cfa691c422978350c09b84a57c2212d5697f6a017c1cc806eb220363236101d4

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11-07-2024 19:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3a5ef58d5cb02f8d9cc606f5849d7b19_JaffaCakes118.html
Size

18KB
MD5

3a5ef58d5cb02f8d9cc606f5849d7b19
SHA1

e2a9a5dcd2fd1fcd89a1312b332aa7a43c8c4951
SHA256

cfa691c422978350c09b84a57c2212d5697f6a017c1cc806eb220363236101d4
SHA512

00781650b8a63dfabb7bd6dda8831ee417f5cecf5d4120ef12f4868e436bfbabdef92536ee3fb7b78dc69ba4d2eea4cb6e3cc4e9791d622bb7bce826d9235840
SSDEEP

384:Lz/hlT5GoejdHhiyZJrHDKnw1pLJa5DFf5rGvKCRzkVlfZsPota:7YoeJVp9M5ryKCH

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b0000000002000000000010660000000100002000000059f3af1adf70dad56f8a43a7fbfdc04d457fb35d5f665e01eba2802df744ed4e000000000e8000000002000020000000470ec9c4734f3115bfbe6009206c7b54cdf290ced39318c3ab4c9c851526f96b200000003c8d73e8ca2852dcbb895ce5c05e84d4a18148d827a82f93792e7d8575073ad940000000ba45a0091b5a02720a1a1a88f87ad903b6ef6c52c804c4679acef3603f0ace57b303ceb3daf886fd245418ed0c6e0cb5150f4ae0596691c1255061b337118713	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10f894c0c4d3da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426886331"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EC055441-3FB7-11EF-9BBA-DA960850E1DF} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b00000000020000000000106600000001000020000000e391d4295dce65dd76100d4a5ccd36f8c39063aaa2b97e98b483af1d4d4b869a000000000e8000000002000020000000769cfe98a6b505139c527f86341e6838a8d5d2a5b1210785ce8be01a3abc044590000000b1e8793950cae7cf34671c9ecb2e4b041290f6ac8d5af8948cc3b87c660b3defdf3f3abef5754d49879d3831e800c020220be14ea3de5c8cc1950ae062802d22ab27f6724be9eed98d33a9f3725f34e0e6bca4d44b0c18116548fa045044a8945efdaa64688e23bd0b8809ba34e7037e377459e0dafe3190e56055f6cc382931db732963a39761246774961c1df6044540000000dcc02156d70b40b33209777cc4708104291f314ee715ba66b3190b5d30dc65b1e60c58f5847fa76a4a09a74030ed5fbe32e94fc64f1995c2f1b3c965886f1d13	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2284	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2284	iexplore.exe
2284	iexplore.exe
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 2800	2284	iexplore.exe	30
PID 2284 wrote to memory of 2800	2284	iexplore.exe	30
PID 2284 wrote to memory of 2800	2284	iexplore.exe	30
PID 2284 wrote to memory of 2800	2284	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3a5ef58d5cb02f8d9cc606f5849d7b19_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2284 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8eeaa005426714882ef0cc40ca81027c

SHA1
a125e379facb894049b06370b36aac8ffbbf661e

SHA256
8640b60d98561bcc101f6e3cda6519059660df3f0735683cef4496227e7da7a1

SHA512
16dfc5a70b259c950486589ca20a00114a3f71f45d69fa91345fd88b3babd7abe5e6b3e09984fed758c8aac0aecdb89c29e5d38744367ef8d0f2ffa547d8a80f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
65b3e1b4233f1de53b1532d8530195f5

SHA1
7d0b07f6628e25a9a0ec8266b4a98bec8920abaa

SHA256
ce3eb3cff9a6e04a9c991e6b3288c96672b2bbcff66e001ba19e3bbd43fad388

SHA512
3171e002572f0eaf837004fcceebb5091326279ffd5efa5be9edde59e1eabd7dc65905eaa6f65d23c53c6e82fbecab06492d76f5550fa562ffb01d28e6f2efe4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4f5e6281dc22a48ce6810b2cc0802874

SHA1
a7a402d6fe9e0051baa48c7e8d7049fe50f36369

SHA256
3733f50777c7083ce02f05b26b0de3513440a4fb268d1dd787d1488c3cbfcbac

SHA512
77225eee0a498e9a8f362b9b9c6a662b0f0b857960f665dfb04f54ded619d74d9fbbdf1af100c94fc9fa2eb1301e665bb6da64f2fe42bc1aa8a0f952e8dcbe4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8eed1c433bac29b4e0569d2d4fa8a9d8

SHA1
07e78b11d9049ede4fdf1f313867433d6090606b

SHA256
12f325f810610a01048cf4a2661f32b3a12790c69d384ad018e1735f1c9808f3

SHA512
ff0556ba20bf7add88abebbfc280a62bf1e6930d44376ab2a652427c060ac34824b9445f31a2f2afd6fe8979f1bd40352951cd2daf92c54a7f40e89d85a085f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
93477c36be78c8347a411b98cf0e4441

SHA1
bc6bc5f83e3eb00e3ba1c3f1cdce90e9f4b4f73e

SHA256
862617fde9e514002e4eb2d3bd9805956dc9aba693b3241ceabf71bf511dee1a

SHA512
0e21fa080b538f1ef71eba93f73900cab1b7605ba54fa2ac588d19215be18cd21014614af770932ddd528027502f6663a523b0e4d6421cff20d120b5287bd1e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aca6ae6da7390a76607ba2fdfb9a57f0

SHA1
61b0e2aba49cef85947b2f3d847aaf489fb56ebc

SHA256
60c786bcba688096c1f0c3cc4076090cea6e2fdd3700d0426c47f8ab95678dd5

SHA512
ed52ae8a1fbc47f9e9ecf6676caa4c559c149054791b4a198adf2bdf7931ae19fac792a44986f65e1ef6029429c065ce5b4c0a088e4b4eb23ec0d22cea079542

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3ac6cf524297a280ee9985dae795482b

SHA1
b5b913901b4880a44b49037ff38b9b7ea2163b15

SHA256
5b3d959cf462c0ba249ca9144c5ed6b9f6638318f6e906a0e2a9c598e578b90c

SHA512
b79061a5cde44692616ee5cbea9625c97aa35660efbab59b6f47717f599386963d829490590a4cf40a43882f79cd89766e29bf329939cbe4464bb05cd406b84f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c97664c6d6d7100d675e015357b56233

SHA1
8a9001712e0fce6ff720e68dd07ac1671b6ff664

SHA256
a1faf899367bbb41fef4ae3f0e638617a6784b123e65c6552df4266015f92c4f

SHA512
7fa3e312a2da3d8a1ebc1f9633cacdef8ff67061e4cb20add7a2f24df3f61b0dc40be2e051ca974cc59dd2e32f47264c75a043b8bc0735290d3d2128f0c5f4a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d4a25e6989b1f04f2822f0aba431db43

SHA1
b921d7d3681d6ce57977436ee285bd72bfee2dd7

SHA256
6d0bb9f06d744cf61f30a0831fda14af256befbe9faa4d5696eef08dc537e61f

SHA512
3bb6e9393c24c98dc8688dfb9dba9bc4d73ab6118c58c0da9ee142c434956f56618dec787d80d890d221741df8a592a6171bf61c34ec81ccd28c6354408697bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
909672a26d2748edba864a0ec996e21b

SHA1
5562141fac70d597b6ac4deb00f8b3f64670e93f

SHA256
5f74310fc7b378ab38f3bf6fe85d4a95c4a80e54e19ddd2bc8dde2fc57a9621c

SHA512
2cc36fde61b8fcca9a1f439afdb273eb8e7d7c4d75a681deff3c2c23cccba7088490f3263611278acc495c244b813de917ff659faec3a3e2848654a4474dfeae

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab66F0.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar682B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit