e00c824d431330578576cc5fb356d004b2b0d4a0e2e37a25ade6d0a41d925399

Analysis

max time kernel
119s
max time network
131s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 21:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

48152384abb2e5042aa31c55bfa93101_JaffaCakes118.html
Size

23KB
MD5

48152384abb2e5042aa31c55bfa93101
SHA1

77d8f8e9b882aa6bc9dfa8a2876372b4ae3a3ce4
SHA256

e00c824d431330578576cc5fb356d004b2b0d4a0e2e37a25ade6d0a41d925399
SHA512

c9a56a2826a7cf6dde1c7c33ca16cb7fbf8761464c4c275c73f4f198275162a5b3becaaa84bf368dc81889f790e931ba67aa60725597db5e75921c9bc27a8e4d
SSDEEP

192:uwrub5nkHqCnQjxn5Q/KnQie5Nn9ynQOkEnt6EnQTbntnQKdj9vMBZqnYnQ7tn+U:+Q/T1WnM

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000006ae5bfd0b3d906e46d38748e57180c0bc7c6d2a3c7eb9f09b890ff90a9121e5f000000000e80000000020000200000006232c0fdcb21a03c284b3df585a32ce2be8d707ec734ea51f516d5bfc37232c7200000003145a7fef38cc0232e149bd40bcdb3c0229b5ab49c28f007d241db151652109840000000b94d6bdf79c6096f58a4d2bc273575527f87328c7e505932b88dbfe07d30182c14091cf08bde202628e8d2295620fc691f72963879e3b4bd59c170c3c59515b8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421969783"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a05082830da7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AEAF8181-1300-11EF-92F7-4AE872E97954} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000004cdb4fa7082fa10a06a1c6ebeb07dcf8ef74e52b737ca13fbfe820f32ef0aeba000000000e8000000002000020000000e9825d2b18480eb2f1e67f46c149e932030e41a031de12c7103122c51cabbc8c90000000938d2fdd21d4f123ed45ac5767e20c21ec4d2eda0e2d01b1b1a949d0e0ea869c3a1b2cdcbdeae1b9772e46cc69c7fef9b1348100ec3c2926b36720d3c048c304fc27d1d6ec363430faac0154c92ea9ba23215f62902bd112cef37c723c26f785f14148cee21bad2a10571f3fbab04a0f4b66c9680cc9ccf3293a068c431813043ab0a6dfa68b669630f07c9577a2d4f64000000045e46c628756eafcb724df2943d69a5cf4cfb4746f8c7057cb103d5c2c6d99b8dc1bb84a35793a95b2da7135cd84af4506cb88db174544d45e750a90c0f47089	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2868	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2868	iexplore.exe
2868	iexplore.exe
2380	IEXPLORE.EXE
2380	IEXPLORE.EXE
2380	IEXPLORE.EXE
2380	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2380	2868	iexplore.exe	28
PID 2868 wrote to memory of 2380	2868	iexplore.exe	28
PID 2868 wrote to memory of 2380	2868	iexplore.exe	28
PID 2868 wrote to memory of 2380	2868	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\48152384abb2e5042aa31c55bfa93101_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2868 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c41298fb5c2054a7907e765114176f5e

SHA1
438ca44d5e61b0a3dae234d7e510c875ab2190ef

SHA256
4fc10f52fd5ca52c073a47924017a0f91e44ba2d740c1abe39a7ff2a0f294603

SHA512
2775cc3737c22a2c7c8127cc8efa462dc9e6ffdc2fc03222388a25c39c89cf2303b66512ae1e3e6ec3e8b86d63382adb801c7f9dfb69ff4ac3529a865dcbc516

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f08769b4073214b208573cd42bccfd58

SHA1
773578d513ef5bfaddfdd43db0ecd21b09a31990

SHA256
4e3a214989f9566d117bd7bdf533f2ca2e5930aaf7a56b354e2db1cfa25b99e2

SHA512
eed0d41fa01955b5657a6ade8d98135e094e692d2d6062b71369b5bbb070b8bafdd206568aad26a57b6bb176e22844e450038c8f5124c82256d5149c83aa0c0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cbaafa7d0084dafc4b9c5af98641bf2c

SHA1
3383275776975b88d5f6cebe2a7d0d75ba26c72b

SHA256
acf3858331172a7b6283fc145499c7d6f56896d86a0d46376d062075060f1b11

SHA512
f89b9180baebb53ae045ce2045c90d257996c083d9b361b6673c579f322724c571a39d90ab90c2945a6e62b0b4b36a7b401fb9087c69ccfcaea99f1a8979d0e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bdead98ffe4e4d2bcca910b3195981ed

SHA1
4657ade8360924c7d1a474ec68d49c3982088b64

SHA256
c7d8e21d10b0acb381163d42d8c12a5758c7d45f4011c5f0d0611c6e38ddf75d

SHA512
fdc965453bd504ca160eba894b5491a155771602ec5c2864283aa2fb1a9f3950da9ad29d6ed1c2df2982c3ebfef4fda6a84c126349b7e1a5c486d301db40881f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ec7bb69e763926fd07dd8076eaaaef0

SHA1
ae88af32e4bbee00eaa4705cba8587e7a1a3f52d

SHA256
2857a4d6290c2d56170226d9b6f18b556aa756fd6e7fdf7e8ff03e1e17c3b9cb

SHA512
515204989d607bb41d5af9b13a9061c8049793109aa21ffc4c21e0d7d920272acc0b03577d713774b6347d36039d7c28de415f390f971a11fb459c74632054a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7df7eff34f13760f78234ba07fc54414

SHA1
8a4a44053cfe6119c5f48400a4526a2b6b44d347

SHA256
429c391199f35b3d89587bb96025f3426a16ab624061bf452770b49db4daeafc

SHA512
ffb3a96985d685e5ff1f2dcac59efe93b28825b39d08dd230b4618621c1a188c050ee954bd35949e8fc8a9b16691213dde44e7442e2bee711a62611677c62e4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
728f3bd089bfd37f23083b87910e15cf

SHA1
e5e9b7d54d9489a3d34a4237f4459cee6fc2512b

SHA256
3ccc7a4a44a0d7d02b3431157050bae62fb6ee2954e39a4e909abae9896c0004

SHA512
46d4613b5cdb8c4972c387fc339a04f4a69f0ad58922d87cff9c7543d65723f11e9a5a8ab37b4069cbd2d140860308fefc3d5e6fb8fee54b99a0b3acaf2ef7f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e6242c8925ce20e7ce7c5c92f2af639

SHA1
0d0b5bd99f2ce9f219df83fb17ebc641355e9be8

SHA256
d35ebeb86a499ea60c5ccf121eec6d6c4811e7aaff87f031f14946d372f293ec

SHA512
39e6c40ab210b0f005f3d0a9e2ba955da5f1bf2c12ebefb6fd2580d8b61f0608eab91fa5854c2febe537a72c5c2e82969c9cc344d4ab1e9c0c70282eccba83be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84314128021b655776ef0e5050a6cde8

SHA1
635a63169159454f6deeb42db6e9232b5be46e7a

SHA256
4f1d3b61bcb6ddbac2e5d802d980ce89521c6f21c2898477014c7382fd24caf4

SHA512
1bf345d07d00f87ab5c6577675482bca2214bb2a21602ff3423a41b257185032e4c6b51d24bb0df44ce8b4a12142f49985688c09c342826a0c387a6b59fc2268

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3570a3fbe6daafc9d0a5fb43954f39b9

SHA1
97d0034969e36aa049ee63e8be43b1bde8f894b5

SHA256
b2be1cc09cdf606c85a723433438a08a6657b656e27343a984aff83d526e57dd

SHA512
e66aa4dffd0ac355dfc097187e1ab14f69f58aebbc50ce04397f11d8ad954c514ed1152225cd14a3534aaa93fdc3a077fed68ab33ec3dc3b4bb6522a427f9b64

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1F85.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2076.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit