ce252400b6b8896c646804cccebffe3a08588c76a5b6c5c5dc78133a81d8cace

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19-07-2024 02:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5a2b8d7ea442adbda806a41d8ab8986f_JaffaCakes118.html
Size

3KB
MD5

5a2b8d7ea442adbda806a41d8ab8986f
SHA1

f2f940940479952ca9f24664ffc7581e9b072bff
SHA256

ce252400b6b8896c646804cccebffe3a08588c76a5b6c5c5dc78133a81d8cace
SHA512

c9ae81dda3c7dd15c74a1d9df47aa6da4c0da981b0b6881153245c5f6d5b3a2659515545ae7c8bbfb0c5a0d85de2e659f5e33583eec00101f570aa18e1e36272

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20cb717f86d9da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000b3b5d08abfa1567b7b688ed536bbdd169150ad1db99bf6a3b97ac3fe0e73039a000000000e80000000020000200000005802187e83e943175e7195d994c456cae8994e08b52e77ec9164f194c329709220000000ff145239b19f6158d72f71638a110d855b938f6b14e1151bbf308ed272614e5140000000ec006b240ceb28bc9026a7213d9f1455f63ee89eb3d066fb656eedae1f6e2b224b56a2044a20d5783d427cf18ca00dedccac1cabf732fdcecb14097bb01b234f	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000b2cc6d6b771503c858f276da2a56ae24970db7ae900b44ab8cb33c619fa171dd000000000e8000000002000020000000147d94d4b35d0867ec4ef33d2b85e548c30538fbdd19cd0c9032331436a8c3b3900000008876ae6bdf2d38eb5af109096bb81726b43bddf71b953534f6fdf827f90af8622ca95ffb60d2321ac451e9f9da6d6bd80f4fd18489f5072b95ce0b2690767a28fc2d917cf4df7cbdfcbde47eb9789af32f6acd3720f1b5ba0626960109f2a2e92a2c0dacfc5abb5ea0502f237afd9b1b0381c238d0e22bf85aa1f335a7805cc71bbe4a7cce0a74141fea4c9d4dae8a2940000000e7ef677181281f4c43cc64b57df4c246b65015ef01a3229d9693cb6dd791642e6d3edd091b0b9d4256a06eb5f0361c8395722c50b794446a7b557c3a6545c64f	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427519300"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AAF4F3D1-4579-11EF-A567-DA9ECB958399} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2200	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2200	iexplore.exe
2200	iexplore.exe
2764	IEXPLORE.EXE
2764	IEXPLORE.EXE
2764	IEXPLORE.EXE
2764	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 2764	2200	iexplore.exe	30
PID 2200 wrote to memory of 2764	2200	iexplore.exe	30
PID 2200 wrote to memory of 2764	2200	iexplore.exe	30
PID 2200 wrote to memory of 2764	2200	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5a2b8d7ea442adbda806a41d8ab8986f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2200 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
502c27ddca054cd378464b606501b950

SHA1
3d292c587c0541e5c2de9ef19129eed3ed37bad5

SHA256
9cc4ecb60a9fa1f6552b2db423f372e99300c21b7e2d796204baa5b8f7e43615

SHA512
e478cc05fec313cee4086bd06b7addf62ecd3d902bc09d1619748d2a0a90f4efc0b465ed5620ed08d273322a37b8db9dd7ab3a723e234f587ccf402b111d0017

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7cabc71092843c4a3af17f6f980e65fe

SHA1
b75e3fd5ccd4ee7e9cdd3a4cbd17820f78660194

SHA256
e09cbd5788557c8d728706f046ccec62b1da5480ed35eaee33ad62e67c8b3e3a

SHA512
f8fd43924c597ab4df25177e20aeafb31650c96558f860e615e3d2f55530d3682a215f3373b0f3e9846b4e95c541fef16a69ed9be92742b36fe8372fbc470ec7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a9b5dc89ac31aa878153e9c42f3f1f42

SHA1
81fbaacb23eded2724c412ddee46b525524af48f

SHA256
870cd7519b03745d20773d918ba61acb29ee64475300239fd1f3e23f207ce0eb

SHA512
f1a7731ee0b7e7a7df2d9d7d67844602b18b108d2cf257214cb2597ed447984a0abb44718cf4b4d5bbdc8d6b8df8764e9a3bbf90db6836d7e0e2d3771c359a99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c8533c01d0fd0267109520f7032bf89

SHA1
e3335850019cacfbfcae88a097961ee33aadbece

SHA256
c5b6be8dcd6d7e0234008e45094692bbc5c240650632773a7295c01d045ff1d1

SHA512
2dbd84eb293ddea48ba2fae9307a817247f5ca2db16e2b97a73ed93d5735fc6386a11dd324959c017fe8d8e699cf5efcb40345b83a96270eea1550e07ad7ce8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
96977e9b3984271a134be594192b042f

SHA1
b1c59ef856b3029851600c3d3ed8278ac45df15f

SHA256
8f9e62a59aec4ea5b622728d403659fd62f37b9b423ef2891de24a1427ddbc28

SHA512
167bc98a323a043a27febe2907e4e47baf290860464c3e4b545b7b817e5020291166504ff0516e813e587c2ba0ddf434f23bc23c4e911e9256ffbf3b8169d02a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
40584eecbfc15ac9709265298e5915fc

SHA1
a28c9b11ed203dd8fd82cdc07a5e19f3c8d79083

SHA256
c59ffd7e92f0d3f5078cec7cc5698737d4ab82d063dc9e4a04875878a61e670c

SHA512
291af04f9dca85ebf5d73a2ee7c4008705b7e9e58e2f193c978801f558d924959444d38dbbef845d55d301e49c5971de10c712f2340a633100a0ef8a658ca34a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9ff9269279dc06a87d85eaec984d0fa7

SHA1
717a648a83a410b889d6be8831c1b006c8869099

SHA256
5d5b00d93b87d080d9f7301081348e989bb37f7d51943772d466d27143407a49

SHA512
fd04fd14badc082c33ccba2220de2e768ecbcd506ef4530673436aeb36c0e5fc23944e7becd9b6e98d0c3977d35155827a63a8b4323edd3048a83a5b81410bc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6c7b594dfbb2dfd838656adf412ecfc2

SHA1
2c047fe4931bcc58c24ea64cc1333ddb3665d888

SHA256
cd3709b3f1b17c0c260ec1bf1dd9f2658e86365fc620458b2acea7e4f3b6238d

SHA512
1f0186e41261d56adceee55ea44c9117f9ac8c0ad2e245a813e0a9ea86826f210bb5e101af0e3c85da1010089bb7dcec673b82ece0c213ac2d79df932c88aff3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b1fdc2323c6b9f08a6d8772327539397

SHA1
81b587113c34766e84b79d885bcaf4851d7c4200

SHA256
e7f5ce7d4f2ba39124af3a28271aaf3156b9246a17d8702b2230ebd69cd53cd6

SHA512
aa61999b590ad30f85462cba8e6b23fc346236ea7307503d3ba873f71f18d44b549488f580b60224a16c5b5fc7549bc4cf1e169c123cd52ab6b39c0e25f03712

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ee07005f99e68e371d398a3d4a54c0fe

SHA1
9f21ad9c924578cbcbf2576c6a95d5f329935e1c

SHA256
07a39b8a17d11a64b9d3d6a76425f72415df8f35eb76aac354d1208c85c17f4d

SHA512
3a6a56645ab6b77bf43c17be0e2777fa6f9911b69d0e08cb642bc4f2b7894180756e6766ed85cb39efc373263d3e5c4751eb1ae8de96136ee16dc6e302d62a5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1905c49133cc25505168a91a384a6796

SHA1
be2d29e9c70b83bce2a837390d3f00eee25f8b96

SHA256
980fb0f16e34c3e99cb574fe1a84f45ff27c28abb2f64253dc9b3ee1dc8cf1fd

SHA512
9c6af1e1bbd8cdd2aea2839294e859d9ff6bc817530f496bfe1e7f65f0d94ac14dc5f175e4e7dffa5051e35466a36daede53f7ca753249468bac60363b0e493a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
92e98c72784b257640fa5fb31ee011e7

SHA1
87f58b0d78061feb8e961d7d4f306ab1d29c6efa

SHA256
37b0756e2cac6c82eb2f33de258fc9696f9f661cf1e3b0a74bf5143a6a6d673b

SHA512
ead77f8a413aab89cb139cc7484c2bd1e267323f078b4acdce844db6037e8aa7dc54f33e42d9a2ed615263b37d2b031e017ca43c739c4da0f242cfe942f12fe7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cad798909652aaf8568bdb7e15f45bcb

SHA1
e74b24347dd34cc93f8a9c846ed9083a416feae6

SHA256
513712480310fb013a018caff8301e85553acc611e65297d1eb88d666f1831c7

SHA512
a44c47c089f23e2837d10ea29350b19dac1b037982a069cfd82d774a63b9a8e8f4305b2059f2bcf47bba08db2c47c79804f6deea99f18423a599246647e4216f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9908.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar99B6.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit