59ecd4b9eaeba798abb2c356664a2ed796c2317345f187f3507a903cb6a13fe2

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
15-06-2024 14:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aeebe857bea50b7ab2e75aa4fa439fe0_JaffaCakes118.html
Size

23KB
MD5

aeebe857bea50b7ab2e75aa4fa439fe0
SHA1

df44a33fe29036eb200329962235ac1e87e6abbc
SHA256

59ecd4b9eaeba798abb2c356664a2ed796c2317345f187f3507a903cb6a13fe2
SHA512

9ffbf7bf194ad03ab9d7142f402ed13132a5b55546fd8d7bd8f4b5e9469cd3e8c9f8d38b3a9a56cf02e09aa17bc1d626ff0074995892386f7db17977065d5f86
SSDEEP

192:uwDYb5ntunQjxn5Q/gnQieDNn2VOnQOkEntkmnQTbnJnQ6v06J4RnQNjMBjqnYnr:EQ/oVdv06kdY9S

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424624482"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A462CF11-2B25-11EF-BEBB-767D26DA5D32} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3052	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3052	iexplore.exe
3052	iexplore.exe
2760	IEXPLORE.EXE
2760	IEXPLORE.EXE
2760	IEXPLORE.EXE
2760	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 2760	3052	iexplore.exe	28
PID 3052 wrote to memory of 2760	3052	iexplore.exe	28
PID 3052 wrote to memory of 2760	3052	iexplore.exe	28
PID 3052 wrote to memory of 2760	3052	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\aeebe857bea50b7ab2e75aa4fa439fe0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3052 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
73fc7d837883b4bb23a58bc35d273451

SHA1
ce45f158646c800b9dc191ca888d95d4f8806c59

SHA256
50908b3c58a06662a18619b6b239d824dac70007f2e7ef18c65c6f74cd8d3fdb

SHA512
39acfda84290d037bcf988504c2a620a57944c74f54eeab8e379b26c658f7a6a13926fb5253ffc5604cac0528efda2bc64fe428df7920daac9715030cd1b27e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eba9613240db53de951231e6ac83bed2

SHA1
fc8eda6a589fb54deb7f8d09e9b950aa9067dfd5

SHA256
0681ee935588aebcc51f40fa6526b0b6f63bdfcb862314242b082fbd69eefe99

SHA512
35890e40a56d4511c459db8d6d3536fc589823704add642ecb379e34473972e72316082cbb22dc19cf0eb905bc6b51761ae71b855c2c857f60ebafbe0a5c26a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dd046447e633d4baf2eae942ad46595e

SHA1
ae66609dc255ecff5fe5d7be36c8d9dae33a51f4

SHA256
bfaee3e2fb70a143fa894b3a6bc178005deb167c66303311610d46f06d2ab57f

SHA512
4000d00b3a56e96d431ebe6bb84b70ce8f9799f665f69b2db3563d5c118a09b791b17dbba69e9057ccf06739977e51702d79cc066c7d52b493235f733b2f5db7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c2b336b85460505f63f30a0cb0bf4b5

SHA1
4f066ee5e2ba9dab469f88b2a243e736423aa947

SHA256
232fc4e8458eb41f9dcb536aae719a2b16de1a510472b50d554c506a8b12c1cc

SHA512
99dc0ba4196e89514709793543183e895ad55e5479e9262b19e0f87170b3a78a481926bc79fb828268c798d28c818e20303e3f97c8b7199186f30563c055da88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
576b0f627ae0b1dcf185de2dc372dcf3

SHA1
46152e0fd6f3d430c6a54644e388b2fb4842fe49

SHA256
8d505335de2d2a9b8e9f06c5b0b890d88de16f7971e94c15d9b0436f0126f975

SHA512
f48136b43cfa819479fdd33c4cdf54d507c07777bb191a9801368be0ae27a374467cda4d6b3fdb95d51f900dd776e006b12f511c1f7fce035e20f996a6404e35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8b2a3775cbd482633e2b4a562e56b559

SHA1
d51b5cf15a79d8dadaaec81d34cccc6aedd59442

SHA256
b8095992364ecdbfd932aa5c6ddb8c18ad3f5059b8bf0706cd13d7e645467ccf

SHA512
32dd737b7680ae03c1cd27360a0abc5b953fdfef9698f4e4a27469b7103289836457cad8b3b4aaa620034c26895d05e085eeba8ac95d3be673ea52c4f46f240d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
215cca7736ca5814e82c5f725e551b0f

SHA1
d25cf723a32779ce47c725cde5f198e4b4544631

SHA256
ae0a11f0d7b0bb80eb20dc5979f2f84097454641e75c97a909527b3975c4cdba

SHA512
0f7505dc570144a14120fe65d4ca8e8e82c39c48a7dd3ab5f165404b169d36d778b05a42286dde68d39b9eb105b908d6f8b9cb9b536c1baf28ba32919c8e6a5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c92256e59cb05a3db78d4bd1aec40933

SHA1
1a4ea0355111a3d38cfec61c24a53e9a1316bdf9

SHA256
1a3b282863b3142a342bd77225d42fac132776c7a383e7d3b6849fedb6e9585d

SHA512
0b4c4618abebee643df8b40ca233484e1239aab87b32b3f55fe40c7744ae501b16b50bc75f40243e65fc04125902284edfe36ff6e5246fe01653bfb4bfdba640

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5cd07c8ddace2c20b7b7eea0829a9b5a

SHA1
98d4e6591c5928b4d9665613fcf7eb9ef7ceddd7

SHA256
e7f36cf7d73b09442dba43f99c5091d88e46056bfafa96e30723973eeb3040a0

SHA512
061e8fc817c6dda5a3052b12f4f3d2ca6a373c8babb217d89783fc175c9ca064c32caa2fb74e405779cf9a6910db3c084d480cbaa8e2c7a67e8fe7c7ada2e2fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab16AD.tmp

Filesize
67KB

MD5
2d3dcf90f6c99f47e7593ea250c9e749

SHA1
51be82be4a272669983313565b4940d4b1385237

SHA256
8714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4

SHA512
9c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1761.tmp

Filesize
160KB

MD5
7186ad693b8ad9444401bd9bcd2217c2

SHA1
5c28ca10a650f6026b0df4737078fa4197f3bac1

SHA256
9a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed

SHA512
135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b

Download Submit