b88ff8c5aabf29eda771fe9818a8ba82d15902b1b68a7123ea8108b6856f4f8d

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/06/2024, 12:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ae7293e30404ab1a047deef4a130e844_JaffaCakes118.html
Size

23KB
MD5

ae7293e30404ab1a047deef4a130e844
SHA1

2efc72c5df2738bf97272c5233e95b375c9ccfdf
SHA256

b88ff8c5aabf29eda771fe9818a8ba82d15902b1b68a7123ea8108b6856f4f8d
SHA512

a1ec11a8ad144fef9447327741a280cbfde1ff2320b4e0b52ed5d59d7ad1f008a924612f05508ba1d367fd2fa9d92c24fc273e758d54d8381d6b33471d89bc44
SSDEEP

192:uWj4b5n/ynQjxn5Q/WnQie1NnfnQOkEnt60nQTbnNnQLCnQtRwMBVqnYnQ7tnYYI:GQ/B7z

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424616642"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{635981B1-2B13-11EF-A293-4AADDC6219DF} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2156	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2156	iexplore.exe
2156	iexplore.exe
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 3008	2156	iexplore.exe	28
PID 2156 wrote to memory of 3008	2156	iexplore.exe	28
PID 2156 wrote to memory of 3008	2156	iexplore.exe	28
PID 2156 wrote to memory of 3008	2156	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ae7293e30404ab1a047deef4a130e844_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2156 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b0ddc2c26858ed60404f08278a818f0f

SHA1
55b3c864f4835fba7b4840cd0f0029110eedc707

SHA256
dbc0150c0d266ab030851a6b5ae3cdeb169d0bacb9d7205234d9484c01ef75ad

SHA512
2f1e7769756751ad8c4570830a123a17df75271c4225a87e580175f6df3196ee2c28b7e41255d3d0669b28e4398920f769531db4177b08d6924170abe9e58522

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d3150bda0363c5e5804b4a4d2d039e77

SHA1
d5599b11548c47c78a6bfeb18f70d44fd61d110c

SHA256
fae62257cd07097a68ac117ecd47565d3050955cbb282f73fee69a182d845e56

SHA512
d3ac1e65daa0a71f92fbb1f548e5ae8f0dcb4eb348f56676d34f75321e3a7005bcba9457a5b66afad1d1eef21c060820f28aec807e5a7ef6921149021aabc097

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
41fe55b3c16491f1eec13d82a692d795

SHA1
804cfa61e0e8477829f340cc723ea8316cc66658

SHA256
79adb3921691a0c94a0033c0bd5da66b3a81dd099a1671e2fd112dbc24a99476

SHA512
979d8356f183f9c70de0b303d79258029386e72553190414f17b12928bd851c9e8cc06d456058c88858d1fe0e8f51088fa3e963c04ec7da488d73c4272abe4cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b4e522e3046b7a54093388ec2ece17fd

SHA1
655622cb2d71e37be58359696df668da038a0320

SHA256
67f5314073991cce5f0d1195d05fc312814a0a13b63c1ed57e6e7f7ae96ddd40

SHA512
7bb51616d70c22df27979b6a6c40718bedd5250c11ba5133e1bf6ae91656ff49361af10db3048fdb816fb305dab54629b3e99f6915430f303b1ed7d9cdd6215c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f6ee3b774beef0273f0c1a0355a01b0

SHA1
a9babb38a6367700d2715cc10e7229d64203e6de

SHA256
e46b28f46f8572d593912b769d8009b75adc9db59dd01d7679772357ff8fdedd

SHA512
eb4d609e3995a56e4f02e1403ed6066eedf65ec26635d6bc9dc280ef60e7b64e33d32805f0229f255666ba9e3c857f7bf80ef6fc1835d184b2101ab76d0a500a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
59464e826440df817cbe46d999a281f1

SHA1
b24b24a7198233185f13212d5d218eeb77c0f586

SHA256
1ac90768df1490e02de26baaf1546cd517c3b14d4b8c60a312857be7acc8fb30

SHA512
0a61f34797bd89fcb2503cd41f9d28e9712693278d5badbfa914974df003ea278346a194b78df66c0e79a54978580d23adf843d6b7a853336a7b99f61d013702

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
08e6ebdfa11971137093ba86d5c88134

SHA1
7e7eaf91f9b1c2156301222cedfc06693b5043ac

SHA256
5fcb54459cf4a923fcb690d8f50ddd67f07a30473016bc8867999c1600b8b030

SHA512
846f0f36453fce472e22639d7bda09bf05bf706a705fb60c04a35a653bf836bb09e65a52a7c1c1391784775c2730562ce525990013696038a0f244d7761c348f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3ade20c9d998aac1f63c94bffe22a91c

SHA1
9a9236d20fb09e048573990e9a3aae8803225fe6

SHA256
c8bb34d3cf28b7c606a83fb03279bf876d357e7b814d6d83ccd6aaed79de870d

SHA512
edb53b907ec4e1c38aee30eac581fb0dd43f7933c9e9a6e526c8083494ea29a1be99b1b2346a404f12ddb7a8feaa8338a92379c45ce3a1a6717c3eef3ca84265

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d234d1048b607460be6bc52b968030db

SHA1
416f748f0a92fba916a85ad18d106930b05233eb

SHA256
30e336ed3e456cec4f9912efdd96b46a10ca5b1ff81800f38c5721dec5657e0d

SHA512
946edc4dd0c41c059fff1fd8cbfa7ecfa49af730634051f6cdf88e32675e42eaa62d67161b69c719f9cf169b96afc226ea3279765ed0f562debb83365941a674

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab141E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1500.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit