2ac24f712c3ce5225c15d9534e992d49ec30d141e817d06bb86d215cd2a8db5b

Analysis

max time kernel
150s
max time network
146s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19-07-2024 05:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5aa52abefada86d87eaa66b5d46fe4ca_JaffaCakes118.html
Size

85KB
MD5

5aa52abefada86d87eaa66b5d46fe4ca
SHA1

9322146ff6afce669125e0fd0f01778a3610ba8a
SHA256

2ac24f712c3ce5225c15d9534e992d49ec30d141e817d06bb86d215cd2a8db5b
SHA512

7ee47b43ba86800c97ac10add388a9ea215951172579bdb6893dab3669715d9f5ca5d98ad7f92ac70963b48945e617edbed45ece366f73042b29139868fa9485
SSDEEP

1536:pbMjw2fMk1D3O9Pj2fckEpHAmtIL5vTwcZm5BRXp:s6faL2D

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b700000000002000000000010660000000100002000000048f29808028e8f93c7748c74e8695cf8ff4b46ced514f849bf15404b5c1d9237000000000e80000000020000200000006a123e410afc006c850d087fb5157479cb042aa2aa98f9963b052e2a1d3b5040200000001636a0b3129251f2ae07149dd7b0b689e141e77b5e688fec44e8ff38f0b997ce4000000073d0bf8f0c6fbfe985c0d67a3566cb0234ce66731b54c3907e96fa69b06c37cc6ed3956a2a282df5505178f5a4afefb8fcae3986f5a9a622b85653c82f748291	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427528878"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000e6624fd239a0d3507b5c4fff0c0349f07ff0483996343cbddbfa992080a1078d000000000e800000000200002000000049e2fd9804059184fcb211e51b955479ae7f46bc07ca94567612c03959f3de92900000004d64e7eb49a39db3179e72b15e9092f025152090beaf71e496c4c3d9a975c3b80e5913028de52aafefc482a42244f626128cc50cb7a4a3efce4202679879c9dbd5599d72b5fb677306e7dd0318eb723b9aac9f7aeb01f84d622d44a2260334cb75f7e8aae3d80c368add695fdd80378262154ef96010b0822f74cd021f96193406604497920103043dfd90101c10108f400000003c078f98440b636fcd1757a779190fecf69ab4a7062b609a827784200b19d92a1af490be7d4d9216f25da4bde9a4a3396a8108bbdcd7d990a15e4b3407bba45d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30be33e59cd9da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F6805C71-458F-11EF-8D34-5A77BF4D32F0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2732	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2732	iexplore.exe
2732	iexplore.exe
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 2708	2732	iexplore.exe	30
PID 2732 wrote to memory of 2708	2732	iexplore.exe	30
PID 2732 wrote to memory of 2708	2732	iexplore.exe	30
PID 2732 wrote to memory of 2708	2732	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5aa52abefada86d87eaa66b5d46fe4ca_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2732 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1f9c34034a19d6621059b47c65c40729

SHA1
5ad7e6e54c3f6b8e2ccd4b610123cef2b1522f27

SHA256
07b8dc22aa3f0847015da7217633a3418106a516391cddaad71dded8eeb8907b

SHA512
ffbfbe969940d6a1acf5641b1208d90cb0d61545d67f3ba5f11325c494b133b60fad2a4c02bb831a0b384f2458ce493f5dca24f72952b6f25d8ac3e7eb62b95d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
100f7e240c61ec16355bf166f350f3fc

SHA1
80bdccb0476a7351e3ce31a38cf16c9a5066fe3c

SHA256
b7accca65cd828f76bded608c27829a6b4c68e57a773365e18ede0388b701ed9

SHA512
c134aff63b339c72b019b1c0ea96579c9a1751659db64e74ac13f79b607caf68a54a976bf79f95c31233a3162fa4021ae2a18b982e731d5d34bc717cdf89508c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d3905cf2b49ef80f231520303fba076b

SHA1
501e07a85814903075387ee830d6cb75953c0fb6

SHA256
9eb23a64e1caf463829ae156464854f37c443094f947d6cda35e507a4e1bf3d7

SHA512
cd4dbccd49a36af6e57dd6dc283f5f24bdea093032688564e5211b4862d9a7de4245cb3e598de622028ca12e1d7e53df60c4ee5ecb9a1d1e233a44751dad87f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3253622e02b4e77f0203f6d9cf1cfc99

SHA1
5680102f19c826933d7b77fb8cea026955299dcf

SHA256
5d85b317611240414ce910af12e76f3c51b95d1aed6883761328bfa82dfbbfe6

SHA512
9fd7728706e12994a7abe3c6d2f4c274e70ddb8450038d4d741341fb9cf563b279b6a71a753f1590bf3187029a70674c18b466ced01c555031de135190f1877f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
224aa17b6579090a02f3e6e31c8b815c

SHA1
067e54a7ab21cf8055b80583d049950a86955b86

SHA256
5e42d5c8a314f19186a1a7cddf9a9bc4268921a7cd269958f4e40200c7dba660

SHA512
e03a662d504668909902b60fc7292d6efa6afc6e3ce17b6a52b44a4c8f39f60c58d3c912f808de87a376cc5b9f2dc76b4f78c1f7a6032e97ca2ef1b1ebc479a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
807f2ce44b11a03e6d77d8952d37dc13

SHA1
162a4277fab2b0660857ea4999133f380ba010c6

SHA256
4891b6de1a82d3a069e971ffe8e1706a5f7909150d3ab772b9690858db914b77

SHA512
6cedab08a76f78777181f906ea1105bd3caa49ee03bfd47cca29395ad66d23d16fb4b9f6dd615b2a47b384259d7adbce07dd5955b8867106bf30e5826eb325a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
241c0802c5f3a6d298cddd5a8e102b5a

SHA1
f538e15d29dd394853491808094c2ac111c5f8bd

SHA256
75142a565d43ce01976caf66563159c28b0199e2ceb01b654e0af268218a294a

SHA512
e86e3b11dc0976e0924d317a72db89e2f77a000248cf1603b4b3ae7f92392e04c8f2c948ef4beaecdc7525b70d9bf89dd3f2cdb0bf733b9b36593251bdeb9c23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
96b244c2565c4c45ea5f41a809bad47e

SHA1
67f379ff602e829d360bcb58036e2ed387c461aa

SHA256
0edbfaf075960c8670781c7a40dd26fa6be5c9687da0df5c29947a5c75864a8a

SHA512
797f05966894461cb1246e459d0ae6053493904c6e1db5dbc4c3e72a62cf3458f3a51e53f5e18370793e807395680a96cd9be510292014a870075dbf6accf41c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
51c8314e317dc9994dae6ec707c2b869

SHA1
2db7115baa51039a6f81e710934da0621fe75443

SHA256
e599cf97dc95945979a8f544ddb5d2fb0296c143217a074a41a349821caf674f

SHA512
301567c2b4bc2a3897b661fb517b07a018ff6dc167c9ef6ea7c7852039657e0aa245fc81926238370820a07e3cf386ecd0e73b8946c5a898b960967c89603e91

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab19AA.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar19AC.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit