cca62783

SHA512
e539ad324a96a1a02e8215074fe4a9669fa74571315a8a6fa65a4c09a0b3e5a34fff39f84f36d4a9c4ee588d3a1c246f28cac667e5b2870b45259a4c2288c29f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
893ee643173e9e3a9844decb82931a55

SHA1
6befea3e886ef7ed33d70605057ea8a5f2344567

SHA256
177118a0749ea99a25cc0c1d22b8b12e465e2f3e2cfdde24c5c24c4911c05664

SHA512
a348578e91c9f5288fc3fa1d0c02594bf39d9748810caedd9d53fd5cc4151d6e737f33b6a87b0878963cf198a88092e59e7f07e5ad756b78212466fb98308141

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
504510e9ad7f67c442e25a3170905e43

SHA1
9aec14fb97dc139a8fa2d5b09856b03bdba7660d

SHA256
6fc2cdf97cf2cb7c849b8e4b7101c4883efb62ba9c23818eb16be196a79d3188

SHA512
0d310e9a865cecb6363b246b1711c9fab4493b0d8ff0bcef46b7b44d791592dd2481dd529c894b4d4db3d837e60ad768565bc66390d70bff185ee87eaa353487

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab56F.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5EE.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar603.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit