153a38adfbf1ae11a59ad9132753c5a141abc7fc440635a906c62529f1a76265

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 09:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5b522f1acd44d0ad27952d7630cf7ae8_JaffaCakes118.html
Size

6KB
MD5

5b522f1acd44d0ad27952d7630cf7ae8
SHA1

988b91b356dc235a4ca474e5749d072a6a448943
SHA256

153a38adfbf1ae11a59ad9132753c5a141abc7fc440635a906c62529f1a76265
SHA512

34cd360ad73419a93b3287f39286feb15c7210bfe7e4d79a443adb4a338bd969cd265a2c0b57dd10262ed9020c618f215ad0948645b668413c091db46a645c62
SSDEEP

96:uzVs+ux7wYK/LLY1k9o84d12ef7CSTUKZcEZ7ru7f:csz7m/AYS/Zb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427542524"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf7100000000020000000000106600000001000020000000edfa8a42787c96ee8853586b759d714e61548502b3b38fc1959ee21136649c97000000000e800000000200002000000065a59c5ba6ff84b1528eacf374b0dd50a0a335ec13cd1e284a375470a539b59e90000000686fe93bc4f11234122102ef8b0dca85921f8e00bdd68e91c90a15bf63bc259a3e518c17abd871ea471e62e33ff4158a25052020016055ddb6291dc1df3a464f38f02ac1c5747b2563c9d0fa7426c227bf7984ffd99f0b9a8725d7bd0c224e65f378a61ae2c5058505142bdf14af4fd27da958c88e68b8e88e3dbce6f22431f124b9c6efaefcd5c373cc477bec578a0740000000d753c1cbe5fa530e5298cc6014f08f5090df8454f7b598313de0ab8236be6390a9cbe6c0638f0fa82f78259cca3993580e0de90d807747882c198d52670c191a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80279d93bcd9da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BCF365E1-45AF-11EF-9749-F6314D1D8E10} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf71000000000200000000001066000000010000200000001147274877b01224ebb0ba9da9fa99732cdcf49bfe743edd63777eb431fc6236000000000e8000000002000020000000fc142b843c657e5a062f43e04efbefdb036c5876494623064752916f2bc647bc200000003cc759d6f9ee666dcf95e747427cb2f604aeac8f902cb511b62dfc81b3955dc6400000006c6fb891367e02feab6e8762ce68a7e8d559093b5cb74f5cb1cf826f62b5f7f1ad43cd7cd931a1f2222cf200451b60889a93c5c571cc2a41713f003fb50d92ef	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1360	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1360	iexplore.exe
1360	iexplore.exe
820	IEXPLORE.EXE
820	IEXPLORE.EXE
820	IEXPLORE.EXE
820	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1360 wrote to memory of 820	1360	iexplore.exe	30
PID 1360 wrote to memory of 820	1360	iexplore.exe	30
PID 1360 wrote to memory of 820	1360	iexplore.exe	30
PID 1360 wrote to memory of 820	1360	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5b522f1acd44d0ad27952d7630cf7ae8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1360
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1360 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a23cd34db1317aa0bea57ccb3c7525e

SHA1
dfec17de883a2757ad7949a0434c25ad0fc5f87f

SHA256
0e8f12f50422996db526596af15191f283580c1d44f1884e8292786b9c929c6a

SHA512
9d71ee0669c15540c9a3af0e17720052452aa8338fa52c1688e8aad7a16c9672b9ca19f58dc17df36b41e7a7522dfe90168ff7ad304ef2015bb260e74e1dc52a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
241c13b698537a64a1072ffcd15212fb

SHA1
fde82265419943cebcaa1a06f10535039ba10880

SHA256
f40c6a6b910f9103f9bb5f7ab722b980b14f03778c46bd92885cf5d2a8f3463a

SHA512
09d2708dd17674d1741a4e01024f3da0f7281e0978d9447c316036f2f208d17b77f46ea54b5d4feecc54359c110a28d15be53fb93e654f912a90a54c079fa491

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5bf2a8ba6250ea47dde7c4f706859e73

SHA1
9f4c3b4052a6589e0c4daf464bf216c4ea151a72

SHA256
f6d6a6d895aec6c02817f3a289ad9ed64f87a805634d41a1df0601ee06a54ae4

SHA512
539eb85af469abdacfa3486d111464b2eb22402d05bc8415fee36c34ee2e89b44bfbb7108a78ee82289e3d0ca7d00085bd605818a4263ce9fccfc6b3b5fbd0e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3b6675ad3037290513c31f85517acf3b

SHA1
91f01536879a7cde4444121e598429ca0acbec0b

SHA256
0ab3af6bad78f35293776ef8ee29fdf29848145900e391c1c5002125118e408d

SHA512
2b74c785f592950896bb46d1eb9a9374e955883c7f8ec748bf31443bc164b20767dddbf19b3ec1ab41283e7f68f805f9ac51c93a2ae58d075cabfff478c300ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c619a1604981df84849cb75309adddf4

SHA1
b9ac6cb966fdbadbbb310650fdde8f96e6affaf5

SHA256
83326a708257cf6d4fbf4cafc1b3e97a1c2e5fbae6fbcbae7177565f86d52c79

SHA512
1e9baeee4236d3f594c426d19e0df4c3597f5cc939ce31f8561bdf239193c5f4eeb033067d64b120fb635ecb5c9839a1ef34154fd40caf0654a3cd1df4a454cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
800ce61db8f65fa1ddcc6981be554b43

SHA1
79134f6c150eac68daa1f549f891c45d6e49b059

SHA256
13d804fe85baedf4a49eac6e13fa865a447659cce03a3f27b0e9740843505965

SHA512
3acb0aeb24b7aa8178027d1a1322a5d0ff809ea0b5ec12e29986d5cf57a6588d3febb6fe5a1af08eaf8d1c3dfe362674b24f13e384a234bbc910a3988e9b1ac3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
49a8c2b96eddd31e976d8ffa89a5ce29

SHA1
633cf7bb09ad917f410b83247b080ed12831aee0

SHA256
882663d834d956d5a99b23825f2d50e8ab60337980b261a39f4188c0ba99ce00

SHA512
162da0a82b25b3b333c168f8aa665ffe7dda207ecb3d17c5dbd8b1b007950ce8b3e35d445e0222ea7432b4079a5bb97f0e23b3136153669dae04266dc7cac298

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4367087d512b1bb69b1adb8a66f3e2ae

SHA1
087e61979cf6099b74cf9d7b5c412b5503c40c8d

SHA256
3c8667a4ef0072dced64424ff012273b051e4da7240d4f3e0ea7fb0ea98b7677

SHA512
ead3e149f0404582b82c4ed0b953fa71d78b77571a0843e6853bc8eb88bd89659e9e8aedbb899558c0d64ab8f67db4f5737fc75222928539287ce9dd660f7703

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a362a7e8fa628930d9c15d85e09f7581

SHA1
3aac14ea3c904ed295b2781b3ee6b5e5f3fdcb15

SHA256
30864214b74faf6e71957f2f16fbc27e72afba4978ef5d74fb420c70508a2812

SHA512
d0cee906fc3d858a00c3f3c32d6c326200815605028a50d06d07df249a109c3280c8a149c660fc544eb185cff7e1091e0946dd26498556962039e41236b53173

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e8008c7f5d9fea62969758b751e18640

SHA1
47564ab79e85a88c2bb2c1efbdababb4d8f2276e

SHA256
3888ec5cd3fa98b0c4080a45a6b53d3d8e23b68dcb4870d6d407d2cacfd7a800

SHA512
70a6f27faa744ab5cdafc25d45a75348a0959bddc5ce4b8af585fe2fa09f890e83760537f81b2e5ec1248ff05b6e5007e2a722fa4aa1bbfd4d9459c37bc22b6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a0d73d3a1ba85fc3bc67fdf0af2b21c5

SHA1
c06b8d708544004e2e7f834431fa45a72330b7ef

SHA256
7ba8402018eb36234b04dbc8a2caec58d120e50ec723fec8cce062ba84089947

SHA512
2128eb01e24624ca1c649704814bcb96fd0898d2ec35177347bff9743fc8a4e337388753dd943b3c8b1358c0ab3baa98672afb5c866914be5572d90c50900c3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3749.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar37D8.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit