acf8205b033e533fab5ccded79af2393e816ffee08f1c83d72fdc7aa7a68d251

Analysis

max time kernel
117s
max time network
134s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
15/06/2024, 13:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ae97f69d8d1c66d36132dccf4ba90531_JaffaCakes118.html
Size

461KB
MD5

ae97f69d8d1c66d36132dccf4ba90531
SHA1

36412cc49044a4b82fbe4bc7b3155f0c6e586be3
SHA256

acf8205b033e533fab5ccded79af2393e816ffee08f1c83d72fdc7aa7a68d251
SHA512

192f3b7cecfd0c51bcb2daa4252fb909bad0179a18c29d6b8daa68f1e12e66f72f70b0fffd9e22fe51026541a76674ade3ed1b7217d4e2311a441834b8e55fec
SSDEEP

6144:SFsMYod+X3oI+YdMsMYod+X3oI+YzsMYod+X3oI+YLsMYod+X3oI+YQ:+5d+X3q5d+X3t5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90566c6d26bfda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{944F0C81-2B19-11EF-9BF5-F6C75F509EE4} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000f81075e7659980abd9f1d224a5f914ad821bb719ba37056678f3bbb2a31a4bcb000000000e800000000200002000000005a8baddba504ec4e8fa502e648da1a4f769ec254f3cda6efd14274df835fdea2000000086fc6edd3ae74c40ac41a2a9f4ab3e3c21773382dfc1ab4326530c3f84eb1d3240000000656590258804df378532d75360fc507e865cb8604b3d646e86f9a803415f7903ad3b274c840cae86747c2171cd08067b5bee7ad0afa3d356d479f81005cdd0ac	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424619303"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000ec440b1110a8e1d84e7cff5676a4213296fc6ab64806f1ae96a2723f1c535240000000000e8000000002000020000000f78c9bea2045a401259f46a3c4a689132c028e14066905f449a5d2864851276390000000745d5053cd50ad6d00708b05d8ac4a8eea1f76b66e87b22b84c58d8abc4e1d4cff5a5e89fd24e88415d608b4ad26aec754872d02c5eb8f5429bb4c0ecd956315918609a06ef1ed34ce015eaa36fa3cd03046fbc3ea0141fa247f4ccea478b0bded5d4ac2f53b306de92b27e2355946e655608af24ccdec170c522d6a4ea6ed9d9de994d05a91baa2c6714e1313c406594000000056b03318938b578889c16b4790699cbfeeb35e2fcf465e43cd2259369064c6717ab0ecdbf2703a337bdb91081bba595c3e39495468b9a5f9d05ef7a055f16f13	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1968	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1968	iexplore.exe
1968	iexplore.exe
2340	IEXPLORE.EXE
2340	IEXPLORE.EXE
2340	IEXPLORE.EXE
2340	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 2340	1968	iexplore.exe	28
PID 1968 wrote to memory of 2340	1968	iexplore.exe	28
PID 1968 wrote to memory of 2340	1968	iexplore.exe	28
PID 1968 wrote to memory of 2340	1968	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ae97f69d8d1c66d36132dccf4ba90531_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1968 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f9e00f9aa564d2f88f281d9dae6b029

SHA1
c58529ba62abc92207f890fa729a591f2fa322d9

SHA256
ee23f47be5e31191633e28e284af4a11543c83a25681c77f67c15407dcd78cb7

SHA512
c3a8f3248181f87853450cd3fdef765d4e2ef8c1380474ec10b9297f6cd9662e8f5a7ae531d6d4cc2f745ae1ba88c7324df9a4404c39ef390e597814cd24c16b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b8599e9275e19f0ffa9cfd501afe7f65

SHA1
8fb05613da746364cc8f276a2196b49b8df8bb57

SHA256
f82426bb9f6f88d10d784af3cc2a4b81a536cb78affd6c214588746178d6a7f6

SHA512
5ec5556d7959ff3cc02f7eb8cb409b1435dd73a149a213f9641db062c956ecaa8c3186f50cc19b9800d7c61fc06e0e401942be100963ab8c667f0d84d83ee08a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c75f592a0dca03351110a14772e4aa4

SHA1
fcb149f37b0c229cd55a57e5d15783a37ff5892f

SHA256
d3a65c5dc191471073e90ee50a74e468ec0e737c493e681541c09050865c6637

SHA512
206a34c7a9b7a3080311ed0c699649edc48ff65a7028c1e4784e6463d732b80dc62f9c6ec3eef0b24a16d3f9c9fa499de42ea7653015da72d3800050943bb6ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f249551c232275098dae70c7fc986fa8

SHA1
e3579623414325db1cb8415c602343568cfec932

SHA256
57a34e78d2d5ea3f443207f8b015d55e1d26115a100b1b70c4edf48d8d816f15

SHA512
929e26c135fb4f35cde8bc585216291fad3f749f0dd8658af38fa832823d3caf6f240e0a6cae56b729f7510aeedefcfa71afd3d71f43c33588fe89ca5e98a45a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
50641d34b960e0e8a034ac15c39c6bc1

SHA1
8f76f9f4f2ab36428a67aca3238019eeff713810

SHA256
87e4d34017e09d8985ab20b630f2b39bd071b890cf81d5e39b346ea5d1946cd1

SHA512
6ff578dacfbe3e2cf4a65308e66328216afa8481d18de963cd1703c99b402d48fab45e20132467ca1bf724858db560282e92e6ffe8a6aa0d405dba4dcc8db418

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c93f4512f88ccafd66553ea0b0291c9

SHA1
f4081dc484514b2c36d6d5f3f521ceb154b9db3f

SHA256
829a66ece7764d72cc3d2b17c3619499feda9c2d1f51edcd29c060c8124c0a06

SHA512
83b9cdc254dea9b7fe672b9d9f18a6a301336f1cadc1a6dafdfd495e75c65457bb92967b331e885b985126ea48a642108a728f0971ea8bef8d0cfdad65d62d12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
675716f7d22b80f0bbd17f20d845ed9d

SHA1
f51332cb6cde0e3d92a9f054e9f51130062bbb08

SHA256
6a863bbba6b41252210fe77527208dab8cbf02b50a64b7be26c8e5a07ed2627c

SHA512
26deae32f08a5a1cd41c7f1d28d4cb8f0818d8460584b96eccd82863ca8b39e1a3ad2823f31e82448dfcb20ce85dd37631290c1f142dba612d92847c0f86da53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bea9eea6a33169365563dedf723d64b6

SHA1
1b8059eaa52b49beda7e58ac8281b4f83f1cfb3e

SHA256
7c2124d11742d51118becf8941d8b94a2ee9557dcc996c30299b28f136c8d71b

SHA512
a4709c982a29f82ab8d9ccc61b633f960ce80e976d04980d0caf06bf4b1030d1a20c08d1f0b5ef0e72c29aa4e2c28129220c5fa15eea07702254677cc4182e34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e5fd6a30cc0fcfe7ec5b6347a0153f71

SHA1
64b569e451ae802afa4cfd5f35ab4d613286f3a4

SHA256
90c7b134ac9317b65282b255359a84170c84d901498c438b1db3a219a8649fb7

SHA512
ee72bbcb28681fc6af39c8b77b030210ce7fdc7ef5707b4644ed00daf57a7c134c9a2dadd6ba121953ac0959bd6cbef1bbef60226226cedbb08886733564cd7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
470903087cfcfb74c21f4f2ef77e0cc4

SHA1
96824e0cd52f4e84f37c836997bdb457df0ae38c

SHA256
5f3f1a1dd760c7a12fb56688c6a703279a9b49d69851da653447c3f4afce0b7c

SHA512
583a29f173ec5cee2981fed4082f2ab58a4d5ce17d750db273bc2e6619bfa8376e68e7764ff40983133395db45d2a80c134e4050243a33afcac917894cf2cdf9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
28b8c00969e387df5ce232f04331f739

SHA1
d9b51a810bb37ff78b354d696f4071ccf5664dcd

SHA256
8a83a6f272dc5624e65f7c892561655ff71bbb47ee255a455c00196a39b9efe2

SHA512
46da568ab274426c31cc0f7ae5d64c11e93d38b634881953ee6eb3e4c374551ea00f04f88692d04f8af6a2eeb61875ecdb610e96404be98cc2583fc1d6555152

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ed21648f4bcc5bb8ce436e22794eb41

SHA1
64325cd4828b02e59cceaa3c7562f634694768ae

SHA256
0f2eb86deb01b80d4d9e0f3a04458457dbbe8d76e51bcb25e8f328b21383d8cc

SHA512
5d3296bcc34f99afd2673e14b4c4df7d9205696d7390c48b18982709ed021dd64393a8363964ccd03ae9052c0bb343f622b0e296bae1442ac3aa547924610793

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9916.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9A14.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit