ef2543a45505b5e507f4a4b12396b0c23ab88a69a72d73a791dbb80bd018922f

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 01:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

48e43eefb3647ea5e40dd9e21f472673_JaffaCakes118.html
Size

39KB
MD5

48e43eefb3647ea5e40dd9e21f472673
SHA1

bf7e9bb76aa01ebc40debacf7aeb0ef485d3e7b4
SHA256

ef2543a45505b5e507f4a4b12396b0c23ab88a69a72d73a791dbb80bd018922f
SHA512

049bc92241b670022029e77fe83cb384b2a6e1293aeef28915daacb5be2359c32b2a5c7dd7b6899ca9e572c45b0b4b2fdd0ee2502e6405d9aab4448e4f0ac42b
SSDEEP

384:Sye6CfiAW3Z6k0JebeYetede5eRezhedjRdYSctShqGq0snsx:SoCKPxDYBnsx

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421983788"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000b4ae2d32096383bb2a99cd4ba79d5db09adf0329338818c22b675bd569c31478000000000e8000000002000020000000ae1df6f65dc0bec061a513636a77510cdeff63390811a05330fed9c2dc5d616720000000d0d7e3039d1845a720bf8f6e27e23fcb6d57e240a6d290a155e3ac6ef117e47c400000004042aaed7cdf3fcffb11b6f734c2a1d55184459f687263cd466b9ee549528fa94f74797cbac17ba615c11cd8578a879e54fe57bb0f19260aa1c042fa3fce5538	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 405849212ea7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4CB3E041-1321-11EF-AF3D-DA219DA76A91} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000008b3c85e6bbce42ae6dce4c4439e7b91ebdb42629c5fc3dff1889c2c1977424cf000000000e8000000002000020000000110b717f1f7f8fb81996c630b6a24b93959a15c0324187af1970410470195a1d90000000663b63359c44c703d2517acf5ebe4a096438658f7ebd1e16265e1402f465ec293f32e96ff0ba50c7f978917a23424a167d703c9a2ae4af5bfc0823f8dd7d1818c584b076c8e8aaaaeb7e39814d63db566deb128de7a2e4fd3d59d38df33b53cb7950e5bafdcd73a25b31d876abaa92f729cc48f7d163830b48a6afd62a44b74a5940bf4e14b24b09a565f047ee4b943540000000b799b61cd1501cc467fa33daab12369662619d149c9cd25209763fe3ae8e704d60b97c2e10fd4a519f96eac9fdb22382a957b5a321994fd7ef795c1ef217b381	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1684	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1684	iexplore.exe
1684	iexplore.exe
2600	IEXPLORE.EXE
2600	IEXPLORE.EXE
2600	IEXPLORE.EXE
2600	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 2600	1684	iexplore.exe	28
PID 1684 wrote to memory of 2600	1684	iexplore.exe	28
PID 1684 wrote to memory of 2600	1684	iexplore.exe	28
PID 1684 wrote to memory of 2600	1684	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\48e43eefb3647ea5e40dd9e21f472673_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1684 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0583587a4513d9b4fd17cdb30e26cfef

SHA1
b4a2c1d05cda327b273b442e013851283e710a5a

SHA256
52eb045b28fafb89d19aa5710dede2f3b6e19c94b28c770b56aa01bf906f21b3

SHA512
e9f4bb43ccb696805d92326ebbb48b7b9120f0b5a495ae6cedae8552d45d2b7c83fc101b3285462ad9e3254fe378214850b1ddf806a9b6212bcfe749a1fe9810

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fab1e8a70fb64c6c679ce4246baf9cdd

SHA1
d30c43bf889937b1fc9a6d8219f97c6c77d7c3d2

SHA256
90c99d9bfc21bec8ce954af3d8729649a3bb76fc51f1b0c9ce77b9abe217e4e9

SHA512
6f4de940b19d85e2564181fa048303e527a26a499c0ed2e273b6ed1c4f6ae35cfc09c9993375b1b0749938926c7d76e44dabce368f2dc5bf2ffd41f9a69ea622

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7cd9c9f8c55b9fa830b51fba7a141507

SHA1
13e78e4ccfaef92f9780b74c01d62534ab2ce264

SHA256
f2eadfa3f30dc3bd637c7e1fda7975303e946bf5094d257edcc46eb1b882cc05

SHA512
be08687c2408d7b85782d06ab9e1149472e8b47b5f2ce429ccc9d8ae0ad9f8f2051210b5873200e8adc18aafce43ec4e8b9d1786a2fc00de864dfb9233fafdd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
830283e14d76583a9dd9b74c54089b0d

SHA1
fa321d3c950005b7d561d556be53028f34914b65

SHA256
64ed41c34914daf053ee5976e1fa3e93056ae0b0035c27b39144bb47eef3c4dc

SHA512
f55999e785d4656a5749bfaad05f1b02d31a40bf003af569192b33d8a91f9fda9e04a29ddbb8d419eefef4789f413050ed26514482a80df2642d98e8497524df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8251cd24be6712b5291f67283cb7050a

SHA1
724ad9b6fe6bca7ade62c7eec7a58a3e907e4b88

SHA256
61fb7913de8066cd67bdb1bb95e2afb881c357c553bc732a785cfaf950829310

SHA512
91bd074a470a049773f8910cc3c093f6cb41338bc81e90ec9101b004bb867f902b28d8b15d237627c685bdaeb9d23f998f0c63046f629db3e82e69a6d2647082

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
99e92671cbc6feeceff18ff843ce8d12

SHA1
277c36597e43b1d3e9244bd325b78de826bd161e

SHA256
f08a683bea840d99e1759eb3715a7e8d9b532d0448469553e6f4402c12427c08

SHA512
ca536588539cdc58df96a4067126813adadfbe5ad0825a2a66a1136a3c8637c25ea1fed80dd3fd9e45549e5f861885765982998016605d6c30f3a4a78f3426ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d8cca21401d969aed90e67aa2c01a66

SHA1
25c26c71d6ce6b24ef4d9778ed51b47a3447d78a

SHA256
79914b796d61cea629279f94d5e523a09497fdbc0756894ad8b8b71a0ef53f3b

SHA512
afd083ad0995f069527f2f94cb5b294f33812e26f1d9ca7b35bd4ad54e7a9be39b8526efb4d1d75d3d413a4d56a552ff568f025662f684711679443f94fbc8ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
10241cbfcfed2b78bc68794b6afe33f2

SHA1
97f42f6bddcc7a37df9b7d6906858ab391317ac6

SHA256
bd3016d79ca1b954c79b5d29c24ac70088b48512abd4d7f3dc9398722252a76a

SHA512
4e2c467f61c5cbf345811d31704e7f98423a007276a04c6d9d4105181c7fd9e4cf6f78d7f52aa7a94da1c52630a8a3bbc032fbaefd6212ad4872ce9228b4142c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
065bbb1c4abdf10391731c2dd28fa03b

SHA1
ab62c8e79bce29c31c8439e14c0175ffeec92cbf

SHA256
d2292ef22dd2b7eefae58a90338d77b089e839309de88e248ec981023a18185b

SHA512
69c3bbe2146c49efc0af20abf1b520c819ad94fb78d44428b02aa87854fa9b76b39eb815f5a44f96295877549e0ebf9be1311ae87d1f506d6442a13a27f4e081

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fae945bafbdd870a65afe4fe6eb21d29

SHA1
597a6c8e8159ecc3b06809d0c80e5bf8b9736ec8

SHA256
72155c7e0c4a7befd8ae4c3d299039c0f754295fc90dffb599c11e5455e3e264

SHA512
66d4661fddd2eb3e5f938526b9553437b99aa17122ef663e9aa815bc0f2441f940572d55e5c502ba47bbcab1ebc64d298895f79d9e0f4c687eafa117ce084b89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d33e658bdd134c3cf0af83b40a861832

SHA1
b93e05485de9acd3fddc05d6bdd1b7bd82555908

SHA256
fdf5008cc5d8df2fb6e751501a10f62d9b331b88ea99b5605df6fc9d440884da

SHA512
5aed31bb246d83eb68fa04abdc6d6111b454f2590d639f900b15518eea9b039920fa35cd8a5179b80bdb42718b2fabc8d3a9f5797e99f1b343e37d3e5031fb6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3FBF.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4012.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit