9384c26ba76c24a2ab5880f6471ec1c7c1c363c788ab7aa73a76bcf7975891ad

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
15/06/2024, 11:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ae23b7590d6dae7d3f04b47d13da59c0_JaffaCakes118.html
Size

27KB
MD5

ae23b7590d6dae7d3f04b47d13da59c0
SHA1

f39ab864f49d17a9bcad1e0c144a5d87676632a7
SHA256

9384c26ba76c24a2ab5880f6471ec1c7c1c363c788ab7aa73a76bcf7975891ad
SHA512

f4cb48d07d0e0d401244b5e5aeeeb0b71a9ce979a7e63325547527710abdb69031f7c326237d8aab7a001bd20b832e6b743d57050b94501925c21db84bc39ddf
SSDEEP

192:uw/cb5nOGnQjxn5Q/1nQiewNn24BnQOkEntnHnQTbnpnQ9eKsm66p4WQl7MBQqnU:zQ/Y4p3Ug4hSK99

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D5D51DF1-2B07-11EF-B73D-E693E3B3207D} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424611680"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1640	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1640	iexplore.exe
1640	iexplore.exe
2928	IEXPLORE.EXE
2928	IEXPLORE.EXE
2928	IEXPLORE.EXE
2928	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 2928	1640	iexplore.exe	28
PID 1640 wrote to memory of 2928	1640	iexplore.exe	28
PID 1640 wrote to memory of 2928	1640	iexplore.exe	28
PID 1640 wrote to memory of 2928	1640	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ae23b7590d6dae7d3f04b47d13da59c0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1640 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
60872273e79fce51804477fdbda46891

SHA1
a65d7a509bb8f8344d1ab37d4c503853130438dc

SHA256
c4538d765a3fb7176d697cbbea282be41eed0db2bb5f95818af15efa52d28714

SHA512
5559d1c773e4e72a177641827b0714f8625bcefff63898fc3770ea90ed3a2748db54a779449b1e4b14b40fe15f01878f4f3ce326106087a8e71c3acedbd1ed20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
58b773997b0cb880418b22654aec26e6

SHA1
4cb7dfe67e6243b94f9338f167d36ad69578fb6c

SHA256
c582320f5e1d7d10c7ed8ab8319ef004aadb19180018cf7267e3e17f0b474b6f

SHA512
a3657898f2a5f1faa59a52e76f257058a69328b5e487afb6a861d210ce576cf87d592e9e9df1458a16ced68d1a640c1c209ea8e43864b661d705f69ed689a7e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a85e1a4fab066ee4927335585e1b0f01

SHA1
4fe9d745c23b78ef6996c40660d746d6bf14af14

SHA256
a86e36d48b34e280b9d9474efd3fd8569e94037b53921c958e7ce5fc69c2ee75

SHA512
f360af8a96f7b64515964b5d8d1fbda5d5f115e4d94f639a9182a468ee0596f5faa0378128b89a062e18fbbf6c7ea5a18d8aca75c8c27e20530dcba40d98284a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b30fc6c39531e9d03cf0c429c68c46c

SHA1
8f903c50c46c48d3a6918d4aafd4f22bad31a5dd

SHA256
bbfe8202461c2516499421bec215154991e40f0a9f9d304850b10835657d9980

SHA512
534d205a5c7303e0063fbc8430c380b73070af4425d00f1594b404f253e0d4b1a2fc51f39f972c2b21732dbc37bc406d1a8d15c205e142237efee7905dee5a20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dd93cadbdf87b0db0769cc09d11e029a

SHA1
2a9891e49540c16faefa0ea0a2b57ef8df974dd2

SHA256
f762260ffb07bab65577dd0169ea97d426f55a26e3dfb0ed157cb5377c2b72ad

SHA512
e4b98a3e6c849013711a4e49e874ccc96baae97fb5ff60825e4dfcbee5869f11d775196d28036b11b16d9e63c677fbcfc3cce86231cbb6950c0818fdb6a6647a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
73dc208fc32ed1872a8121d29c6e7714

SHA1
e60d793ddcc773fcbd965e046d1991237937727c

SHA256
d8d389bd036b37669484f5ef589627b2b42d0dff7d8b54f187e53e1e8e0f95c8

SHA512
d01ffc422599de97e2a8efe202e51ecfa17e0583c7bea7f3baa172686952334b65d47f7e0c70417226e3ab003680f64641b2207ca69377cd8903dd219051f54d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ffe68715038473e01aad0eee5c918fd

SHA1
67aa4298b108b231cbbd0b1074a7b348afee597a

SHA256
edf5c3abb8106a7b6a89644d343c8cb2df8c122a821a8ac569cc143ef3ba8100

SHA512
0a683373ba597d95163ced35328c879728172a359aa674df4481fefa9a5f01462358ebaaccea57355b5dc83e41bc6af121b0947ed3a34287da017ce171ec74a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
824e77feb8be6edb8436db73c87dd0a0

SHA1
40841483bf038b77439ac0e711ac04a70cc1432d

SHA256
ae649f6f46603d0c9e73de74a6c1c9591829b0fed8477f2231912f33d0bbfd7e

SHA512
3df8f7e1debee79e155f59e3ad79135959383c0a0f99a6aa5a2f6b5b8c5aebea5cecc5730abad733cd95760a0e56167beebcc605b817652742cd97a3e0dcd016

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f6b7853d6ccf447d36cc68a538019177

SHA1
275ca166cc9b8dd6f19c6dcd1053d1e4e579db72

SHA256
4552ea0e94a2e52999d2652547d17360b71d0edaa54035b7e3165d0160c7baa3

SHA512
d4561531b09a436a36a33ddf76fcb49814990c61fe2579b9a0b4b299ce8e0a944711052c05e8d2111989ee294725b7d406e7c7df1f3324faf0291f8bb3155571

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB37.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC1B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit