e616a2e9b18c354c792562fb3bbfda9a0c723402e185566b415d4ec31742be27

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 23:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

48a789e236e653243e0000135f9da1d2_JaffaCakes118.html
Size

4KB
MD5

48a789e236e653243e0000135f9da1d2
SHA1

330df46076d6fea107f00ec18c1f3887290100de
SHA256

e616a2e9b18c354c792562fb3bbfda9a0c723402e185566b415d4ec31742be27
SHA512

90d20cd9338a96f75bfbfb9af27b2e7d4c2fdd49ad353778a2535d3b50e849d3c1f912ce8f478120d34b81d5b548cd8bbf1c7576e1a20fbffb5211bf5688f045
SSDEEP

96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oS51DLd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pD/

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421979375"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{05BBF3D1-1317-11EF-B20D-42D1C15895C4} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002a974a0db1fc0d4abafc0ab364af10d500000000020000000000106600000001000020000000b419938d86449a60d3b90ace33e43c2df7d7d0387eab62c65db660099a77c5ca000000000e80000000020000200000003de179ee0262be3b9097feed9047b0e27341015809ffdca0db9b224aba7fb5df90000000db3772423f58372ab3cac9837d76fca3aa2f21b602127bfbf28e037cdda2117b02ee433086a610ae402ad52d89176df0cbe878f21343360fa136df4d69376fb024ccebf4e23a4408e80c777c03d3c738a4ec52920ccac67293397a2d88e7099bd80143d4d23decaff865d2d3a83a6ab0d8da9a44aa45bd0d9ad6dfc4cb617555bcaffd46359894ab148b8243cda95dd2400000006d473438d0919eaf60be1ccc32e99a7cea3543328d31b0c9c7bfff25024dabecbc3fae794c0380b11b3bba3c17cf415ad773ac0f186c52b1d6e28a9b0e75eb6a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002a974a0db1fc0d4abafc0ab364af10d5000000000200000000001066000000010000200000001a8f1ae8697c596a5fec0176b24d03acd2b4608b1aa8be62bf79e859eacac3ed000000000e800000000200002000000050c853eca08956eaa3e0a21b4ed0f4209dcaacbe5918e186ed9fa351987866e32000000049204f9d0f3ef2509c8da69738bb54921347b9ef6196cd9d56231da2d7e2dd5e400000002db045cfcddd7fae0d33257096605532077cd92881442dfb6cd455c2cc1a79b688ebabacde1421dbc695e79363433aa1defe9c386bb069e72f82a03f72e2aba3	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0ee43da23a7da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2220	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2220	iexplore.exe
2220	iexplore.exe
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2520	2220	iexplore.exe	28
PID 2220 wrote to memory of 2520	2220	iexplore.exe	28
PID 2220 wrote to memory of 2520	2220	iexplore.exe	28
PID 2220 wrote to memory of 2520	2220	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\48a789e236e653243e0000135f9da1d2_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2220 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47289cff75fe07cf87c08956f96b4959

SHA1
529e3bca97b260b5702eb475e23da3521625719f

SHA256
3bfe2f60978126b475edf9f0175fd42015bff96b173a403114d8b9697307e868

SHA512
2df5e8e69bae90085f23564d0a81cc2aa8015f7c1b12340adb691d5c516351b199abc42962ff1c133dde88752e08a7cd9b5a6703bad1073e620520ac7c9f9938

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce2026fb28fe0939164c2c1d96967f02

SHA1
e69aef3e374216cb00f23216702afbbf49b7f084

SHA256
633f69e81a009af016b2cf672d73edacb7a822f3fc8f60a896dc964c627b5071

SHA512
f483f4f09e74cde4c3f288fb38606dd34bf66c27f9b5dbde33a6b8939117fcafe4fd060d718594ade4cde5790eef6243d314f04aeed3a012546c5b85990eaeab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4cf37f3aa94a686680cc36573509aa25

SHA1
aa13417381c33409b9cd0d83d7872885368fb2fd

SHA256
ecaa7ba1506375f3649a29acf5bb41c6a73b99d441a30ae9963dc52734dc20a9

SHA512
0cebd4aaf4b6c06068b8ba930921f40ef0568138f7e58c7ed2bc486ccf2a68b99a81b5e4f5668be941faacac5558052f4326a9644588e26a8e5b278bf8d95d74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb1c1719dd5da8a234fb25feca68e47c

SHA1
c4f152396b191485f1cfdb6b04176aee29487b8e

SHA256
3c8efc83f07d4029e835b1e1411e84662c9eb2f5e0c2a509f7b2486cdc01c2e0

SHA512
01f6490e6c05e6d884f40013ab650e3bbcc368d0a2931284c2f0d275f6c8df48b84dbdd32cfa344c4e8a0de1a2a50eb88fa6d32d36235abd1f4db60fe9d0ab43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
341d0da23dd43b97f29fa7747be42057

SHA1
c7fc73da5e84a313018c44569c7b62ac10d4b22e

SHA256
c422eb8f8387e851f23552423b655546fa6d9ccd2c7624156b07be7db9cafe90

SHA512
7c50d3c3269ec84ac4afe80b118f0a9038ec1f5f4f7827ce5b59504912516ce40e4ddcc9c4c2dd53f41abb50f7bd82077f3043376e40c856eeb73fc074a439c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1181a930a98b84d10a7cd6dfb9ce6ff7

SHA1
f5465ff46863623013c2a97112f79112f7ac5c4a

SHA256
4b35ae8585d80213845aa615706b60975909e4f633b586035e886b56fb7c688c

SHA512
8d9ed1e4f3111ae24b9bd244073f65576b59a953ac20d25f46a6dc6648f1e7256264aab0c105f363015f39723ef2dcc2b3741915b14ce35ec8085c09095dc2d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91970f4e11a7167dbe6ed1352c10d621

SHA1
60dbd94ebc8b337f390196f1f57af3165bcc69b3

SHA256
b0f99c310952bc9ffdbc8c8dc21fe6df38a87b4f46ecc9a264b65f03ffa9cad8

SHA512
46aa2265be7740b81c20012c1c496313accfd6036a06fb97d6437928373f1aa93f57d65dd35f4790a82fbbb384eb80e9b0a1ebc2b726b2e6d8b73f3a540bf867

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1cba3ed326e6f1224b372cf8f49fd8f4

SHA1
572fefec0ef70835b2f46040eabeda3aaf098c63

SHA256
e4a9c2ba028490dbb9322b2d957727b6c888a60fd18cfbdd11823b939515f89c

SHA512
12dee221bce491f619dbb0bd51089edfcedf9a3a25feb4597bc864d1be838585703099263b5306eecc4d4a1da953d9303cc297cedd0c0d0be124e49aba054cfa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05952ba740423006b6e20cff3a3122d0

SHA1
49bc92069f922363af82beb8aac9acc9e7626c52

SHA256
e7390c0f18cd179ba4caf14d358b769bc400e483e6b7b6110d27d29e54dacf18

SHA512
d7f781a03102b54b9f5a5fd0c49145f3eadf51a8c9dd382a23b461fbbaa869770a3acd23f34a95497566b5252aba1270b272af5b517928b43d4dece19e13c2d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58669d6393d71fe3bfa6e12313be01ec

SHA1
87e8755fe77b8f4fe761461f693cb9f142143ee6

SHA256
046966fc9e39d154ef55e08268b044acb33202164a0c48185b7a389e703b90e3

SHA512
c7b849ab277d5fa43daac5ed4ecc2ed7f25da1df0bd2ff7006d80632055fea11930fd67d966a2b92f3e880f2aa2738a84e4ff3f55519e3b4d7fa136923aba44a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab254F.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2814.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit