ea35598fe308f20526280e88f48ed817469ca6dbc9c48d6889950fba4acc744c

Analysis

max time kernel
133s
max time network
142s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/06/2024, 22:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a6ee461dfb167c9d2cf39ab4431ba510_JaffaCakes118.html
Size

40KB
MD5

a6ee461dfb167c9d2cf39ab4431ba510
SHA1

1ce889c13a010c13786149d1d8a9430ae5506b97
SHA256

ea35598fe308f20526280e88f48ed817469ca6dbc9c48d6889950fba4acc744c
SHA512

39ae1c5ecd5972709bcb3807ea487e1b72665b3a4a156599c29b374b801f7a7dbe798623dd2abebce9e3dffeee07726ecfbe9547929669979037f882fb502f33
SSDEEP

384:EWGtj3MBNM5OiaeNE07mJlzQ/z9w63RTcb8pxhzEKfNuzV7a0MHRBfkswj6cWiCf:hQUFdU5f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BC2D4901-29D5-11EF-8A46-EA263619F6CB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424480211"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2836	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2836	iexplore.exe
2836	iexplore.exe
2184	IEXPLORE.EXE
2184	IEXPLORE.EXE
2184	IEXPLORE.EXE
2184	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 2184	2836	iexplore.exe	28
PID 2836 wrote to memory of 2184	2836	iexplore.exe	28
PID 2836 wrote to memory of 2184	2836	iexplore.exe	28
PID 2836 wrote to memory of 2184	2836	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a6ee461dfb167c9d2cf39ab4431ba510_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2836 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2809cbefcab380d14ae8d8bcfebab0b8

SHA1
c3a85541620c2d1fe41ee00baf7bb2741a8a4f4d

SHA256
8cd944b386f6a92de91b42be6a03108106460bd192067a12e5cb7fd3f421fb96

SHA512
cf6db9f5fda5cf6a5b394d05829bf6bbe13bf12a4d5c7f51df6c672e9b8ddf5def399501e02cc5c28a1de3c62bbbea9a51ebe67d57b9506d88ddde559f811c48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4443568a5265ade5a522ba11861f6f13

SHA1
529427d70a7117b8b4e324455138163ca6befe61

SHA256
8d6cc18ac37cc15bb3e13cbab378c66dda20c4dfe3a2af892a77061b56f47e44

SHA512
01e31f438d360e5b0fe01502a3e7c2613b15a1f72031c1c28c215a001ca28ad068c461cb59f4d0412daf8a6a61ceed4a004b3c7e2ca7423de48c6237794f37ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0bd4c85350487e12f48ec2555ae7dfb3

SHA1
7c435c56ad81a4baa5ec3145a12bdf35c7c64bd4

SHA256
2fb6cd280328d37be2bd1ed590dd26e331add1788499169eb2b3b7898b0c304f

SHA512
59ee88c368c52420f08f5fa19cae37c9eae96d9a70ab862785a5133087e5f786e07de9b8422595230fe8c0776f64c06f598b3fd62122318b43da221ccf8230e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d2188abc10437625c0a383f748344c80

SHA1
3bb2e45e84464b22dc9d1b559209cf19fd411a04

SHA256
89d03e8b14ba601ff6d311d1938bdb325535009eee383afc599078f36ee5307e

SHA512
cce78d6cc521ddd675f7c28cc62a65df0d10eaedc3c6284a3744595f366f387033b67868d2296821326ec2b88b04036dd89d15b37b752b25ad677d92c11792cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
654ac47679b7c9287c4c3484444cbf0a

SHA1
1bc856f307a28f6b849bc10f8483ba3099fcebc7

SHA256
03ef7511c98e2c0b87b296e10c1c941a11127e0aabc1244101cfa5a82fbf0cd0

SHA512
424d07c606984ca6f5827748e7dc00f367fed845a0dbef43bc3006127565982f23e5e04b6a60b31af2343432a7e80eec5604db09323f66b9ca0461ea0c87a3e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4fea0016b594453e607668f1b1b9bea1

SHA1
2075ccdbb4e90855bb739cbca8caaba752373d9b

SHA256
a5bad709551d35f056b6a149e0d503ed3c2e12463ec82024755b68b73f13588e

SHA512
04acbaf7533dd8c4eabddfbfa8cb795401c15079c8912efde4a928ba5e8fecd8bf0a8b41c91488fab33776ef58fc9ab10afceb50f138438f6ffa628bf8595ecf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
722cb19ac28699a514e209aa6bd511c1

SHA1
8e967355196aa85be8dc81aa1504cb8c58de80a8

SHA256
5361e26b485d2e9d8d1cb169e072704fc188fbf86bfe3d27c414502b2e85f2a1

SHA512
960b9b930e7d8446423e4dbd002f622b96323bf22ee17175083479633ac67c065144e0878eb9e43fb5d9128e65d02a470be0ec719d1f1fa6794493e250fcdfde

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
95df5b04c157aeaefa42e6a3f7116d31

SHA1
c41da63b63c87b9c7944e9f15d3ab57ebee476bf

SHA256
98469ddb73e26f8c5e272702348ab48b3cf7eaba1538ab1ba993b98db131ed4a

SHA512
df2eb36ce18323b20ef7c3015e8983ee53039e4f999341df338f8902e9d9e8774850ff484a989ac654b2cd80059cee2ce55575cd2d4258efc76d19c6d488b821

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7e51d049ee8a10f63553ac2445695bdd

SHA1
eff69be9ad92693a76a7052c048a854772550289

SHA256
6c1d10523a157a36c2f98e5e9449ddf80d88a63db5c0532a262a7b26e40263ee

SHA512
58a06e7ac8b17f5dea1269709c6549f7f5349f55a04dac6dc41fda3c5d19091ef9c1a2da16468b6016d5f949601a53058edab791080d8cf3b506b9317053bcc8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7acd93d33678d76f693496080e5382b6

SHA1
9a172030dcde895276fbe7086ae2261b68675755

SHA256
4b6700d63cc0c073fe9f233a67cfe17cf6cc89d38f52c6cc96b60aafacc4e495

SHA512
7c62c586a6625d0cbc56b0ee3c5f4d483047731a9ba5ed0c2ddda65e77a96b5c920bf91cc3f84ecaafdb61b811dc58976f211bd64cf92f9a96d6d8fb2d8f2da6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ba0d795b9e1ee03c2f60610337acc35c

SHA1
75d109a0ef13d6a3176a463a94e4147410dfa931

SHA256
e4474ce89b6ca765e172b8ac51e7e45d6cc971684808b458aa3a15d0b66fc59b

SHA512
5e7096f1fed83366173d301da712a54bfddd81029c0b2cbe5182a578cf76c3b5f191488225924e09e96b283624c7382f113a35efcbc32f3815b90572fe3a288a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1EA8.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1F9B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit