67dac18cf09d70bb0ae33ddfab6534ef840936eb957e41cea4cdcd8a29733699

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
14-06-2024 23:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ac112a7b2135ae105fa8e020b86badf4_JaffaCakes118.html
Size

37KB
MD5

ac112a7b2135ae105fa8e020b86badf4
SHA1

a37f0cace4e6d165abeb761b1cd65b1b57c7bec8
SHA256

67dac18cf09d70bb0ae33ddfab6534ef840936eb957e41cea4cdcd8a29733699
SHA512

fc90fd04a021746309af86739c2cd2f07f830852509196fb0ecdd14d218ec77400a00249475d0160fbfb0f2cd53f046ca329df21a98eb9dddf4a763cbb34c504
SSDEEP

768:xiNXPXGb65+P7JdKQflugWeTTnGY+4V/ZzfvctydyDcT/CtXNpLhBf+X:xiNXPXGb65+P7JdKQflugWeTTnGY+4Vh

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3C1D8A81-2AA8-11EF-8EEA-EE2F313809B4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424570620"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2960	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2960	iexplore.exe
2960	iexplore.exe
2928	IEXPLORE.EXE
2928	IEXPLORE.EXE
2928	IEXPLORE.EXE
2928	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 2928	2960	iexplore.exe	28
PID 2960 wrote to memory of 2928	2960	iexplore.exe	28
PID 2960 wrote to memory of 2928	2960	iexplore.exe	28
PID 2960 wrote to memory of 2928	2960	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ac112a7b2135ae105fa8e020b86badf4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2960 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
aeb1facb4cb0ce2b5cbb03564662bcc1

SHA1
3a7d91e0c507e42516e7dc179d52793c2abfced1

SHA256
584ff7886679d5a0196524461b3a3e895e8a3cf55cc69958381ccbb551244a4f

SHA512
383b3feb6f728a5f129762320e45e959d8c8d92bc64e1b049033dba553fd725234bb0e7708983fa91e24e8c744879a96a6b37fbfefa62dce58262e5e88e8ec1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f215397ca833b9d34c8e2bb1c46444cd

SHA1
1da13948c2d8d1b6a612fb06cbf20cdc26abf1e9

SHA256
d31b80a454d5df9741f091d1bf9d0f341c5ef5cd0fbbe3d6bb0f8ec0de88e5e1

SHA512
e3e13bae49eed7cc92254365b83165a1ab17189e64c856bd12b3a7eed22cb5414cea4c13c7b06cf88f09bfd82aa72db98a87dcd74893b58eadeaa3e47f75480a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b4d0543c1f171f7ccf963ce9f82b50b2

SHA1
28f83852d00821cdb1701dbc85010a186cf9d90d

SHA256
9f6270f6b712e1b07906875659727200c9207fa51412d7117652291d5f2a073f

SHA512
c5b55d1cfdeea7f509f418f120bbf8bb837d3fcdc565109c73d851613160d05015a0f6e358380e46db5f7cf2fbaebdf366421b70db68624013ebb510166232bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fccb673d227a2fd4798fd1ac7103afb7

SHA1
c9d3114f0bffce08442ed9ff9c300a2f5b7bf6b4

SHA256
79e17a655d44c7473a2aad0ce47a5776eef5b5ce242eee76dc82d338eb8f2b2f

SHA512
24c41c61a2324512fab7ec92aa5d8766967926ab7cccf7d057acc3aabd47d5ec0079236e600685026d6a8347f9ed304e260bf9cf0426fa09dbcc56631aba5cc2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8c1e77e8987a781f12b393f8e1694160

SHA1
ea7c92a1f397af36b0790f461667a4737acf1f75

SHA256
ac22014a622d3d28dbc9e300f2a0a6fb1bb135b72757f6425f63d83952a6b8c9

SHA512
f108d753ef4c78263e44eb4d24fb70e360746ae26c6a934796734f32606ff21d3d95ef7343f4f5bf3bf08d1d62640f53cd3b2d629ff77cd79762e1c9b7073cc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
de13b715d1d4a6fe0387759d9a5ab99c

SHA1
14262f4f66c404912a7e13e26a126c72d9f8ee92

SHA256
f5bab2c154a151c0bbb474d4499ecea1c3158c74fd29a042b84be86ec956855b

SHA512
182f7220dfee14ac7d446e8b68a0ed67f8c77aa9ae8fe3f6576b3def86c02dda3a4752738b7c44fd15eb6c5d5b2fff1688d16f44fe9bf6e6d83a60b4f72e5fca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a5dcc9f785d2152f46c160b2c3f0c50

SHA1
f0b5d5540030dff4bb146b1801bc0b447f19b8ff

SHA256
1e337a13cd4be0b01e98ae78edf21ff6f7617fe6ec3a1d4919d17d4c9cbdc77b

SHA512
6c6f3b10a3f8139b7e4e6f3ec85148c1193d54b4eebb29b3c10af0193bce5c0f4ff48afb0f539d79c253fbc1de4fe8793fffaee980479c0bff6f8f04ba2ffbfe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
db380f9ad504d5224c6eb87295b0dfa9

SHA1
eaed233b6379650f70bfd9fc36cf4e795af50ddb

SHA256
b3ea9755d7748e8749a3c9ec035b62f06596fdff46ce67b4654bcd685ebbc774

SHA512
54367a58907f3ec2e74cfec7e6ec1bd5ed71b17e470e78938100ad4ccc962127b20ccde29ec33a58e4291dd5bf100b1d8f4d5ea7290ee0a0d4744c04e4ff6f93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff897b24159407d63504aa6fc434adda

SHA1
943abb8a9a8f1436f3bcae42f9589ebb2e12fce6

SHA256
2b39f5c6376b1a1cb486767a23693dd92459e9e479e627950966d3ba36152cb6

SHA512
c58cf23dda9c5cf60f862f27ab8bfd82f06c555f81d4a3ad680270500e15c1a3c74345c2c20fa9fda8c3b5efa91dd10efa9b0d9e398b21217a79ce14dcda089e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a00d610fe5a51c859f4cbe40ac63af32

SHA1
016ff18d799538af47ae4251a7b6764af7d56b0e

SHA256
1ce1adaac1af5a6a97f89c10e3131b02fdff8025d664d23de0f51d2052c52e89

SHA512
e47c658f03053f8734959ec2d88bec0012c7b852297af5ddd183ea9c285b8add5c8f5f722f526ef2a9d4514cdf56081b1d3d6a6df5e3128c97134a378297e0f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a4c8ab23a8d82de17b453f4d5696a370

SHA1
8f99309dec96985a1819ac89ce1fabaa8da0705b

SHA256
811cab3bbe59d3cbe999c8a0e718c0829fc64a3a71a5e428876e1b22af29a180

SHA512
0280d3c999ed11b9c069813ee9c96713af0a4e6e074745a14f9da8ac17d207777f01ed4715caa02b51d2921ad083528a203400e4c03671b7fe2867f12f154641

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
17d00a2c2d293b5fcd9fc789a43202a0

SHA1
3a0fc622383c7b53975db63eb1e6aec48cfb0270

SHA256
e6d30b252648ebd15b4d953fd8a0d1a21aadfaf1c82322c9953607c7038ed40b

SHA512
d51e86c515c5cdb4172b91bb4af9d8b5ff164565a5c46c9d669b3e877705b9e8604baa0bcb6788ee1ef5d84f440a46e23645afa24c19e1adeef325823a63cab3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1B00.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1D65.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit