02027153a598ab5d04f6d2ebce6db8614e2cd58e70853d1646282c1e3433f65f

Analysis

max time kernel
135s
max time network
132s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
12-06-2024 22:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a2ab5bce4457451af01bd15262c864e4_JaffaCakes118.html
Size

27KB
MD5

a2ab5bce4457451af01bd15262c864e4
SHA1

41cff65e9cb2a24d76c00c89e8b523f667826b7b
SHA256

02027153a598ab5d04f6d2ebce6db8614e2cd58e70853d1646282c1e3433f65f
SHA512

4ee2860032a5829172cbca18ef3cef2bc31b255f71f8ddcef17b076a3747e4c5a5a436ad32896caf87b34924c3dac35ed50bc644efdaaab917378f9f4cbcb2bc
SSDEEP

384:wj4pUfC+Ze1NEPAIIQ+VaNyLfw01+0XwABUu21dsRSwpwE+VJTw0bOGE7fouBSAb:wcpUa+ZeNtQsVmfIp+rkchjnF2yeqBO

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a80760000000002000000000010660000000100002000000018397c6fb441cecb26c73d2cd083bf5ef10a12b608136c457651c2223a785227000000000e8000000002000020000000ab7ec1b97868fdff3611f2a7827048843765512c029161c93e9c35a6df123fc020000000d552a5c735f42fbb5d82febafb70622636496e9b49edbb69ff784e4797261de040000000eac490010f4659a93352defcae4a40e64e66aad0a894439059fc41d3a7a38ab1d9dc9183277b01e1563ace226b5083086eacc8c9b2101adc5b55f21d8ec71f63	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40b31af116bdda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424392755"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1BB19791-290A-11EF-B98D-FE0070C7CB2B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000006f9148ba20005a59e4d025251bd22e17f3ba724bc2ac820d679b11acca32cb9d000000000e800000000200002000000022a1c9f5ed9d89cee63b5e8775fb393d9ca1da543ed290cdd4a0257d421a906090000000e716ac271d15cf912a0d54f8e31dd8210f425b73c25bde2a08e45767d37685b99afcd80d93b845b5868e0de194a7635be738c140e696835664ab3fe1223b70fe28d2b67332eec876377bdf5a14c22fb30cf9c4ac6e62696f3b5149bb0b2c829a7cb90ad7900993b4bbaa16762219adfa78e028e384c834f58bb7e3a60ed717d053d6917f8704b6ddf489d9091b1e1be940000000cf3c3f8beda3c36d371152aa4200cc0360414f1762e8ee4d40a5d6989512785d14466b14315e0a38ffc05841d90945bc3ba2af399a466c2709761fd8a71cf072	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2208	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2208	iexplore.exe
2208	iexplore.exe
2996	IEXPLORE.EXE
2996	IEXPLORE.EXE
2996	IEXPLORE.EXE
2996	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2996	2208	iexplore.exe	28
PID 2208 wrote to memory of 2996	2208	iexplore.exe	28
PID 2208 wrote to memory of 2996	2208	iexplore.exe	28
PID 2208 wrote to memory of 2996	2208	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a2ab5bce4457451af01bd15262c864e4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2208 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
917a41b234ac6c455be363745084d10d

SHA1
8839216002cab5d4607a8351d97c271e71858851

SHA256
c3ccd8ef050511bc7c6943a55d81ee913265e34e33cad696a35a66e55d40427d

SHA512
6f44093de507e7bcd27b8ed06d06006068025435a08dbf0cd401de2b86eaca3f5922715cb34080b3d8d4f793012eefdf1e9626e82005c3d304e17db459888929

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
206ee46ce9f1cf9b584aa9d40833c9c9

SHA1
0500bd77bb2faaf30a4902df5c6ecb2711230d67

SHA256
3a60be769e10b286756dd082600c535f3819ca854e14cad1423cd038d1236785

SHA512
1cde0e79a5552ce870968abe73eb1eb99d0d15c1a853252ab4c6d2c47ccfc4e035b9fe030ba7f41893939836df16a96557bd0836bbd59553807a57ffb3e77266

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6b2c3116709807b3814cb2332f319379

SHA1
bb2a56bf100282400f7b0a704b78eeda87801dbc

SHA256
977e9216ebb727007c4642ec8dca545b7efa1450510bc0bcf52da6fb3ee620ad

SHA512
f0f6aef62f60bd8e920ebbafd75dda543243f9409ce8dff9090fc5f13a24fd25794733dcb5af128cb559d884213db144202a8658103bfab8f2722d223d3bfaaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d2416d981db75ebf9713f7145905d10d

SHA1
340206dd4ba3ec06dc287d5dda3ef7375c728c84

SHA256
8e7af627bbb81b7750bfca71d0e735db11c54e17167264fd503b8b23bc4c7bd0

SHA512
c530795fcc0a59d1dc42c8ddfacee1662bd2a5f9ac3fcbf11c1d7e83e2d3ff415e18c9fc76f7394ce8dc4337a50ceb8e47215fcc0b9f0b6a41a2d233c6f6cefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c14501f397ee8a7cefa4cd9523af4ead

SHA1
598637b95075b6d685ae578e628ff2860d3ddc56

SHA256
2471970bf1dc7368bb613d6cad0e5e96fdf4d7d4f33f8f69b4f6f54724ad7449

SHA512
bbad61aad20f9c304ed7e32e482b5f6b3d9cedfc17df6eb2e3ca5b88e1c56ef2feaa4e944be52d353e1bf118597253b26eeb1294ccac2d3043318c6e2903cb72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2475bc02934d6c6de4d709b117d63e2f

SHA1
39d52988edcbc8639b7053e50f2b942a402987d2

SHA256
85ae9cae788e8e14be799d1f8417aed158477036752cdc2fc448ac1d1512b1b7

SHA512
f9a712706a1aeef25a097f6e610a21e093123a5a5be5440e6eb16feaadc063fcb60747ceb066dccd1de9b06ebbc9935cc29c09964a18ba3aa6eaf8494d2b90c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
258235e2a8324bb0f428e9f7414cdc05

SHA1
ff5dd2b031fd671c93a44305ea7b2c87e640378f

SHA256
7ac2dc9d11ec883cd6815107ac72f8e75a6e4a88db0946ee7c50d7843d6c50c5

SHA512
1b6350e2ffee4747f77c88c9c474896ba44afc28739dd9ca372ed0a3e9b145d60ad41123c6104cf0b2da4dd51468495d47d6726de7eb4a467eeea50ea09d2a0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cea51b29ccdf38091a831abff2b79dbe

SHA1
ecb2664149ab41e809d1bfaef48f19bfe0206bed

SHA256
3497023cbfb33299898ecf0752f6209722139425e20cf8d37e0dece45429e53a

SHA512
9b94e1e66e9a9b90f786ffd23ac128efb86da73e623bf3832f54fcbd54de06dc8b1434488c365bf2d4407834866bf1b5f5dfb769f80a8fcb1258ea2144c34529

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6a490f641cf91a4d2fd6ae1271cc4f18

SHA1
eb7d476974282f5ff2add136ae7e67ef9354f4c1

SHA256
402086068220c73323b6e7b8f211e4cff3423195ef9ff7eb2cd3844e7f86defb

SHA512
1fbc4aea051dc47372fa111172af905ea5b9487a3b76692c5a1ff0921b4e88bb60e20511486dacd0fedcb31c7749658a1091fd925741fb3b1ec4f0de6a5276d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
46afe93d40bc10a59ec2c3ac3fc15025

SHA1
4c4e6d99cc146776a6deb8975212f7fe63cc4e54

SHA256
15daa3c94e612b01c04461cd5dc6e0b6451dead6d08e3e12c7ca7543b5e67da2

SHA512
3ec7de6e21581ce5955920039c541920d6b29f277f6ed9f827c7bfe3359a9f0364046396c6d3042052db1c815b075facd0d013404d7abd4c8705dab73e323b96

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab70FE.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar71CC.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit