28aa250fe0fed6c872a3ab2f62f299e55e0943f4a2b8fcf0249505cf3168c2fb

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 23:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ac16b7435f44f6f66db8ad90d7bd96ad_JaffaCakes118.html
Size

56KB
MD5

ac16b7435f44f6f66db8ad90d7bd96ad
SHA1

e699b529a84483ed197c912f029db2e4b6db183b
SHA256

28aa250fe0fed6c872a3ab2f62f299e55e0943f4a2b8fcf0249505cf3168c2fb
SHA512

08309763b8209241b8b28f80b2cbd8e003bee2fcb2ce505bcd21ccaf42e273f369dad38172c0f6e2c8005a23c085f916636755c58d1cdc8072dbcd3a76dc766b
SSDEEP

768:vxjIZuTnMypKVHijMWlZBF+EDDHZBpreI:vx1rM1SPLdDHBrV

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424570928"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F3AC0CD1-2AA8-11EF-AA09-E6B549E8BD88} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
952	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
952	iexplore.exe
952	iexplore.exe
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 952 wrote to memory of 3052	952	iexplore.exe	28
PID 952 wrote to memory of 3052	952	iexplore.exe	28
PID 952 wrote to memory of 3052	952	iexplore.exe	28
PID 952 wrote to memory of 3052	952	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ac16b7435f44f6f66db8ad90d7bd96ad_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:952
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:952 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
fee8f20b2dbfe69a89308da70ab2c9c7

SHA1
713daff489ecc196d9a7b728ef49f7d54f3cd385

SHA256
c640f877f1cf51a5e078108497c805bb656690f2409a6fb8d0bd662f557d14bc

SHA512
3621b69f14c8b82b2de7a22815ccbf3f7c1d17b5abe6e296ebf159b6289121ed8bb847ce3c07c457f6915bb3337c32411ca44c5dbc81ba703b8435f7be202546

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aef84a81fb21b1de8c8b4918c8be3a60

SHA1
acbdbf1a65dfe31db1785d4306a7f5f356df5673

SHA256
a798f9848aecbaa2b348d4c355af4465109c057d27657bd63663432af05bed19

SHA512
d92d336c206f1fe5f8026b63996a7192b936c8360fb5d758fa20b75bc68b2b275f17cb998cfaf043ad8afd542c9c0e4822d06dbcb234e758b22edd790d153c2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
128dada514997571c6719e4f7a5af44b

SHA1
7f3049c162da09e49ac54a607462ea9df6ebb9b4

SHA256
c472e2526b5bc0a6fa09b96fca6cb628c144dcaf0c0275210c96baa87f98686e

SHA512
eaccbe9df21cb4d8edc04ede187e75080af54404b8a10f6a0a18b2c886330c048c9203d42f060e089d800658c8d94e00275b49fa06365befea8015785f7ffa12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
223c2e371c1875602f62ac42cc6994c1

SHA1
1013538d9bc4aae61bd65123d00aac03d0a258bc

SHA256
479e610258b6953f78b94e841b83d270e4fbd8388d7262326e142760f435fbaa

SHA512
45a8c19ac0d4cdd2689b893392f932e2170e17854bb00beebe71df9e769c4cce101e1448a970ace414e84e17f960ccb2831f0aedf4a25f3357fc64699b44e8e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6909e940bae43e96ccd28de3e8c43b7b

SHA1
fb6fe4616b1d20c16a74594c8129a5672100f2f4

SHA256
d37b0dbfee4b4313331b10f32fead9792dcb0b30fcdd7a9156c8807784bb6cd4

SHA512
949b658752cfa82daaf34770eb6fff05e7eff99bd46576f088fbe92c4f04c216dbb2fe727493ee8bb2f06e377620465401493944150ab2b1114372bde24ea82c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69f48cdbea33a0c74fb1d27de13578db

SHA1
2013b7767fb1d469a29263abbb18ee0b6a30b2a5

SHA256
1d276e52f9135224873107a06ff40ecfd4c5c39c7a25b5758419ba95fe396a27

SHA512
4d0d54b43ce19c280d8149b6909373d223e51300268cbd415491b19b10b1ae7f0b47da86fb695953a5081af0cef04b4e1180a72218ea3147047befab090b318a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
241809371cc52fd8c3a3f672eee2a2b2

SHA1
29c460db7caf2354b11581be632683674c3a7d46

SHA256
9c65a5d7f03507e737ff5ebed0d210fa1fd0c0cd8c40637fcf5c7144d94359fd

SHA512
610a6e713da628a5615e5bdf441a08c6e93401d40e4dea7b4796b28b3819e90403addec113a480d55fbda60e1c1fccf7464c85a81f3e34b63b27aecb099fda76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2ca8e644b13b7e187769b506f44fa3a1

SHA1
7e7e078f392ca6f7dc1497d6a49acef9f681c161

SHA256
83519263806b7513f0d02319a05e3272b19ed0640305bd212709fefef20b3136

SHA512
d8f0950c4d2aaba95600c0844b96084338d8c5c49148c912c668300b34814f13589bdb1811751282e53859bd7ed11ba19ea8a6a6b7dee02653aa515c4567b474

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
807c6a25d6c23668da52b7351236f6b4

SHA1
ddf4a692e4ec3b5a57869d54eefa6b76f991a377

SHA256
5df098511e0845f95dc443a230ca74e0c330440840d64e0355a14f6316e894cd

SHA512
f39cea719dbcb5b6a867ed6ff58e600fb1d538f1f0ec41418e8c0952e3d4e339c20b96e3dfed6ba7e9b4fbc6e67066e8ca23a57fcfd803f0e48c3d5b1d06bf75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5652e613dd17a40b1997ace017448b6e

SHA1
57309ae7ae068b57698d1df355c947c3369a9d66

SHA256
3d19a5f47e1e8233fd72bc0268cb84f6767dffcf0e485eb40bc452c5e6a46bd3

SHA512
b1c0658873cb303ef10ffdddc71f507d7495db7cb86a35d10193202e6f244c308f1dac4bd38174ee84ca4d2599e47c48fdd9856318949c942f1efa62a588153c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
bf714b2dee6b21ceb7c856142e88ba2b

SHA1
c4d69a43f2466d3e1edebb36917ba1a9ad20eaf8

SHA256
74c71ec78b725c03355a6b9ec9b8aa03713d806398865282709b157de3ad824f

SHA512
3da9665d1618c4f8f3af16ec57e9454239a4d58b79b69194f703c3bc0b8be68d5ce8ce490a0082522ea581c22bb9e0d77f865e927eb9882a31f99d216e3789f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar64D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit