34ef08f7641420f4843710078190a4694e5a5900a10c26f2e48a79b5dcf241f5

Analysis

max time kernel
150s
max time network
145s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
14-06-2024 17:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aafa08a586d6662da99a18115d06eb19_JaffaCakes118.html
Size

27KB
MD5

aafa08a586d6662da99a18115d06eb19
SHA1

6a64a1bb4a8b0978a08be2ddd26c74edabcb33c1
SHA256

34ef08f7641420f4843710078190a4694e5a5900a10c26f2e48a79b5dcf241f5
SHA512

b7d2f5fe23497a45479dbed968b9b209a47fb3f0696215438e8781ebdd07c5ecc35b9412729ca072b48caa52a624fd3ed2638870c9aeb88d1c525c61c713b28e
SSDEEP

192:uwfMb5n0SnQjxn5Q/fnQieWNn18nQOkEnthxnQTbn2cnQ9egum6uHh2AGoQl7MBB:VQ/z4nxmu2AG7Ss3o

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424549071"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0E28EF71-2A76-11EF-8B35-D2952450F783} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2208	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2208	iexplore.exe
2208	iexplore.exe
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 3064	2208	iexplore.exe	28
PID 2208 wrote to memory of 3064	2208	iexplore.exe	28
PID 2208 wrote to memory of 3064	2208	iexplore.exe	28
PID 2208 wrote to memory of 3064	2208	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\aafa08a586d6662da99a18115d06eb19_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2208 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8065864fae44e093d823ad39d3359af7

SHA1
a40a231e8e12060f9ad903dc023a5f3177f51c34

SHA256
d91cf61eaeef4e34a240007f45c940feaa7eeea5edc502d6be1a74e719541cb1

SHA512
f532ab87dee5c72c9fae9abd6a2e513d618d01d878a9a3c449bff63a700bd8507de428c01a00fef8916db156f5fc02f07c4f2ff9cf02cd84b89528da37b06d00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e14f0ec8a2ea71c5b0056b6dada741c8

SHA1
5694385ff763ae621fa48e127da7dca53837e9ee

SHA256
5ba95ddf2a4872df1af2b723e61c0949a6f311e8622a3d28ddbcc5fd980c006d

SHA512
59e7490f2d037f6f7264685fa1b69ec33e163307f9749699133b8d4071a7768b997e50b81a0112654019ab478423965688964035ad2efa33ebb66c6fbef4be32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3997bb26cd5109cf3ee5f2e7f81fc427

SHA1
490609e6f8e4bb8110179882bfa57d5d33a5c4db

SHA256
d5b8fd40039fd8e7b5ba17229963a2549e365b0e55576feabfa1b60e8244784b

SHA512
009ba97766d3933167bc1fe40a9101a11743974d86630f0ba0ed05d448bd124d21b5ebe19ddfa12c301c63642b8da13077f9057e44e992a993798bdfe3edf7c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
106ba7a6e14f161ff7ee11c6d219deb9

SHA1
c4a9cec15d6954d074be14d5ae0e0ed5f679375c

SHA256
c6e114347bad7ed4f3a8088de445dcf2dd88eb82ae732fd5c2a0594faeae995f

SHA512
846e30d11155625f478f363bb0f4c40ce775d62f85d37d110268f21f963e3ddaf32ccec01f475ca29c7f440c3afddb1d4fec7da30d18c9d441826477fde73d24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
28a949a648a20a8fbc7be616c5a053b0

SHA1
e003a9e69a3f54b2c5b3a76c6a037611bbfa5390

SHA256
14b0392eed8d259ec76f4dcb1c9d10b4cc57d012cbcb32cf5de29f1d068d0f59

SHA512
05a0ce5c41dd8a6e69eaba4f318f314d19fc8a4b2bc5dc4aa837058e19df98677b599504abcaddf5a6aef8307c7d11cbb98a52b5c39c21ecc25af1cc90f027c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
037c21adb8557a8b20369983ef4b84b2

SHA1
0c989d5583425f95adf572a95b868b03bd0ab838

SHA256
fcabe60e9a2094dcba12f50bc57b174e6c22194620752ec2901fbb0e73ee5c32

SHA512
6e26601b773ab80825400c6d181a2e2344a959d31a98fc23294f8ab71b39ef3d94fde0498623523e45d4e59219d58e47e167a0e94f27d2e9c2c1f2e9783220e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b1e3c382a28e7e430381619b1f5c681a

SHA1
8167d424917487080218785e64f5cc830e531888

SHA256
a31ec6233953c6e74d545ea45d850fc88af3e44e1523f4d9a6ac4ee56de5f969

SHA512
45c71c86a422d027831ae4e7e517aaceefd1c0af8d2b63b2c377d476daa67c01c700131ca0ce7ee386c8b5dc0030abf23f46b15ed88382e314e992f96cb5ca85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bbaab548d5061c60c032c80f3ad7fc14

SHA1
7d50705c616f7b7bad973309a73671a5de5459c4

SHA256
947c80acdadba4ebe1b48ecb8c2d38842a2c4cd05186c266956f94f9b1853c7b

SHA512
91c7b94c83be34d9cecbafd4b4789055a49ae0ba715e18ae7f544661bd377b0a1a33960f8ff48e54aa2becb5eab27672207cbf3510c478615b9d1a0103da8b20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cd3582492f20ffdad5dc919a71b1097e

SHA1
a0db818b4bb5150d893bb33db1a0e1d6d52b34c9

SHA256
f718fe00c1094081cc61e5c03656a32e6236b1cc88558c13e83866aee4645489

SHA512
7222893611f8d9dbe67a3bdc06a2baae1ae1e350841f37fd136728362d24df4b05efaa5745bc70b7cfb83149abeea5bf39b78df98cce23bd77e741376be3a5c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6B52.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6CBC.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit