6aeaecddbae62f35779caa22993a7134471a3887c8e5522968401ef7d2fc6f1d

Analysis

max time kernel
148s
max time network
147s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
14/05/2024, 00:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3d3b0d910f542104834215348d652b10_JaffaCakes118.html
Size

20KB
MD5

3d3b0d910f542104834215348d652b10
SHA1

eb3277c728078cb68c91ff5f9992899d9c318333
SHA256

6aeaecddbae62f35779caa22993a7134471a3887c8e5522968401ef7d2fc6f1d
SHA512

1a4f83310e73497e511d702c789901a6cdb9484de773872071721980817c48e5c7632ad205f926288d538821be603c45780f71f6f383c2bcb1112e47f8a40b02
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIf4lzUnjBhPh82qDB8:SIMd0I5nvHVsvPqxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421811421"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F95B1C21-118F-11EF-919D-C273E1627A77} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1652	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1652	iexplore.exe
1652	iexplore.exe
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 3048	1652	iexplore.exe	28
PID 1652 wrote to memory of 3048	1652	iexplore.exe	28
PID 1652 wrote to memory of 3048	1652	iexplore.exe	28
PID 1652 wrote to memory of 3048	1652	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3d3b0d910f542104834215348d652b10_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1652 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
0f432d12d4824dd0169d5f3d4dcb8232

SHA1
d690ddec91b11ba95eb3421323e81759fa12df4f

SHA256
82d96a340374fc59c3282c4cde6ee4d900c50eef2ab6ade2cca4741693bed5a8

SHA512
f0d0a27246dfa03649c575d74341fe6eaab35e5eaef58ad38a58cda7d37008fc94c71dacb257265e2fddab42db754061c78f56edfc0ebfa2c9f306b5c73d094f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d099aec41073c23d23eb9abb2350b283

SHA1
87553520756a381168aa0d64d209504c6d40c4a5

SHA256
1391d891708c7db9704ce2130a55e78263d0e80f8d4361318ceb40d0bd43fbc7

SHA512
2572a26b2b10478fff22e50debf233a3765965c9406160fc93320f453d89dfa74712cda092e3bf60edfdb64836611e8a0e5b845b20d932dc61e104f99c7aca49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b120f9aecab951c56a184df47601e63

SHA1
1ae9c4abf86e76b82fc2e443987d5d39fdf44818

SHA256
764807269684f174fc08301797fd00ab7efb3b6b57a06afaf482ec30578dcdb0

SHA512
b3e0fd39c934cc7cc2a8529ea8da6875dffc4642bbe53be415bff0be850ea8118e05920a35b4312053a00fa3943161f22fc108b064485d05c538b956a019d5c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3102f3a7792c474eaf68da796bbe8d0

SHA1
bbed77ccc3aa8837d4b23f88122613c05e51c555

SHA256
3d86723787cc28439f7d2ab48f5d31e582b66216280e775fe93e67a61cec7489

SHA512
bfe76b0b16223c1059695f42e0fa1f5130f1104c017ff9d28477f15e734109dc2696daa1e5af944b013466ced080db6cb5dacb356ab9e85d7351b91647b83e5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f181067b9f681b6a2f1579b37ace25a

SHA1
c8d826fd8f02842728642fe7f6f8aacd3d6ef632

SHA256
40c777328ba3b3a40a0ff9c4f45f338340413b246e0a169f2f942747529caa4d

SHA512
3fa0fc359368fac6b046dfc9a72a0c9b773b7c5109b66e839f8230716ebc904852b16d9277e5e12134a7383ae4bdfb1a0435ac826fd1ed4c8dacef2c50fdfb5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e236dc19dc7117f1bd1ffcc15c2383a2

SHA1
dc7d21794b3476653a771a187351a8a9ad0bb1b9

SHA256
278b2f81ae101dec14ecfeff1d1b77c8c04256169a763a74b5f376106d821d04

SHA512
4336ece1564ea29e92a2244e569a614db62305ad8d9f1d4855fbe78566f008acebaa759f175315a77a0c04dcb51a00efaf17024b865a93212ffe883fdfdb1242

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ec75ca66d1ee182dbae21adcd9f1ae7

SHA1
de83b38ce3d908e683825824649842f7b307f42b

SHA256
0da8a5838afeb4b35757ffa20be4de8c4c6c9fcd3040bf4dbf23c0ed2f29a2cd

SHA512
4ce24aef912ac1bdb340c25c170c3b4bc7dee936673a70dd2019e787a37570a87d83f25bf7f4d9ead2a82327f4d6f3f82c21d2b82a1600402ac7ade32e32b5a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d3070e4478b1b9237832b05053b55e54

SHA1
e2afbe42e7dd16c4bdf665adbd4364ad5ba2dbe6

SHA256
6762476126d0bbd4fd89dfa7f4f595ed94a1cc2330cadae87ef44473a44daaaa

SHA512
ab3c5b5ddda4a7ebd2f84c67b49ad47691663b265c5a064f09593ac4c6e1159bf4563e4cd66a89baecb1ebe55046e03b2aa7eb87114aee56dfc87042a65f3607

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7ea6a3cbe240c6ef15cd9f12d679b00

SHA1
ccba6037c69d2fc2a826e956229581fdcb36c491

SHA256
43f88103674088b30199f1a4e60db6fcc4c6a99ee5e6087dfcf48eb502e2a7c0

SHA512
1bf0b858c39069b81a486ae9e08b8e4bff41084f6a25f96ddadbfec4890c0b02290c1236068b5308dd836dc2bba05feb62c213cd6aa775a870cc757ee2092aa3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd8a7ea00002b2e6ce99ac993d03ba5a

SHA1
c5a3dc09d63be46c5ddfb24ffeeaad3c69ae1816

SHA256
00a56dc87ae2d854d4f4a6096eab80dee98e845516e8f3199bac66c11c5221f3

SHA512
8850fd81400bc57baadb699d281a23416afb6eddc8f29760de32902e06c9945253dde74dc884c8ed88da47dbacdfcbb1413be7db3a7c5335cbc2443914779992

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
7eb185f30151acafc01d74cebe88cb7a

SHA1
9102a9a601cb5c2eb37c55cf003183119570d758

SHA256
be524b4c761b27caba447ea1b4bcf5e056661d436ac5b9924ad735a6a7fa4de4

SHA512
cef631b6a096bb36121f22f5f2430b426c248d00d2dcaf9db5396350aad8370306cb2a3b2e1863d4e4a319cf4d3a5c8d4bc7ee674477a97b6d9a2c0c10088653

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCFC.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE29.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit