f08fe90dad12260bb1ece76e14b35715423d68efd42dc59ca9c782f2c7c9298a

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
15-06-2024 02:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aca003063a18eb35a17794ad58ad4a06_JaffaCakes118.html
Size

23KB
MD5

aca003063a18eb35a17794ad58ad4a06
SHA1

abfa407e4d7d6e8ad08ab040f6c3b097e40b4826
SHA256

f08fe90dad12260bb1ece76e14b35715423d68efd42dc59ca9c782f2c7c9298a
SHA512

d551f8f683f3fb6bd835fd561778b18bd309e22399c09570f1319a8315ae102f64ca1341543516aed8e88085e13b6bfb442c6cf5447e42ebf4a5821f97fb849c
SSDEEP

192:uW70b5nO+nQjxn5Q/ZnQieUNnznQOkEnt/bnQTbnhnQmCnQt2wMB0qnYnQ7tnuYV:XQ/f+g

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CC658761-2AC0-11EF-87B3-6E1D43634CD3} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424581171"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2528	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2528	iexplore.exe
2528	iexplore.exe
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 3060	2528	iexplore.exe	28
PID 2528 wrote to memory of 3060	2528	iexplore.exe	28
PID 2528 wrote to memory of 3060	2528	iexplore.exe	28
PID 2528 wrote to memory of 3060	2528	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\aca003063a18eb35a17794ad58ad4a06_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2528 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
3b4d5488849e1b6f4af0514e8bfcc983

SHA1
a2650af8749736f299a76351e98cea1642c0faf2

SHA256
6e43f9c71c2a09483b753788534dc9e7f7c812f8c89258ed045d216840c6d6b8

SHA512
80cf065904e1b5ee694f6e8eb80ba838a1544315684570a6e20c29e23dbf8a49be308f7484bf7ad3511bb411c4d1e0efda9790965c8cd152881b4d9f2502be4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bee984c5a49b7df3bb0faeccf34bdf3e

SHA1
ae76bc3291b06822027f4f6cc073f013b9981a70

SHA256
e08bde9e6568623cd864b64d995e0096c6d8a0184b11dfcd5a5d3b1865cc0dd6

SHA512
797ec539c6e8e34c82173415dfa8708b753d435f553a7526531015141b41c94c3aba55d54314d681240f5455fcd8e6f9f5dde1260e110b56741255cae80a1234

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
352466e74057fe89e2555cb4f4bbe307

SHA1
3687cbfafe98fb01a7b96e5b09fd7df9ce2c4ec8

SHA256
8ec0169e4aef416d4d850721c3d2bd2a03f56a77fa47427d7daf67d6de5f2f7d

SHA512
3da8fb1698929052c75dd6bfdd0180a02eab72e3b400be54abd44d532b743974bd592715d512dc82037619182106581d403628f534c5087ec8cd55d0d0dba068

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
41d7d2d4b3d98de677f9634e875f483d

SHA1
2f5f857ee275809cfc65a73efe8c40052d593ec5

SHA256
e56693e584875c85fb8af10c5cc8c530408560268e0f9b825f0b85f760ebf20b

SHA512
9b9b17b163b26c52bd9206956b4da23beeca8967b1ffea8c420bd3314ad4ededb2c3cfe36fb4ca85844ae5a8543227b98b196c33ff7383c650625bfa4e10e4aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b1556ecb6ba27bc397fe2031ecd1068d

SHA1
11a3aa7a107c04f25b49ea7f5d63482c9e2b88b2

SHA256
61e106d281f3aa9b3cd1ff725c844c6ff7f89787c06f7b181907cc30779c1b92

SHA512
8874c65e960fb6262bdd6f8f6aaaee3c9e204fb05b1fbb3dce919f0d693b9aa5bb647a2783e0bb166ba8debbc2b8c46023083676c618d6e9ca4f0248a612ad9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d8a4075363dbbf5b10f0e9875930e789

SHA1
1c359c3fbb1408ca91428dca77b4f510c60d39c8

SHA256
1aa56a9f282879742528d325a82c040f440b2cc1c4a6567afb28481fde6c971a

SHA512
603a61cf94dc8a5679274c0b1cbe2566a0f5d0a66d1fda78ae799158a866fa0e091177140fa7298cf5bc1a6e9167844e3524abab5a15f90dd6f1d1fb4aaf1ab2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
db3a45f8bde08dbd5b47ee0f73c70975

SHA1
5a36ad8c449ebc821cdc0bcc54015fcd1bde1133

SHA256
dda2e262230ef7c3f2be8d320fbf6896858c450804cd24f1256549316418c1b5

SHA512
47b4efcbfdd0750d5555fc3c580b5ae61ff4e3662206764244367d0e34ba3276eafd65de0e2fa8b944f36628ba3c25d9b5069f94cfa252ef40a427aeca251fb9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
51fb002b8622bccb1bb3426445f794c3

SHA1
674c1444ffb984e2950d76605037a50f4b28d33f

SHA256
5075816988c7fd58c1b1008b8fc10eb383cc1b68231ce5d1d74d49e5bf0fa282

SHA512
b4003bda884a856a241a267a383aa6315f55a755f696a33c26e05114d9f5e0783791d017ebb503bf7e213f408f32069b3c7e5f48d18231bfb627e6571a37a220

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
17ec4a5b3bb6df9765f988e7b51dd647

SHA1
4b77754a63ccf5428bd17198c7b0068f4d1b3566

SHA256
86d6d912781dab112615a26a0bd7388d94c9ec5494458ab98aca2511fef4a54d

SHA512
e60d7b7df15ce1b82461791494f96bbd7f7de07992bbab3afcd2ea024f50ecf95859efe3a34089733e700012d14523f3880dee3a6b5fe6820b3a78bbbe4bbfc8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
edf389c8fcf746a1a878035212565834

SHA1
904f88d71c1a689a9655ab6646b5ea83019f8be5

SHA256
6f69af14e25f57d9d256888621d6872670818e1764fc3a795a66c43b1fca1c43

SHA512
7cee999d181ffd17ac219ef0d776fd0d1e8079fc19871e5a6e712380d6e37c8adfd181b19a2ebc48af803fea18ff1cf22dba153ce1836814c64c8e95da1553fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
04ac24a7cb1d7425d9c3724c8847985e

SHA1
545069562191c6a2df09efc048c75ccaefe4ef4d

SHA256
1dd4e21b96bead26c60a925ea4b81bf564383edb9edf6ab4f9036ae60890502f

SHA512
d499bb6b5799823f61a7453b7057ddb7092620fdacf65f8287ec9db6ec17a77a9e4096ec045ac8b2882597c92bb66e651d92176a0ef5545662f85446ffa8d51f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1BC0.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit