9c4b6032a29c5b07aa5bb64c962423c699287c4f4a1caedafdcda79d781cd5cc

Analysis

max time kernel
134s
max time network
130s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 20:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

47fc4048738aa2a6461f512ee23311f3_JaffaCakes118.html
Size

19KB
MD5

47fc4048738aa2a6461f512ee23311f3
SHA1

667ce53cecb976838ef300f9f63b936ee4961975
SHA256

9c4b6032a29c5b07aa5bb64c962423c699287c4f4a1caedafdcda79d781cd5cc
SHA512

6e5e7a9d03c0642fd9bf0e6241bd8b82e70c1160667f7ac9e8fd8e9a5a10d039d8fd0dfec16853635438d02fd65a86a4baca0370a522e33e30af7a15a376e250
SSDEEP

384:rdbq0/ez/TcY1YrjKj9S6wX2mfwaKOyzkFzxZqMSo7+hCyvpk6VfYQgriVNh3hK0:Q020+Y7l6po7OCyvumhj

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000f043b0c81b0a892dbbfdce22af5b6fcd1561fed4d256416535d6bd4811c33236000000000e800000000200002000000008767cc966c164005fb34b4baa22ac9ad5fcc8d481f4cac71117966f9d3e56eb200000003b553208778fae601e44621ceb7c2cf81feaaee07f9f279032f1872a8f9f7614400000002c74b403e00908f00bea4be505a8fddeed7dad87f103a3037d18314e743a5a248cf08ead97aabcefcf5049be9a1a57106a9dac2585094914e2d85930ce98eb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40bc1eb709a7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000cfa4cf4d3d82035b10cab7d6f488ac0e0f2270c041cd26cb39aa08b55819fb3b000000000e80000000020000200000009da6a28acab651159cd433dae0791ddd9f85e8168e7d87f1b0b8202662beb91390000000b873503d8ef565d27a99b5fafc618cd057785022beda1b5a66b7d1e5d6b75b216443544743dc760a962f57f6c5ba1679b0eb285e39b4f1199e128fdb6441d80317d5972af733a03ef904cbe8e4c7ca81ef71b9eddf21aa79014046b7d411b783fb903980ef7e977eb080d0725d30fd2d29bbd9274255667c2e3cd486ea7d199390f2ebff4ee5d22c62684be316e0c6f4400000007805aaa0d22ad52877fa5f827b94958df3b2cf95b28cba7869f2f11cc261f59e3afee28ab75bfa0b60093db1200e6e7726eb8542fb7d4b0e11e1ee4668f45ee4	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DF8B4E51-12FC-11EF-AA6D-D62CE60191A1} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421968144"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2892	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2892	iexplore.exe
2892	iexplore.exe
2852	IEXPLORE.EXE
2852	IEXPLORE.EXE
2852	IEXPLORE.EXE
2852	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2892 wrote to memory of 2852	2892	iexplore.exe	28
PID 2892 wrote to memory of 2852	2892	iexplore.exe	28
PID 2892 wrote to memory of 2852	2892	iexplore.exe	28
PID 2892 wrote to memory of 2852	2892	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\47fc4048738aa2a6461f512ee23311f3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2892 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb61658a12de6a874a7cd1c2ea831335

SHA1
a9ccb533bc46690cf81f1fbd14afb8e3c1b44108

SHA256
3869674588190ee1f85e4e48610b2aba201935cc0fff855312b6b3d8711a3cab

SHA512
24c71a7547e7ae615da32fbb4d7147f7132743f43ca6e2f54918bdf74e0a1323fc4ce9cfe84ceaa7e0bdaac7d973aca91c35eb96c0962aba12837de693006521

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be4544837615875107015d84f287f03f

SHA1
e39a0c3722b27913721284fba34ed46f522265df

SHA256
33d0313aa8c501a20eb7426319531770d2a7124e31bf50ade545a33604f0aee1

SHA512
db9ddb00cc89ea7a05590fae735995f045c938f82f79d5ccdfcbe1e1be9fc5dcf8159cb8b1b7e8e1f1f6d0f8edb8a4f07d922413fad1fc14a752f5b92c220f95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
493b6030eb96616cdccdf9fb8cff19be

SHA1
71db792cf7f604de0bd33d1fc363f9dc7b338484

SHA256
37cca276394638c1557a2a2ed6fdbd79a27bf211f782e5446c0884bfa1fb15e8

SHA512
6d4183440fd048a385f2d4292d4eb01b0bfd2a54223b4b99a0bc26e2da314e3f21e3904e7266a6ebb268d1cc5e0d1106356cf7f9c2b7375dd158e2ae90e423ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f1abfdbb90d3bd2f17f0d6694c3393ee

SHA1
69cd30664d22cf8eb5b231d816419521f12fd564

SHA256
707389920d00e4b3a990a286bc2d8b54fdf66f4b6f158aba0a07e34d2e9b2ca3

SHA512
54459463eb33665c286ce9ed1e0e8f0613e95a72d8361e942f99f466ad58413ba7effc55f6476e28d11890cd5d9e1f096eb30112d94cfee3cba6cd7286fb2d90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
34d4532fd9767fa680872602490e7e54

SHA1
f9d9c84d2c9f0e0ef23d1e5fbcbab57a23a46ec7

SHA256
fa5778ab8dfb14a3caed91ceed5087b0a2a4ef001d6fe2f06f8fe34226adea75

SHA512
70f338f868519d1edebca89adb571f2001062790efdb8dc810bc0da547e3ea2e2e270dad006e0b46351a49e9ba7681c866c7e2ebdd016c8ee5dd2cbf7adc234a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
554384d215885014b72b32d2102da02b

SHA1
fbefdbac1a092f0d49c5a072a1c09818e3472689

SHA256
6dfe5f7e58033c3282cbbbae5bc0c38884d743cbe54a36ddf6a4d3c1aeefbb75

SHA512
e5327b9ebd5933bd21534d401cc94d71804229ec7bb7ff99e882812810ebcb583a0d0642dde075d84636c1f293ff323ff9f55d5898b92b290f22873517ce9d1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
121e28a02a2dc94567745ca4315990c5

SHA1
f4fd395715fc33ad2943d7bac06fa72e4a9e4735

SHA256
1ff703a64422033e83099bd8ec8bba176213b620ac4e28bbcd755eaea38a3f14

SHA512
b6459b5531dd3fc063d471986359e47ddd2a3cd9e126aa8e133de346c43772c5a78e78439157e841318da7261a6e71cd775e2f736126844b469444d3f15567bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5db6fd3dec3211f241c8cdf1f260a653

SHA1
4a9eb363c7843baac9f6b06bb16d7aa02b795109

SHA256
0942c8e68c5b7fa23f7996bfac1e9a4f8529c6511cc5b412aab9b8c408bd1315

SHA512
b97797e506bb30af9fac4df2d747311f5f708c30dbc75a29c1262a50ce3ca29f56057c41b1370e4b0a6210ff489786bb78345ed321599b80aeffb2d9336deb29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5fd82e508b131077f755c5509937d3e

SHA1
85d0c779a854c79ca590968dc0abb75be3a73dfa

SHA256
83893ef6013dd0bb8fe499ed420098c5a516f1e5b4ca4eb8177a2ba422903f55

SHA512
53f76028a3dc2d3736934303f3dc28e00c3457ae2ffeb8dc645305209414f399031eef68a94d55d4e8cc4a7b8114994a20adde19651229ef11415f08d40c9be8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c92f30aab14654df8d5feaf3d09986a5

SHA1
62ea5332a9d23fb7bc2d767399a53eeade7e95ec

SHA256
e9428e20ee9585718b2f2c3401a14e453249a388e4d940697b5d6c606d5f4316

SHA512
42f48ba7e43a8b1ee1c7e3c4f7145ad429c6af2af34ec784b410fb17760ac69fd8b4015f524d3a63b1103c8fc7169dfb57118f2a7b0688475bb77de7d3c09f38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c02e2a069e44d84086c724dc288139d6

SHA1
87be59dd9090c9900764cdd168e655176c0a584d

SHA256
c9915fbdc4ffa6fbedb9d9635d30fc06b65a6e750e38984e45787a56bdb43c4d

SHA512
882fd9f035d3420d5b87c47444bd168d4026e0e07f2a44b83d0435d3a4c94b455fb626dced226775ab6762bbe9acca13ae46454e3ba65c52aa27d0ec7b008aaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
48694e50d8718cfc92d79e70b14c71a5

SHA1
8f7337cb6f877b1d6f7128cbcf0603c750b73187

SHA256
eb8fdc489bb263c55f6d4dcdadc2dab4bcff4bc1372b351bf2bed213456f2b40

SHA512
72918057eb7689ffb6a2873382a77a34ac4dfed35e2ba9be259caabe91b64dff4569cd4bf51fccf9353fddf98f671ca213d4b31e38f6de27a78249d0fffa1cb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ff5cd138133f8583b86a4a6ceba516b

SHA1
4657f54bb2bf12dffea014bb75b98dadf4c9d97e

SHA256
fe74b782d69406fa5c0198e5c0ed1e0b07a49ce2c0b5c2c01364ebd279b9f685

SHA512
2f846d878c87c80951d0e8d883ef38b9d0a79bdc23e5ff06285e33387e53424685f06cbe1cca34048ef3c353013b198d9dae74cd4a28535522da8f97175cfabb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab587D.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar58FD.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit