6f3bcd4ba3a14f4d95ca15204e936fb8231bd6480b4b93d64eb4fed3e968f9a0

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
15/06/2024, 14:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

aed5e523e41a181e384aa7fa358bfa4c_JaffaCakes118.html
Size

23KB
MD5

aed5e523e41a181e384aa7fa358bfa4c
SHA1

5ef75af63ba49fd8a57b7495b18f44f859035fab
SHA256

6f3bcd4ba3a14f4d95ca15204e936fb8231bd6480b4b93d64eb4fed3e968f9a0
SHA512

b2820e1ae570892413ab1995cc8e6912c0127421c982e7ff948d4d439f3498748919289238b54bfd659c25399bd7c1fd00738138ba9b0333a711a6cedaaf5a9a
SSDEEP

192:uw7Fb5nzqnQjxn5Q/ynQieZNn6nQOkEnt+onQTbn1nQ0GLnLnQt5qMB5qnYnQ7tk:TQ/LGe/B

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424623244"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C27FCAA1-2B22-11EF-BCFF-D2952450F783} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1892	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1892	iexplore.exe
1892	iexplore.exe
2964	IEXPLORE.EXE
2964	IEXPLORE.EXE
2964	IEXPLORE.EXE
2964	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1892 wrote to memory of 2964	1892	iexplore.exe	28
PID 1892 wrote to memory of 2964	1892	iexplore.exe	28
PID 1892 wrote to memory of 2964	1892	iexplore.exe	28
PID 1892 wrote to memory of 2964	1892	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\aed5e523e41a181e384aa7fa358bfa4c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1892 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8b0e4ea9d83f2ef08c7b648d0bc02330

SHA1
5baf8ffc11435469007ab7dbb5a519f3ec415231

SHA256
4ff7e7e956979afa7ccdaaaa5e9ff15160a8a08fd2f5a8d8d0662e815ba2d67c

SHA512
017dd436cdd1e26b57a086eddd791d4253318e96117702044e94d30f3dd0e8fabaeb0e6adcc94d729cfda6da8398b4e83f15a95295da824ca3fee14c3bd98b34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
01f5d88b89f588de8e40cdd34b31616f

SHA1
9ed4473c7b2ec9c1ba25cb39cd28428a8843a283

SHA256
d4e7935cf6c9f18d9bc920ae628b03e7bf47ab6b404ed6cebf71166c2092a9f8

SHA512
3c0097c1db286e897742708ac26aabbb7489ddc8c76301324d167ed046185e6388a895dce7cb077d3172b031f729051433579bda8e00aae14c341c046e834d6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a8544c4a1c1684f3c74d87f43e271ea

SHA1
9518ad1ce8153c0dc66548ea0116bf5e3a09571c

SHA256
1b4d2f6a2953b4954e94ca2277a14f52755ab421ed7f86d3ca2c8a8cbde28573

SHA512
311bc8e19705a3a9e72701783145a1d0633c872b96e31a24293ad913324fae7f583dde5bdab9a76c7b58003abb2f011d76e2571795756df67a40ffcebbeef3a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a831739862495036c57e34f52950173b

SHA1
4819c63a768c9535edc1a9e08bc328245f0485c0

SHA256
cda65b1950722816dab5ff05c0ebb92f7b02ac8c7955bdaf469b2f43b2b566fa

SHA512
52eabfadc417283b913f56ff6685f3810e5a3cbee84e14d1b377e7d83160c05ee0728225f3484f4c20cbe81dacaee39a78f8b58995e4bf9111c5f42bc27081bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
38e40e9882d2c6df0b1d9557172ae61b

SHA1
3db63ab5b6a93a546661165571bd6d38fa9e1826

SHA256
e54cda641409d543e1e0384bda65ffd54810ebaece36db2986adaa7562b90abd

SHA512
12271ed88319b07afb6a3466344213a196eb81a29d70c0d54dafdb3ee81f0e102b1efd263e4b6707cb6dacdfed9062afb2685896f77d4b0ea35fc71e87516049

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a5bb332fc5ab335893336494705a76d3

SHA1
dc08a8cd1a72f57a9be17e1d7d652ddcf27fd6da

SHA256
46680148e162adf78bcb362479273f164a1d5e00d9a4dea4c7d6e365fb8bc743

SHA512
fbfd9035ac2cab95c8d0ae327e20f9fa147a2a554a2452ac569c2c995d5359e37e21a23997420c5a7cdc5679d444c4bf59dc81b9cbc8d99b3b8849b3684432f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e89c3fab92e7ff37157d541e3c6f39c0

SHA1
ccc8e58a9bddecdf2d66530ff87212a5daec3d86

SHA256
8607e0ab7a22c8d449e509953161505ead2fb90e3ae0610e5a4634be335c3222

SHA512
ac679839fede41a0bd9a14547e296fb684cba51ffbfa3093702c148e91b887efe406ba5d7a8b7d0aa54bda00651d30dda17d8eba7333dd18b97a17710fc371f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
40183ad03c9fa3b12630733d08098cce

SHA1
5c8d809a6d9a0585ff3d8955f1903c8f43e63c4d

SHA256
1669d80f5cd0b5a012ec115d72d85c027eefee9e9b2c0f7b3af912e5928f8998

SHA512
35636cf8ff1b3785d7bc52c16bb493bb31385d9970d1031aafd698245a6c15e4b4d5289f3f8407032b03c5b4a010bf5073193212777b5533f757acbe8cfcadca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be772ad515b2667b9dd8bc41c4d878b7

SHA1
069bf960eeb04492c8fef491ab845dd734378311

SHA256
56fdaeff2dfb09b26ffea114c6f496b46110a80023a146a32cd4fce558e61197

SHA512
da11c08e0251aac0d6b0b554a32acde440ba675cdf6e66e56329a91ff2ef1f6c39790799b0815eb27aba473fd9d4ced0ff5d0422e1c80d1902ddcb491a546f87

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1F36.tmp

Filesize
67KB

MD5
2d3dcf90f6c99f47e7593ea250c9e749

SHA1
51be82be4a272669983313565b4940d4b1385237

SHA256
8714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4

SHA512
9c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1FD9.tmp

Filesize
160KB

MD5
7186ad693b8ad9444401bd9bcd2217c2

SHA1
5c28ca10a650f6026b0df4737078fa4197f3bac1

SHA256
9a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed

SHA512
135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b

Download Submit