5f704fdda52ff36bd2f5116fd48ecfd51187e4537b2ba95a90c9b7ca176ad292

Analysis

max time kernel
134s
max time network
135s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-05-2024 01:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

48fd3f43510f2eef166d0d838b1cceee_JaffaCakes118.html
Size

69KB
MD5

48fd3f43510f2eef166d0d838b1cceee
SHA1

960a4c25d3a10fe237413adf903a6211ffe600fa
SHA256

5f704fdda52ff36bd2f5116fd48ecfd51187e4537b2ba95a90c9b7ca176ad292
SHA512

fd91d6a48ab8dd36f41f7e887accfc09f059af93a56d6173ebcdc5da9f2969686145ed120ae996827c5b8ace0a28aba7cbe723c3754e3eb605513b05cef9b4d6
SSDEEP

768:JiogcMWR3sI2PDDnd0g6vfBPFBHoTye1wCZkoTyMdtbBnfBgN8/lboiGhcRoQFVu:JCcP3ITvNen0tbrga90hcJNnspv

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A7C9D211-1325-11EF-97FB-6A55B5C6A64E} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000ff549f964da9aedb138423003b21f4c457c21b40b9a2911e1b5da6cd30f80b4b000000000e80000000020000200000001174824111902fba78d438ad2a2f1a1740f05eac81d6e823a73120770974100b20000000232d2cee93ca2f7e3458350455aebb1abc005cea02996aed386b3679232b5dbf400000005c43cdfbd92aee71a60d0a22f2d2d6c31cdadcfe0f7838723b7584580c8aa1361d04d80ae8c3cbf614db78f075ede8c31f350d07441c5b519493421c31e29457	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20133f7d32a7da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000fb9db499efcca83bf6d4efa774a16f5af0bbeadc6603984df4bc0e1326a16bd3000000000e8000000002000020000000b698022df166eb6c2158c810fe74ae25e8a48e9c807967d672e15f36666b418c900000002248aa5d8351d1165f4a63f45a4c3a67a21f4f0a585fd6db60fc537ca60753a628a2fb7eb068f406cd671134905e7a7359c1f82296f6ac9703eea3cf6c1db9532be376b0cd3ecc4a8e839b3e1cf61e6f32c595b93192f2303acda1dc0c4e5ce3d4ac94a931e5090d17a56e4162d3a419439781f1fdd41417a4a4d9999265118a08e2e616ec1bbb5c4890740f0a655987400000003c8e2bebecf94696390cc508a9e1ec7b2140371ff3aa3ce2dbb7add58656d4ff64f2ae71b56930dc9b572f3b14ec402dfd60349387a3ffa3a930558669a8ea8c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421985661"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2648	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2648	iexplore.exe
2648	iexplore.exe
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 3016	2648	iexplore.exe	28
PID 2648 wrote to memory of 3016	2648	iexplore.exe	28
PID 2648 wrote to memory of 3016	2648	iexplore.exe	28
PID 2648 wrote to memory of 3016	2648	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\48fd3f43510f2eef166d0d838b1cceee_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2648 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d59e28d2290fe8baaf02d3058a7feee3

SHA1
4111a4870b5f93ac04904fd65792a3b1c74714c1

SHA256
8ff87d42783e11b05cf63d227e2832c1801335d1557b46219479a73c5738b726

SHA512
0ea501d5d201701f1cf31f03e8db7d50f7e1160403600ab2a96cebbadf98a34f1dd8398bdeca6194e9bc7d9c8aa5b6cdc6bb55823fe542e7c84e18c1ed34eaeb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c5d2928cd9b04e2de41e7ec88046492

SHA1
00affd4ff2fdd0b09cce6100d00b94416850c0da

SHA256
cfef252537869349d60c8a162c12902198c96a4f8406c2338bd114f97d6d2c6b

SHA512
1b929fe9539988678edd780927188fabf3ee244fe917c9fd48f9154351f620475c2d23932df3c55475fd10e10c448539aeccec2ddabdae7d3eeb8b40bc593aa7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9175930598f197e69b2da1d6ea5c688b

SHA1
65c494bcf33afa24aa0649b7e2d610d6a500d9d3

SHA256
e50a50ee9feb2b87561642f5cbb2ff8b3dc78b8468da43a08efb03b1b2890a8a

SHA512
c735d61d318e621f0db0862d1bb31a1ee4679c9e9ac90120d41ead4a42db86938822b196c971f142138abf57a8f32d2161d4fde0a1912dee2741a8d828c9d018

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
954aed5ec04fc6dc60aa84a362701dbe

SHA1
1788295c56fdfa8be0f6ecd6d6ff1440a8b2ff1d

SHA256
19e39fc4e513388f59bb4055e3f7ca8ce93ba2aaeec95c28ec8dca8d23502a83

SHA512
73558436497fd00e8c5170bc86d19381061c0baf7a4f9e9fc5e7bd28acc5f58c53d8e9ef8d9c568046a410f83c5906a938c10d44cecc3f094574152eb21e900e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b1590dbbf15ea5adc02d979a4b9418ad

SHA1
1a24d9aaf4d45875c8b9ab4e6339a4a1ba4602aa

SHA256
516729e1f57f9231fa368555f4910e32216ea12e0ca8ba022cdea7d251077d57

SHA512
6421ace184675b8d56a67b1f011992059e5809d698909532105443ac5d478921db77fd4818a944bee577ed4c585ba7eea914e0c0e117a880225b36fc08b8f53a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f5d624cabebee3d23fcda1b688641bb

SHA1
9bf9cc2e300056e2c4afc5f99f74d3060d82af63

SHA256
64dd86a5d8b30d68c50e8db3242ab2b3d3896c06c399d94c604c9c07ac7ce050

SHA512
8f78852db68533fcb439cfee1779bc69155034d7d9030080dee8693a3b8c957f36bc3153a38afa2859b63be62f5b489303a99d221c6dba696e29f04bbf29e485

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
41d162c0fd4d6e9946ee4cfff064112c

SHA1
bafc46992755e950e0cc451be367ad4c68f70a3b

SHA256
648efddd25df16899575cc59f86e2d10e2b1c2757c39a03bdf6cccddf11d025e

SHA512
b616373f8687735194bda30b64b5f64d48eb1fe151743a5853a92d7d3329988161690bd77a1f2194c8036d9f64c454f26f9f419824cfe7112c467702e680d87b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb8114948ced6978b1f5285d142be590

SHA1
70b1e730cab56456758e77c29f5f3271dcd52742

SHA256
270f1e14f23bbf5f679eaffa07041bfb1dc0057109f78c79121527c4f5771a7c

SHA512
4dc890d2e5dbc7005d54afd8fce478083e6a46eec2c1c9d13625032a627f601ae2a09b872d2dc8523bf037eb8002c3fa90787a9a9dedb3c176faa80b3ce571b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6deeb1081da906dc3deb447b5bb656f7

SHA1
d2509c0466b05c49953e2f63a0ee5a5ba9150111

SHA256
70d0f5343e402b7d67e826160fbc2ad788c35519d858403e7ce67d6d00add771

SHA512
57273b26d1616b39787a9e4a705c45261a887ce323ff8f9493153f539fa9bb210aa66c182bebaf8a2b5f289edf7c97488158a769ecdb679b89a7253096e2e0dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25047351bbd51fe8f7954e4f5a5447d4

SHA1
1aebbb0181a5c731233cdfae5a52853d6f7bb445

SHA256
ae002b7d1094729052217fd4679f411254687599d4f9e6ae2178f689811cbfad

SHA512
06c4a9a8fa8c4c46d7a107e38ab7a43a60883f18904ce688ebf17b1466e0d1c1baf6c3b0570d0371cd26d35c368269815d447b99824bc8b1f04065d134d9c6aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
72641879f47eb0b3eb47e62e376693b8

SHA1
6292850d670e0025ef52beafcee33096258fd680

SHA256
335dadd7812316bb5050d69c99c7c1430af476eddfb77ce3dc8e0300fad20f67

SHA512
7f6d77ad05d05e50bf4f2ef64a2a9afd367442a9c21ce8a2a54e9e3e9b943bf47b19afc21ed6e773486c8bc080cde9327fe74f7f896852c27858abeba5b1d62c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f1ca82515c14494bbb60a41025c8d17

SHA1
ba1b35917a7ed285739c8ce244c5c03ce7797234

SHA256
a74fdb33ca795aef049f568d5f7097b98508aa48c023c9aed220250135a9aad1

SHA512
141120106b0a9ac2be5855f7280665498d3e5f7746f176a829551da0f2ffec138c57ef51372b5415f1927433df19b940d0940af71c993f54930f88f1715c2972

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
54841e7ada1ed1261799d62bab8c2237

SHA1
de450f217670672feed8e655fa54e713a3a8cce7

SHA256
28ea9d4a00b7cf9bc4e43ea625c6908e53bc412bb22f8ef6069bbdd4c33b252b

SHA512
ac6dba466d5eae06fb4c985f8ab68e3e364fab453d0601805094d83293110950c31dcdb70f17495c00f46175d3fc0af6514e6c604cf73c4ee148b2ce8ea21dfe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2bdca3279e8e606392c319b6974149b8

SHA1
ff668d09c99eb5f78ada64fb75d0ff45faeca369

SHA256
56e0599551a85b04caa0da2714d17147f6067f6acd1026dbea35a1e260758272

SHA512
450ff5c81cca13b09e816553fc3c0ff0248cfe7349579c3a07a4922176d2c96752db17717c38dde9501bfb1c5f085e8e785fe654d3277d5d3a05e14118597511

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75781a062054d8ec3715332c016ab0fc

SHA1
0f6716d89c612b96f326d74b309cf8ea0ca8edba

SHA256
8a31a11e631326b2702752343a20387daf1c023393a0dbc0013746bb53881093

SHA512
60cddfde8f23480fcb43ea9a7f5fcfc61593a26b1f8cd49f24bbf256609250733c974f65f9dc09ab4ce2924cf45d3e482f7082d581a3361264eb6ea85c7a8f0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBBA2.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBCC4.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit