240c8d8ecdc77f58b3d9322462a5c490d116a87cac561a8507499f8e9a9292f7

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
15-06-2024 11:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ae27a2d8beada8ec0e114dec50d7067c_JaffaCakes118.html
Size

39KB
MD5

ae27a2d8beada8ec0e114dec50d7067c
SHA1

60f93ead032a6cff288ecf933bf8a2b6971595c1
SHA256

240c8d8ecdc77f58b3d9322462a5c490d116a87cac561a8507499f8e9a9292f7
SHA512

2dd9ad22bbf476a3e104d6136535782abe39ba24fb3d03a9fd13fddcbcf908882f2b82536a5f3f51daba6e2edaf6a9ea27f14ece70ad17874686d907976084e2
SSDEEP

192:uw3vb5nyenQjxn5Q/unQieNNn2TcnQOkEntWUnQTbnRnQmSPxOPaN0sPhJ+WQjb3:EQ/YTpAxxZkSmJB

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424611895"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{55EFC3A1-2B08-11EF-B9A1-EE87AAC3DDB6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
624	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
624	iexplore.exe
624	iexplore.exe
2000	IEXPLORE.EXE
2000	IEXPLORE.EXE
2000	IEXPLORE.EXE
2000	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 624 wrote to memory of 2000	624	iexplore.exe	28
PID 624 wrote to memory of 2000	624	iexplore.exe	28
PID 624 wrote to memory of 2000	624	iexplore.exe	28
PID 624 wrote to memory of 2000	624	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ae27a2d8beada8ec0e114dec50d7067c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:624
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:624 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
03bb6078c29fd176e4c26a770d57b24f

SHA1
2b205b4a5b029a2feaa19cd928037591ec295e8c

SHA256
4fcd6be425cd8e31ac95988e4b2e505ed3c461805adc98b72452323c41c7ab55

SHA512
be9c63ed8a9c8093af08990718f7ecaaa1f823e88880f6f154ad9821c08870763cd243b17f3f4011f4c3f5e72236519147c7efc7cadb1a8d6f112feb612a906b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
698d2516b4db3dad436792e9809bacc6

SHA1
7bddfde58c6c18e89b1b4404b2d1157e104d24cb

SHA256
33baf7de10b245192f7af787f6f19ee60618590adb91b27e2b5ce1525f524eb6

SHA512
6b87c641ebab80cf1a8130507c391de921e3a039914150b9f37dfdc5d66c16ed4fdd41accfbcc7ee951ff8b57a1c7353112e21406fd021592e3792cddea7aaea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
86e1b120549cb18be0c0aab2ce8065d9

SHA1
ac7321b7e53762e2e546eb51aa7ca431650870fd

SHA256
b1d7ac4cffb865d526bae3d3a6d1c0353fd503761877b513dd20b81623fb0fdc

SHA512
62c91ba20a717cbebb2c0da59a460d09b4787f2eb8b7a7488d3426f650e3b4369e49e7bc42df24651618fec9d229e87d8c74109b2c51d5a185fef9ec92019b18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cc0e4cea3c67ce96a2d8b1f23259eefa

SHA1
fccf40dcc95244e88d0ff430bf722b9a1e8dc53f

SHA256
26a6b296cf5993a35a6203f0ebcf716a8c57c5088e7e888e9983f12ab5b20b1c

SHA512
d7d924c1c490db4f2b35208b7c67ffe2f7b35bd617fb0b1d51e6ad103c067fe43a348c9c8ebd4729b3e0120b1f19067149deb18d80f1cb7a73484796b329fe51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
17673b105f653ac97381bfe5c84e4791

SHA1
e8bff76a192568d04fccbd2922fc63632808b7ef

SHA256
f2f3af973b2c154f3850d4e665b13a692b8d6fedf6536bd7806915cbab855490

SHA512
62ad4092a366c6e00fa6699e26ccf7d29c34d8b0536c6f03067f75409cdd18f82b4567944f8716a28a6af506d89169134ea83c7c0d21ba88e74d23a19cf5f4fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ef024965d4c0cf398376b986484ab985

SHA1
62c4adc29c56a72bbf01990384664551941ec969

SHA256
7d63e81c8202455bbb9587112f1fbc1bfa7bc025ff7c9c7716cac8067c452698

SHA512
cf7ff42ba48137378d8ebe193cece310733c7469b7191177dff3676fd210379423860dcda6f040fecb30f88fe8c67d2d567bf2b31c210734789c4d85bdb43da0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
635ba1d917231971df5933306cff11b8

SHA1
05bf27be5f6e1bf47b3448bb1438718c537d45bb

SHA256
c64ac9d26e114dcb400212b1e3d0c5661979e10cd26f234ba7531be34d3146b2

SHA512
ea5b67b95371c4ba872103426e5f42b1e76fd64fcbf4b16ca360546e41fee4165570c306742878f3877fab85772c199c4751a6cc72267bd4e9ec3cbd0cf4ee9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1d261d683a60b06a7544684b0b0aed8d

SHA1
955764805e9a8c52728765c9f797efe4c883e61d

SHA256
f9e69f7787b426fd7a510ac20523fec088b74743d4644de56371311fdb79d05d

SHA512
6bd344d9ba3ce3ca5285a86bd2254d69c28248a67b48e2c307dd8d3dcbc84611a15c2a61552b5abdbcd0bc9c5597e430cb88147652d252d091e18daf429e7458

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
71ce417dd0c99fa393483ec9a5fece1d

SHA1
cfedb67151e8fa2a45a9824158e1551034546144

SHA256
3f2854ab8e8ed461f3c38c6934185b075f01726e53d3de49ff9ce3a06e643ca7

SHA512
83c2fd0d6d0456f6fdaf060c7ef5c33718b7b20a7dec0126a0b7603847d7d8bc94e835fb8cb9ab7b2aa410aa9edb9a3fb46330885e35c134dda160785cd2929c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
452b95b5e91dd47c404a948b7c58b3d1

SHA1
87674d740327deb3f1f39f66e035831168c02727

SHA256
1687b8d71f9aa902426d02d46c2c6606b038b6e8fcff0e4bf825b92b7e56be52

SHA512
ad96bfe90eafa1cf0dda3b3ba708bf60102083da9935315b10781ce4145d5c8d78f38235b204ff514f30e3438e4375ebb4fe47168bf0fbc08a279d472cfab5e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab10F2.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar127D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit