049cc964244fec4efcd32bff9b5d4d8db4d49a992cec622465e0f53cf5d331b4

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
15/06/2024, 19:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aff3a9131349dcc500bc88029a2dfea6_JaffaCakes118.html
Size

23KB
MD5

aff3a9131349dcc500bc88029a2dfea6
SHA1

7cb0df2090c47ff0c26400cd99ae1b10f437d171
SHA256

049cc964244fec4efcd32bff9b5d4d8db4d49a992cec622465e0f53cf5d331b4
SHA512

eb09b83d6f2a460658116b0ae737f22883ee18e6444aec3eea06159d53079f6a13a49988a64c12a81840c880c000a459a4e611cffe2bf2e0d979cea309ca92cf
SSDEEP

192:R2yoC9zLb5njLYPvcjsjsZTcnQjLntQ/VNnQieLnFunQOkrntN+nQTbnenQNnnwf:IyoezZQ/O9E

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424640965"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{04FE0581-2B4C-11EF-882F-5E44E0CFDD1C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2916	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2916	iexplore.exe
2916	iexplore.exe
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 3048	2916	iexplore.exe	28
PID 2916 wrote to memory of 3048	2916	iexplore.exe	28
PID 2916 wrote to memory of 3048	2916	iexplore.exe	28
PID 2916 wrote to memory of 3048	2916	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\aff3a9131349dcc500bc88029a2dfea6_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2916 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
2c7c1065bb504182ce0297bdc78c3fdd

SHA1
8c3ea7233b415a5666837fdcf7c7ebc1aeb5331b

SHA256
f5829cf2c0f632ebb4050662a3125a5a86812894e5a22c6da88a854972f75526

SHA512
fee67cf389b63c763a8ed5ac95e1cb6bd4887df12de993ac46d8148003d98a691a692f19dd2f5f756a4c41fa0f7cd2417e3526ba847bc0e5c98051e43e5e7d85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
63af408f1b4a6991c1cd23b8e5ef4868

SHA1
018713c4b349833be80a0c141adcd18c77d56211

SHA256
57b69579a8272425e721d28f972cfc5d86670e2f5e55e139e482b3efc8c0572d

SHA512
80d3083c8528cc60a95fcbdfa824fc15fcee56a93daa4f8b032fb1b8764eabbfb9d0def8b399abb7aa38db1abeaf1cda07ab4ad48d474819467064f9131a0f03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d185fd1beca0be8426a587a8e0a09c52

SHA1
57fa07e456406d91ac189bbe70e1087b07ae1bdf

SHA256
5957d1ba598b6de1072641e1f2b008b742d0e3b3f13a7e63491113b0fc9c57e4

SHA512
1035ecc69731c28349871b1671a89d104471a1b9d1bd6298716ee5061110faaede7cbce40feb512aa0925f0663dcee95482313ae0c58df24c5cb22e58286d6e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f47d9bca298b3b6aa158390fb324f0d1

SHA1
7597e9302dc6f0478a7ac78621d77b17ac4c5bcf

SHA256
efad71975c0bb3354fb3f28d4844851d409f56eef2c7d9c02a2f92e1f278b4e8

SHA512
d482f3e9565b50f7e3c7e9d3efedd1648a3c11c0c4c6af700bb0bf1b91b55fef060356fc6dd2cb022c019fc449ac64b40570581eef891701f20bb4dff1eaf34d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
77ad303c7b7f8af18d4a1cd299420b80

SHA1
12e63b625f08fe68712d46d3b9c8f640aca41937

SHA256
a1f8b27874615c2cd5ae532bdfb1fdcb2d651d2197df8fe3999120c58f264687

SHA512
d7b4a9da64f18817c18b945df0840890d66033c287ab46b001886fa1cb45b6ac3b8508de2ce1e2cdd6081cd9e70c1ec5776e9a267ffef272e46cd23b90b186a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7ec0ea82b1cdb5cf12ac850e9342c1ed

SHA1
44979c603950b5da9c16198f63ec080c1382c117

SHA256
102482cfff3419c1089276b66afa30cc3a82b0a3842cb3dd37e6c3270b966ece

SHA512
61b580b552690383757e799fa6877423e11dabd7fc9391776af3987dded46d1cffdbad27f6fd9f52d7d9b2222c07d3676ea306716262e77f032e7723832abc20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ee2ee7aa037b09679c20a2bcb1f28b76

SHA1
5b27f03c58f4a2c562f0aa1c2a5b8cb233d8bf9d

SHA256
2c9c5e651f10396b19293d5360ec12d1e4ec5ebea9753b367b755bf3d5a7ec5a

SHA512
d21fb44238a1658cbbdcdc1c5d9b13b62eb7bb6f66714bb5bbc30ce011e907271509c4cf2376626962f9814d15278d8215455f3c5c1ea865c59096650cdfcb9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
664a40a0fcf7b756ed9325ee704405be

SHA1
2539f789db29f8e9ab93c9f5801b98ec2f675a1f

SHA256
733f122dc91e5973bb548e51be36ecf651c07c606ef2cc2f52e2dd94fd932f5f

SHA512
7028ba5f54f6e496d28ae243126a9858a2c3404dba909aeaeda9f4074b88d78839c38005633f0bd35d2251384236761abbd24a4dd3d1698c358819499479a25b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c53f38b8b1e6278d476617914bd2af3c

SHA1
46cc15c693783975e022403cd985ccc9d9a4c86a

SHA256
3869d6e743eb395834714e1a069b181afa364602f0ddedc2dd26ea9167f3e1f8

SHA512
d3c02df55680f4d60108b23d403e3f892e1916cb19cdc1fb333d5374d843673c68c8ec24031343ab7ef3ae63a173c906bc19311d58b8bde7deaf497cfcb8b8da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
12f26e81ff727030292d9c551d2800c6

SHA1
6fb63e733662c07df33abbc5b7300410917bc387

SHA256
667deec140670b6b8d9348237801302253fdf3995b4d3a162638d6ccd82e9e09

SHA512
1575c2f3e306e2b175eb3d27dc95d36a4d476abb06b115dbefc485c90de752d69dfdbc80fffeed5c8775626906e5b6ec7659f9fd22aa95b98ebd29f4775fd5cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
5a45765c3aecb52657602853f3226752

SHA1
81a48d543959a77c7f125242de639bd2e2fd028e

SHA256
9e4e87aa77c6f548e8cf2c69451aeb392cfff74761159c050401442595ca2517

SHA512
c416758ce21252d9c1a5af353e793f793dd2a9f0a13410eb2f652bdccaf9920990dd95ec5efa681ad0cfc009f601113c4259ea903b46cc0f5e629695fb22f9a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8DC.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit