da11a7a5c7d1515914a10efdc7b1062a4008091d4e33cd9676cadac5ed395713

Analysis

max time kernel
137s
max time network
142s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 00:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

48be17c06fdd979b929f269988e207c4_JaffaCakes118.html
Size

214KB
MD5

48be17c06fdd979b929f269988e207c4
SHA1

589f3f4be39458bc2961c7331da8cf34aa7612af
SHA256

da11a7a5c7d1515914a10efdc7b1062a4008091d4e33cd9676cadac5ed395713
SHA512

748f20186f5aa62ee67294ddadf50961c01ddd13e78032615cef54962af03b31d7fc9e3bbf59b8cbf8ec30cee0bd145e0b5dea048babd180eda8c629263b2664
SSDEEP

3072:SGGHl5NJhGFtIyfkMY+BES09JXAnyrZalI+YQ:SGelBSFsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421981102"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0A564F41-131B-11EF-989B-729E5AF85804} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2876	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2876	iexplore.exe
2876	iexplore.exe
2860	IEXPLORE.EXE
2860	IEXPLORE.EXE
2860	IEXPLORE.EXE
2860	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2860	2876	iexplore.exe	28
PID 2876 wrote to memory of 2860	2876	iexplore.exe	28
PID 2876 wrote to memory of 2860	2876	iexplore.exe	28
PID 2876 wrote to memory of 2860	2876	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\48be17c06fdd979b929f269988e207c4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2876 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ea11896f0c6f3cb24fd2379baf43d7d

SHA1
839b9ea85fa857d521f038dc13c82b8cdb9d5cb1

SHA256
b4a2529d8ff5a76b4c236cba283fb0518e5ef0e6eba3baa3030bf87d50c63d27

SHA512
8e5e7910cb5c2cb5cc5c7408aec0104ddcfd726a6b6d3048ca233a1a3c152615bb8d01717e6b7d822bc755711179d8a400a37e2ba2b493e57f4a6a6badce1a94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b791bc99294d8a3a1c5175322c206ef5

SHA1
85bdd307045a9fcc4c82bd648f9f44a96c0b638c

SHA256
74b9a2fe148cd05f2ca77136827fda75312e25d095b890f72004e100d19119c9

SHA512
d0fcb73469ee993177092d3790b03db2dbc6041bbd2ca1012a0b3a30e6dad3476cc2cc4e44cc207bf2eda3c0955cff10dab2b04661af196491c8c5409b5bf399

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27530f941eb426fc298ebd992524c1ce

SHA1
d162ea930467fedc4da4096cdc123352ee205e8e

SHA256
ab9e088b2663a0ef6e7e9923d50c767a4a6487dfbdb4f7147afe3640c05b3fec

SHA512
05a6b81853092f2b751253864e7340bc7b7e2bbbb4ece2de1ee23cd5b8f597d2f1c416856443a14ef4519f871e2b41634623e514c8da30bad97d95e5671aeb1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a06ee54cb4d2e217c30262457820990f

SHA1
76b4b393fb5b3185cf1e253a41df2e59e881b250

SHA256
eec76aae07a2b9b72907415b166bae29a46a70a6ef73ef98e15b60267db873b6

SHA512
fc094fb4e3d0edd5f8c35edd3e18e22dae2e37a50750d59cede28624c7417e8df60d87b9fffe185d9d60cc41d3f8104c7e68ebd9c7cf6455930add5a491d7373

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f04e9db0ce334c892cbdb87518a0d476

SHA1
3e0084352453553f7c7084f764fecd62b54b413f

SHA256
41c8e89a99d5e230f4e7524b78eb2facdc1816703b9a5cc95fc0b28de07f6140

SHA512
696b00748946842ab0d276cfdd066a3f91a9ba68da8bae9d861f756da2bc11f81fa42b769040f1a63ea8dce1ab961d9189799225449f0af8bb4acc9333c72bdc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5211fb1080ab5f8179dd5774027a69e6

SHA1
624fdfdd103c5c7612e407ed2539fbcf5532a4db

SHA256
fc1b4f537d38fa43a101cc0de7e3e0a16ca9cafed0333a93791622d97b1639cb

SHA512
51e0f75b3cd5c74e9acf9baf3e6db933eaaa85e428142e9a4639ff88915f5f1fba991d90d93e6c0afdcf6e2688143d3c1d0584dc60777fbeddba5bf9670eb73b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e82b26747bcaf63094bde26e89c18fa3

SHA1
b44f68b8099d469b58820f4c2c6ef812b20e88be

SHA256
52784bb031adeff7eee5f3e30227c8dab51d2b7a1d3d1149565341aa823467c0

SHA512
c32b54e28fd69e8b570e4f4b3e4332a90a577ebd4c6bacfff56ca86ae2957ae6399b7bb0fc3222fb759bc64c87cd7a040df3fd7549b13a7d95e68a2d7d0d2a6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
236f4cbc967700e892c8ab52fa14c5d1

SHA1
cc795ee28c11c8919b8cd307324b1461661dabc8

SHA256
731162b10b0e2c5a2464f7dd97f15b93bcc888b208fa0e5db214bea947a91495

SHA512
2b9d4c94bb2dc3caef48aab9fc6c4939cf20f7946a4af4029db34105d7501ecab1f9f5da4184a23960db4ccb648a8e322fde494c09985c8d0af9bc876c70c1f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2e940ea8c06cdf4149b40a7fb6aefe5

SHA1
5d2d3db5972cee755984800e947f0d8a8b10a482

SHA256
b249d02fc47eca31f0673ee7c255ddc329604449dcd8f1a32ce94e423ce932e3

SHA512
fc5f90b0433d32a2497145f2aa919e731ee01fd0400858673527597ec2af7489fe2a635c0214b64a172687cca9739ff0e4818ffb941d478cde77f2adea4444c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
daf640014d326a9b743a7aad1122c19b

SHA1
fc01e3df8a9bb494a4a1f9c7ca5c7dd5d4b97e9e

SHA256
4f659e1701cd2fef0bf0d1d7ca70bb118469e24fbeca42f2cb742727c62d2537

SHA512
449af9bc5b878cf0cd89beaa0e902eeb2e324eac09e331d9f08b1f34c07191ec4e0bf47cb1199b403d338d26a046f65b8e39c64f5fd8775a09c7af8a2c955f68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8995877e37987b7d6857112f17ca9e9

SHA1
41e7146014c6a6ac68f822076f488e44b627171a

SHA256
f82cf75ff5cc078f07e9e0e24e12caffdd75c5d18e4b05027174a5a7cc5b829c

SHA512
a36cc8d6338ade48af60f76f173d110044e900d630b9d7f361c5b8e9f695c7d9d20937fe7985c6a0967d38a2095dd13b95359c4754c36cb76bb60a19addee3b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e28671925570820e925d0c6548164b89

SHA1
5e00078f8e5f92759cf7df0507c78bb761f21e9d

SHA256
b8c49e30b256ae73e1708cdb5b54bc2e89753a28c1e38aceb50263cfbeefd3c7

SHA512
9d124002ef215a6c408039049fc025b0baa7b7db3c32809843a8152075c245ef530e6863dae099ae70c7c9d2e5734a288d95a402bbb61fccb1000694de0af299

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
634fdeb2387df0a42b5178f3daae4f29

SHA1
b5f68ec2b193c0ef26e86e1716a84417b1fbfcf8

SHA256
317154e98c8f67b468112fc0306e3bf13db89a9b9c06746755ebe371dc15432a

SHA512
b1bf8a1c8ed2b2bfe55c969e4d9f4d55daff321a6e6b89b38d9306109801501945ce77fcd0a14f47b12e1d6e550aa9e1c9f3f567d2144992fd62f1f6973ab739

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d099399490aec6792ca7bad250ce677f

SHA1
e02ae45c6c248e25fc3e94c10b1ffc7fc0a8556d

SHA256
d504e146d40d680d9be5614616b6bff5d872ac70d58ebca91238e261d7e36ac4

SHA512
623988a467568f6249fee56028e41e7364edd5268d20fa7d6eef7e972bc6eb22ed68d8b30c2ac9e3b7a395423b28f865f2e652be80ac25e78282d9da050b8021

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
818c99d4e65e7c34d26831115f64c2c4

SHA1
6c7c3c857f20cc9a438db3b92c877256720c4ffb

SHA256
7e04321aa7512382655648aa30972db03cd15dc9191ce99d14917ab4afbb9afc

SHA512
f7bed3cd7c022c0d5c2e53ea5bd4b9c36b0b8271459276a746de5e2f0a330f2d80f83d263e0bbc5fc0b19e7a0977184de9701b5a5ad3d94e14c94542cf6e7736

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a6b86d1d2814ecbbd9a52a2fffdb746

SHA1
9529cec2d71c99cfc65b56a2d754e1274f95d7d0

SHA256
e23210503c173223eeff8d682af2a2ff76d5f67671ad6030ae3833e9140b8112

SHA512
4463a22ca727cdf98366ac0a27a40f28264bea293b9e2b8ee85060ca2421a259ae427b2bde0917c81c8fc7c14ee671ca8126487cb9f314ff5a27b56207a4d3b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
777d18d8d0de952845e9af9b5b948200

SHA1
60a7bbd1f2998f13aa0af96408cc8f4237a5a3bf

SHA256
0b5fd0f11fba82481d2d03db0dbf34825e1bc9188db51a5a8955ef324078e6b0

SHA512
980d665e44ea5651680fc0b6862ed708b8fb0dbeae72bd3c449a39de9e4cc71562e8a714c385a7ed8198ead52e21a2ca81ff94ad99fb7d216f127fc6126df2d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
34077bc510eb4a166145f055ad9ef96f

SHA1
c26a6e71d443028c3faebb540befd0e39891262f

SHA256
a0baa1c21431d0b726841ca2fdf63d06fbd017b76e296308eab91dad7383532f

SHA512
66d17fdf74d9f4b67f84e1cace7a13c29ac966b900c2b8dec033bb8b352a4c3a1689baae137bec04671ec6ed8b3dc8c5e7ec05397246f95760d227deb169c5eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab957E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab965A.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar968F.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit