ae9190f847cf3fe73962e8a3a57cbfe6a5dfa6968f42f2a589fd73abe48f1a88

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 18:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3a450b0dfb88c2d7c2292c2c262bb1a6_JaffaCakes118.html
Size

56KB
MD5

3a450b0dfb88c2d7c2292c2c262bb1a6
SHA1

cc88416396f5e90e98bf52f96524fa1b99af0507
SHA256

ae9190f847cf3fe73962e8a3a57cbfe6a5dfa6968f42f2a589fd73abe48f1a88
SHA512

a5f3f007b217b410fe16ebddec3dcab46241c11dd0c63046848d4728050861dc37c58ec8bafd3d515fdfbe51a1b95ca09df8cf17b172a22acf2c77c0784a3d0b
SSDEEP

768:5gOriWNcaSoBgGZCucov30BW8vvyNS4V72RKxx:OaXCucovkU8vvGS4Vj

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0f34326c0d3da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4CD5E1E1-3FB3-11EF-A24E-4E15D54E5731} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c0000000002000000000010660000000100002000000023e6cf2b52ce685cd3786a119d5a9399f42495c59292d96787abfe99274053be000000000e8000000002000020000000b3015d5da4bf11fce1f619de57179ab011283d727cfc5f6868686d20cf589e06900000001cedfa1027ca5799a3a0020aa5fd84953d52286445dedc7ec8de367b501021261e02eda8d1960bfce70ecdbf1c5af0b5660956f2595e20b93f3cc43f9db740a19f89f0e0eeefdcc3706c93fae54082074223880bde9d7c38ed2483b6c7225d20e84770860360de326cc8523275a5fc0d97b15602c4f12a83421c7b9d9e72072051807eb298eca5b65c16f2087b61c633400000000b8f8692b06b42026e51c5a9157ca084e43cb1b76502dd1370cb7bf3c177ee5ff665b970005fd9cf8c66abd25fcd184a1e36b7a6a92e9cdc17680f5d0d94784a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c00000000020000000000106600000001000020000000702f9a210daed8232970caa216c36b458097484806f2eec1470d0222a3111ef4000000000e8000000002000020000000b5f549dd7ac9b7e9e943508465722342dc1b91969dc72dc8a6066bd90f0501be20000000019d33e9e0e5fff8ccfe20f57cac15ab6716beab04e2dae810b130019ade07de40000000c4f6717623bd01018df3d4a9d169184d0a8476e123f4b4dd6212e3e3a496b9329bb57de78d3033d19cda386fbb39f440e881cb69a0c5ad04a9623230771c6783	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426884347"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1628	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1628	iexplore.exe
1628	iexplore.exe
2104	IEXPLORE.EXE
2104	IEXPLORE.EXE
2104	IEXPLORE.EXE
2104	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 2104	1628	iexplore.exe	28
PID 1628 wrote to memory of 2104	1628	iexplore.exe	28
PID 1628 wrote to memory of 2104	1628	iexplore.exe	28
PID 1628 wrote to memory of 2104	1628	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3a450b0dfb88c2d7c2292c2c262bb1a6_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1628 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
ae5eba39ec145e934da6df38f243952f

SHA1
7fb29c558a46f651568aa2024328843db6906b7f

SHA256
bb1cb8f1eccb41732661beb154ed148c5e1ea08a4980eee78cb6366d53464bcf

SHA512
6fda0733a21e17fb6d221a16d74d61b4a6afdcb35bdf83d5ea973c3c50258c5c89c47c4f7402444946da2672018e88b9d8cabb8da24731f8f8fb80013314fc16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
adde7078c9c00e78ab629191c8978853

SHA1
7465f8db54cffa372b6e8bd4f1b57ca6cce8bcd2

SHA256
df80be45233938f356c0dbb6f0a8e4c3c9ff36776713a2b5cd28e2b1d20d8d95

SHA512
8e6e39cfa0f1f1c26486c7a683848ac42aa39c8cdb881d0bca2020356c4eb17f70ca21fa5ff767f5fba87bbd1c21c78d90dbf8a7e2463232a90cbdfa6b4a68d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
c11e17c91b01535bae8320539fee3e18

SHA1
8b33b42abea98c8722cc1c23c130e425cbfcf00b

SHA256
ad7da74071c6f6ddc6e17df949c42a89535c296481afac00dc08afd20865e048

SHA512
987f12df9f4dbba9941027819ba10cd8a3cc63e1c9128a9f70f6a9ad1e718859f6c6709a53e611ba580545fb311f719c89b6beab50927959522c45566743c04a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
6bb8592fc848ef29e79ed6b2e3e5d2eb

SHA1
a5c0f648ee9c93026983df4d2d548ce8cec7910b

SHA256
ebdac547adfd39dfe45264567446b8aff672136bc3f83dc00434358e4924ff1b

SHA512
fdce9c91aa0cfaddc9dbcb43885e9a4e7ab33b2e78872e165a3996d9f2ff6a4f5dfc9eb7228e068665be5f33f55933bac94754359f272a81a793b7767bad6fc0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
595fe822723e65a834337a970708b5ed

SHA1
66f2e44cef0ec7188dc05824ece90c77281e1b1b

SHA256
39d1e42797361502af588cfbf43728820f625e7681905eeb4684de3e07d51866

SHA512
d32d43a73c3198ae418b617eb66b30b57c430833b44ea0526af68d1116927560c2996ec839906e5f92aef9ce7021ed77eb90bb85495a9e3d75c375e424de5202

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
cdc3bef0fc818d0bb4be7c8fbb23eef2

SHA1
242b065a206d03b0d9816131ef95003a473a478a

SHA256
1285258152ebf94dfc456a32d547207985ab81d43fdb6d4611ddf8cc16fbdf97

SHA512
041e54da6000b35b17bdb0cc2a167c4660fc5b49d414dfca60aa4d832cf352ae7e090cb8f00c99efb679c57752cd8d5d7d09fa9001d60122730aa8b50b2264bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
8fe1a403902c4c62505212fbced00a32

SHA1
cdf0e6f347977ce2989cd110bb18a3a1643ce0f6

SHA256
8916f40aab467e3344b87fe2ec7b9fcd44e14623bcf4b4651ce062f5aa48eb49

SHA512
8141900c21c67c980849b685b787e635b61d68e0a02e178670e4fd9f4e86f906cdb9a5862bf4f52dc99556fc7edc74ab2b0ed3adc445ba38406536657c146c85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
c83ff56beeb07c35ea6be3bca5481950

SHA1
3aa26104f14fe94490226c7a46e32e0fd5fd348b

SHA256
078af204541061dd448932356bd48026cabdbb672030ca3689b33e475c0a5afd

SHA512
895bc71abdfeebf58f5ab3e97446dc077ce755a5b2f3f9c31c05602cefa749ddebfa5d5db8678080a3275e4bb6dbf13ed9afc03841e11d3695dbc5e139049d00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
880bbac25ebf50217a12b64602ff1d89

SHA1
8d805067e630089466df47f339c76e1d00e86854

SHA256
a519078487e0ba0764ab13466783754810e98249e1bfbae510fc8be2b968b036

SHA512
a5e2e0a2a207babe5912bb6178f9ab143cecf7fe12b4f93e7c2fc34da93ab953b6fa7141c7742980edc360d211c18648193a574d1b99ba6fb25707e3c1260da7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b19114e14d930d4d35725b5afaad1399

SHA1
8cd7f3a265c396c17d093b4fe92a69cf8538a9d5

SHA256
6dc87f34b7b56bccdb11e770200ea33601a6dccc5b982a92d49f7d882238a806

SHA512
72aa85d6e32715056744a7b0ccc569dd3e31ab4554db9f0fadc2b9932e6b9202f8c72636509aab414680adc47a5af455d062f85f6c4de5872e51dbe35b1e5921

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
c75a8cfe5cf1d3e7f4f34b92e6480443

SHA1
0b4651be87b68d3d9ad1bd5b1e0050df2f236d95

SHA256
3a4b0323f77390487a20499a70f54cd710855f9e81ad20b9329b8bb523ad8f1e

SHA512
102b4db43494fc27e91f0b3ca252261a1e4c8bec1c86fe8c68354ce8515e214431b198b30f6b16bea93533313da30996fe643e660d1c945291c79465720bc0f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
4513f47fd166e0ee9d52563aeee691aa

SHA1
6a5523e6d1ea1fc09f56ce9a7c6540947cf25ad7

SHA256
29b0e168500fbe84b7d05790f96002cb4176ca60766de900eab52b031a8cba09

SHA512
544ea31790fe336a8072a2f68b48ebe65708884bf83d2d11a416494016ec032053b37525b5c06cac4bf74e13654141cbae0af5666580b4dd1c7b568d7f1784bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
0c29e72afc5a8cd799b3d2817b3b932b

SHA1
7d6c48f820b5a01ed51d5abb82f06f9c73cf0aa3

SHA256
f9fddae96a3f7856436dc387cd539a297b27ae3546c84a843b5234c84d09d6be

SHA512
39a05c234bd8d0b743357e52d6c6a538ed6dc605611207d80def875fe4c8882f51ac60c64163c57d079edf04c11219fb34bb5f1137f41bf9c578212ab00e6c70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
59173e4194b2fa7d58fd50214e936303

SHA1
37fcb426a9c1b702d0ebef619e5cf6dad335c9c0

SHA256
46ed3f8449bdd61cf8aac05f0cec7c1cac4de4adab4120d96d7d3f6f7ae5bf6a

SHA512
ce6814346bc393264ae6c955d13354b5880bbc2a7adf2f22d9c586c524843c3a3bccc82e9fe37e2949f9dd71a39b318c327af8dfc694f0019a0b466988914396

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
9c8788825b7636a694c35d3673ea40bf

SHA1
50af3c2cbfcb9e83932e2979f541d88ea52e368e

SHA256
abd8802cd329e1bf666e04bc445d96877102bb154006e6ce3a97b3dcdd446864

SHA512
92dad877df358a7e7d3e7fe675c2492255aab784fa2302d396bbdcdbc06c578beb444ed88dadbf4b3f1210a2d96e62ac17fc3ea1c6247aae0c6d28a64b517cf6

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC6AA.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC7A7.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit