ba4aa5fbf4b5043129ed7a4ce2bbcf0aa12beb35d72cb5c8f4ba1c339b13a631

Analysis

max time kernel
120s
max time network
128s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
15-06-2024 01:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ac5ae6ec907068848f86dfc051edf1d9_JaffaCakes118.html
Size

825B
MD5

ac5ae6ec907068848f86dfc051edf1d9
SHA1

bd092ab7bf1ee98c3c71afd3dbcaa71b1e0522c2
SHA256

ba4aa5fbf4b5043129ed7a4ce2bbcf0aa12beb35d72cb5c8f4ba1c339b13a631
SHA512

e1f59f72e487615bb99ebee6f4df541c9b5cdb93973d63a77cedf7195e94a5f1f8dd471295a393b1b6f49083cd9e887e0fb2bb6fc98b529293d7da17df05d32d

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e8ddd75946c8ef47973d8845b42d081f0000000002000000000010660000000100002000000008a73c15e861dc921e107517b1c58ad5f6122245305af2eb5458fd49fff88983000000000e8000000002000020000000804f03644cda2b71d5e946bcacf1bf6f443dd9ba08f90cf7473c437cc6d329e9200000006ba8b0ea6acb520b532f6931cc0ccc47e48638c907206b081a45c3eafc6207c94000000030fc0173caeeef888a48db769d0e2d9b1b6313a4de40f218eb1f79bd038337fe8b703cf1c44b6b7fadf035555c15fa0c86d9b446de43dd9d1d59b565fa1c7796	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e8ddd75946c8ef47973d8845b42d081f00000000020000000000106600000001000020000000a9f26a801bd18a945de41fa609d713b50bc0267c7d77a882d146cdf44e9f03fc000000000e8000000002000020000000e2573a16af4e1480a35c2a04cd0d4240d13b024e3f150c75310b5f7346f119bb900000000e3b77bf42e5937207b4c8f92a94edf9e34b8d16bfea9b8fc1dc788a3386042474f87c9b9b92dc4f7d9fe15bd325464a9650311db8e535b3a2d56669d956cf395a6310f61847ef8bb965ac39cae07fd8b19bd26d6050e0d4185dab347b4edc530419a74b7749a194934b2856908957fd986d7b3f332ab0598b9f1d1e861ddaecc1bf4dd6ff17ad084ec50c968aafad754000000044c5fe1ad4b00dd66ae681616b02694205eb8f884657498592b89ae36a6772137146847151156d64362b202c9be776d81f08dc676fb68bdf44756e7227b2b730	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E780A0F1-2AB3-11EF-9A4D-7A846B3196C4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424575632"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0461ebcc0beda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2860	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2860	iexplore.exe
2860	iexplore.exe
1936	IEXPLORE.EXE
1936	IEXPLORE.EXE
1936	IEXPLORE.EXE
1936	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 1936	2860	iexplore.exe	28
PID 2860 wrote to memory of 1936	2860	iexplore.exe	28
PID 2860 wrote to memory of 1936	2860	iexplore.exe	28
PID 2860 wrote to memory of 1936	2860	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ac5ae6ec907068848f86dfc051edf1d9_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2860 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c52d290cc432ac8cdc4ddc15bf72af21

SHA1
c4edfd0905490fa54486bed9bedea9d8a773263b

SHA256
a1467adffdaed7fc27e6e8637643bf7d6f3d35a115b3d05f8dd806f7a7bd9448

SHA512
d347271c8ea68fe0c93911cf441bd8551bf124ead5113b0bc19e0b5f8d1891602a23ffb23607f99c701450d9d80619659cd8c520e2754b030e2de6e5050ba4d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
97606b83a5d815eea5c2fb98d7043e28

SHA1
497ec72b0c41e942ce78022525d29b15b19e52d8

SHA256
424f5e8dac87e8eb63ae48c626c5101a700768bb9052d4579096f7a89305d40d

SHA512
2d99eac5bf4419e09787a931cb07ae9e1a2f49fda7987a05d2ed1636208915517bb0adc217072cef85f8e3e47ea48d009a53aa9f6e5c5f19a59a2acf8745a2bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0f54d5b025eebfb64ba9643a5994f15f

SHA1
5130b01a1b7e23a1886b3a81d61bf022eb581102

SHA256
522fab21150c632dbdd6ffdfc90e4e8f9a1018bf3a1d53b700cf7c31d45119e3

SHA512
2de41203e8b4b7742b39a69ff919d43fb60bd293f194e2bd88e0c709e2453cf9f414beca5086992b7e6c86a7003346cd7a96081efac5ea72507f4186a9274aed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b0a225c6bb1503132e8966c554b1680f

SHA1
add77601372a17e279e28a0bf92f42d4f682c024

SHA256
1b25ae038134f41ec8a9115cdd7c545eaaefc7580932ad519f804c1f20accc7a

SHA512
bed4bd6af84d1f8d32b118b370f5fff7bdf5c6c19809293e2e8d1e06a639877086b52b6e28999e34e203bf19fcfcbdcaecef0f10731615f88fc57f73629108e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9bbdc8a5ff9b3d45f8f725fd2c20937d

SHA1
3bab1f71e35ca7550e3304e81eb89f2617729458

SHA256
d18a785c90a1d3b45a473086ba1bf273e6cd252a310b1b2c8ce8f3c1a9dadbb3

SHA512
8670df67db003c1847595bc69877d57333d31b34c81000f57d91d8a2b730df2c5460657371570df97ec0515a65301a94504e1358d6c121c07521c9ad41467bc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f6dd5c209960c289dddd75095c894647

SHA1
e4fdfc169f3e36a1e8b12fb36ee499c43e982a71

SHA256
a1ade09178288d1ec283981705296445c7aec4ff2b188280f088b499a8f9066d

SHA512
43e5aa09fe77250a9eefe949df04ebde91c3813bedd36e85a69a058a1e827f81805493699e0c7d950b01ab0bd15b7a15b942fce252b5f570aaaf1135b7a4ed4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a2d555bc358de6ec2f8b0e8858d91e39

SHA1
1370092a5e67815c349435409e61fd2f74214da8

SHA256
1d59c548a52e4cf0d4444eb1c8dc5b7a9d6cc7de6710aff55f495976b33cfd58

SHA512
350791622d3f772d9a48aeb48872ecb807f3ad429ad9f660d4e3536f545dca2106039367e85abda0337b3f41305deb6be2ceea6a319c21a4456d0c7d40bf1b1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
317328f9e69fd239c276dbaf1315bfae

SHA1
10855915f881036207a09a04eee8af95a97ecc0f

SHA256
cc867b808a8179933149ee1c459d4c2fb2b4b823a86bad96d1c869935bb1e2f3

SHA512
99f9ff0c6b95c1d70eeaed5e26226b6b1b59ca3badc070940ed5f5235613672451fc21037eac14d3508a84447e1a0b59183e2475a086f0749795d29b1eb422d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3e02ea2e23d91fd6598d8f6dc952c9cf

SHA1
8600c92c1e1d22b59483306b78303af2405e8439

SHA256
39466ec13d59f9870e6e51adefab2edb5aee9d60870d2186568e6884ff86a68d

SHA512
4979ab616741bc06d49fc6496a256e3869052bce24854870d01e9b81ab4f28179648fe5c3eccb83f687bc853021dad47f972859944f6cc16a92f1350207796af

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar21AC.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit