a544b9b0973d48ff2d2fff2bdfd7eb8d26e13d2ad7ef0c004a77ccfa9245e2a8

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
15-06-2024 12:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ae68c56dd9095a465f6c0d490beec220_JaffaCakes118.html
Size

18KB
MD5

ae68c56dd9095a465f6c0d490beec220
SHA1

c6f34a6eb1daaa82ce3861f0807baf77d8bc2602
SHA256

a544b9b0973d48ff2d2fff2bdfd7eb8d26e13d2ad7ef0c004a77ccfa9245e2a8
SHA512

cf1271c924008887b4d1b6b533ea0c0b13caa421b2054cba358f2f99324d0f55da4038ece6bcb908ce811982d66dabfea5493ced20a3043b0b7b5bedb4adb02c
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAID4lzUnjBhvh82qDB8:SIMd0I5nvHNsvvqxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424616045"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FF881711-2B11-11EF-8221-D669B05BD432} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3024	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3024	iexplore.exe
3024	iexplore.exe
2516	IEXPLORE.EXE
2516	IEXPLORE.EXE
2516	IEXPLORE.EXE
2516	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 2516	3024	iexplore.exe	28
PID 3024 wrote to memory of 2516	3024	iexplore.exe	28
PID 3024 wrote to memory of 2516	3024	iexplore.exe	28
PID 3024 wrote to memory of 2516	3024	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ae68c56dd9095a465f6c0d490beec220_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3024 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
4ff73c2597c4a1aa3157a392beb473fd

SHA1
f87a6dd8a15b25552265ba2fdecf7e9850d9b100

SHA256
4e379c11d25138c458af092293a6d62e9c47a7bb782fa1db3e411300e162196d

SHA512
c5d9924afb769591b9a5110d40fca5025cc8386702b041ea53e50862d3bb1630a3bfcf91ec552d25f6ebb66d6f4e64a855bb7743d76b039b058e899bd93febd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
afcea8da703261c105dd9b9d86d7ea1d

SHA1
9ca13e3294d2524902b8df3ca466cd368be968b8

SHA256
eee2ba2362854b61d7fcd8dd6843a76730e5bbc1124adb682b16e8d9d1b7129a

SHA512
7d35d01cdc2d910211581e03df64577cb78aaa730e5efd055679bf38653bdeeeb96c6ed68ab3ed5d6a57662a3fe30ca9ede1893f9a8d32504a1e9925d807a78a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0665f30ff983e4362bfe8c5ad618bc5b

SHA1
ef684e1f16ae5cb091ef3d3b6711f78389f52ec9

SHA256
c18843b46ef598ec18f63dffd9eecf92bf3ab2174512a154de469c299d629c88

SHA512
3b15d648f129b59deb3ca87ef495da00e6d7140c96a50409cf2ab6d2a198ca2d4b35bc4383a0ca3a1d90c0f5058ee24d27e9efadeca2a35a74acb719dd74671b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a885ac3d12b3c6c7e394169e58d03022

SHA1
36e639f00dd96cb937a64405b6368377461c434f

SHA256
ff0aba649b72255f7ab52ef449e2f91a89e8f0c7ad665238045c43ccdf0f725e

SHA512
19d9c6d8a227729229132624a47da3b36fb5e84d7b4cbb74f9f6bf8ad5fff16bad4ee91570cb16651145599d215a76dbbc109b113872048933fdcc97b40b9a19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
52dd1aee14b7f0cb8d6cfb5a5018970d

SHA1
1b178152433e58d1e09752ff11b9f9a97e431eb6

SHA256
004a5e8871505c38656bac0dc108b9045040d56fa11b1bc329365093edbaf95e

SHA512
1a16129b95852b1a85de153f17f3b569602b7d0fcb95a21a494dc4c3b87c71a69c5f5ebcd4b2e894b11e689f7401db6fc16f546718fd24ff988eab95888bd38a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6e88bd332bcd765d3c1a3fec6ceffa71

SHA1
f2636818666515dd80549b210f18f55a3228fc77

SHA256
8d483b9a69b8cb32f262397e7bcdf1f430d79daa8274aab8ad74c0f8a490b581

SHA512
d0bd09d20964059be53ce6691c7a03ab5ea023b0678cd06aa502538d0fc04649ff401c6914c2421aa5f8edfd9781b4474216b71daf4509f0b661b8d73b7b3379

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f6187db5ad3b884cc7cb2d21ebd479a5

SHA1
e98985d9fd19ddd17d8a6ce05020246dd678e92e

SHA256
dddbbbdd123661f73c777f7cd146d68e2642c5d3864c7dc1e5f2dacbe97d9e61

SHA512
a0512af41d6e72f72f750051962fd6786aec527b13633aca4c686496ba679f70c8d2c8c0267f065de09e3b8a94b64584663dfffaf1818db6a99f86c23961629f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9f01d54b1e5e0959173fa4136aca5f46

SHA1
da4031400d1b664b83c8467adffb52ee94b2472f

SHA256
f225cf1f1a2629339477f6e3454703e8b1c969c4a4932e6f23d8dc4b55dbc8fa

SHA512
5ed65ea567f3e7c63e671f6c39ff69959ac8f4b9788a03d2d544af8f862e3203c337ba15f55ec62071f598860d0044d75d7cf6bbcffadd404efcf786fb45415a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fcd798384bfc1b624dcb4ecf82ea215c

SHA1
3374950d770a4ab0fffa6afd032dbb3bb854811d

SHA256
4edf0e43e74bd8d3d72ff8530c4a8b1677bf9414d47e898f80769a682bd35d9b

SHA512
38c65ad6654fb5d5e19b96b9531f7b847af7fecc49b38d1c9c9f5011771137d37dc20203ad21182be226a50b8aa1f12fba3f2b6815a6cf8bb0ea01c52c4bfbc3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a361ce7515bb669359d28f4eabf67d0a

SHA1
3af2b13a84f565e836f1a54b97413820e34c3746

SHA256
e4bf097e27565d43fed2ac7b698204c04db37e4e8ce961ce46ae26eba0a1f95b

SHA512
5b44781b50bfeb5a5703bfefef39f479c62838df9dbc8d50d03e34afc3ddbc5fc517bb9fadfb34920703bb4d06c57e36a62c89e25eaa76a83b1d9d2cbec586ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
101d1ab2e9008bbdc6227460bc180b46

SHA1
7f1d160e71a8324d894c3cfcfdcec04bb00f9612

SHA256
49584bbb3b07a20e74c8694a25caccaefa9a8331b751fce5205c9265371fcbc3

SHA512
5505c6a33f2432714c3e6500c8f4d3575c44e1f9ba65583ab0f326e9b18bbb083efaf9a9bf271f62d66a53a2dd1535d337a1816c38f448a2ecb96ca97c3ffec0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1BA3.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit