a958453abccd6b027d75bb87cb8b79ccec0717d015e2d3f84cbe79f3d76934ca

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
16-05-2024 03:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

49381babbbbf4528aa8115dd20a41cc0_JaffaCakes118.html
Size

461KB
MD5

49381babbbbf4528aa8115dd20a41cc0
SHA1

a077a2562eb5e71a56d1b64d967ec1a217f87bc9
SHA256

a958453abccd6b027d75bb87cb8b79ccec0717d015e2d3f84cbe79f3d76934ca
SHA512

e00cb5970ad1c9c6f0885eae3f2f225511b41727d22c90718f761d3ed4e1b95344456d506ec276d4bcd6c0bda0bdd40c03f2679e480694ef9556080e1a98e254
SSDEEP

6144:SgsMYod+X3oI+YqsMYod+X3oI+YBsMYod+X3oI+YLsMYod+X3oI+YQ:p5d+X3a5d+X3n5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000668da67208572766ac869a9435be2208431c026ed429a64c65c32cb1a6d820e5000000000e8000000002000020000000e0e005ceee69c976e8a42d0578745cbbfbc72bfdff1c8e0a42272ed7ddd6083890000000a1e45ea7d139a43b4b6e4d5989d95ad806dcc1ddc0dbe7865dd76bb5dcf5d2afa1579d6b9a656ac52cbdb09bfdefb8a9a7efdfdeed53be06c862d288a1ca62896c9303c2c3d11622ca08254faef5d7c967a5210082f92f2507064c24fba481af7e82edca880e69e22343cd8ab3c52ce46e0b95e2fe03883e1fdc475bc8b25e066663776ab34060b82fc2d5a97af64111400000000537e3f0d11455daa4d6537539f64438a097a106ceb9c2a433ef10a7aaa0f0cb29cef17d79782ede33684364142529ed01a9738fe50c746db96288cb4e246c38	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421990889"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000070743699935c6b4b7b24d65d36a7cb9ea3b108bc3ba2148239c19b46df558d8000000000e800000000200002000000049e4c38cac78d1b7d982b099f41cefc485d4d35b96c25d06500c2e9e57b32c2e20000000279712bf08ff9e3852e1ba4b4fc19651f10d8dca15aefe5dcb799ca1fbc4651a4000000083166faf2e1261e41f115534ad7db20ceae1062eb3366965b366c6738f114337d7ce9bb4d76d268a56733891d2bd12d2e21591471fab60279116a81271142de8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D53709F1-1331-11EF-8A04-E6AC171B5DA5} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3053c1ad3ea7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2360	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2360	iexplore.exe
2360	iexplore.exe
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2736	2360	iexplore.exe	28
PID 2360 wrote to memory of 2736	2360	iexplore.exe	28
PID 2360 wrote to memory of 2736	2360	iexplore.exe	28
PID 2360 wrote to memory of 2736	2360	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\49381babbbbf4528aa8115dd20a41cc0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2360 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
019f8876dfdca9a174727236329b1fc5

SHA1
0ab60aa7731b69d779fa60e8065338a5fd73be16

SHA256
872d6ea13a4df6bfb10405628117cb873f6bbbf6ff2988618590bbffa91f007a

SHA512
240336f3f0be0d4213568574315626f9932971e980e9aa4e2353fffb4198ebeccc795ebe83d1a4583aab610c280e7a0f55f58f2c728136b41b9a9253769e14e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b967e22600a83547a2f6717fe1d4118

SHA1
5d74b7d847c425b2d1ddb837622cc48531ef7d34

SHA256
d3ebe8456c76242db6492b7900acc628ce52b89a607fbff9b4f7ef7d25df096e

SHA512
f930b295b332b36a5c2f9c563b29043889bb10b151698161de0cbacd07ab48b4e17135a1401a30f11c418d778d01e25a63dd5c340e68cd1534fac48a4cd6c125

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e74076393d50fa7142cc7ddba9e18c3

SHA1
3aa4d799aa80363d8a3fbbf007d924234646062c

SHA256
385880737c239b1ae6868198b6292b124c2262ddb896cb62412bea5596902fe0

SHA512
7e8006d3f1edea96c5f5cc2c2fb4ae4e7f3dc2c604a9698f646192d4a2b67d1248310bf73dcadd1c2271fd6a63a056c7ecfc6fb86eb74f1ffe52930ea3ecc2fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
31e14663f0eb355e0701b023993e596e

SHA1
cf7b358d3acfc3ef2c4d370a7ccfe3d7f835817b

SHA256
8242fb2e157881741513c63c4220d6c2d310fdcb250c9f7f182d3aa342266539

SHA512
3625d46d0af55b9e618e6524c09455da2599ae116f72a39544bc82dbdf13152e39f2a565deef542276567ce828dcc62097407176173868df910a88a1404b7222

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad9457aae6359e2ab684d6cce1c6babf

SHA1
3554500c5a2428ea5680ca27bb285f2192e7c0b0

SHA256
1935a2cc7f5f77ca121db338216a0ce70bc3b967a1a724ddf0f4458d13393a50

SHA512
8a1c324e3ff017b784bdd7bb898d8062f5196b3f25c5a15a1182977ff5896c1f0e0f4856a874ca2bc24ccadb0024bf4c13e9e9a04a3a4a1e6a1f28e4381fc342

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a06f38f98de70a255b568c06416866a3

SHA1
3c0bd98e872bbe7122fad449e7afcced94790c07

SHA256
5a025df6169a560d473040835ea49bb03b6c048e9e7483b5a63432d4aeb59cc5

SHA512
9829fcf3c79f9a92a4ea5ce10e10ff2d433dfd722468f82741a732fb41a4e0cbc50c8109782f0c10005088633659bcc31e3716e3b178384ba019388be9fb0ae3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
48f439af7edec01901187cc0e3a7b148

SHA1
69358b17cfb5b3d474320c23ec7c1399c606cb4c

SHA256
ce33648ca33a4e09bd57532b2ec45cc4e2a5824aa97ce92dd919954705154faf

SHA512
73dee264cdc19b3fdd2b222c663d3ae648204389e566093997f8626bd8df0246af73e1b208edb354b58fca94c84d50ea8cc4b1182f36c0d05f58fd312d671aab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
10f4bdd1ea1698c1e4c45943f11053fe

SHA1
62a8fb462f2ad8bb89362d074ced6385d6418e9a

SHA256
01961c7d527028d9288ef2869705512e2ee21f451836dfe9cc71a43b25f98806

SHA512
3c6537a58f0ba9f374b7ca39477b2f17906459f99ee42437beb98ea17224187a3a2bfe734a7baf1b5ed1ffd965cbad3ccda019847b9364314eda2c4649c3a109

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f85c46bfc1eae846e6b553b6b5283e41

SHA1
b79aa504fef81ef34c69033850806f3a3c8c217e

SHA256
626b11288ba1cccf2715d900a394b68d6264e6891cc83c7b2743d58b9b7eb7e0

SHA512
7bf1335704a47a09846559c48a4b1c4b392f9b9d3e03ea6171bff465e2304b55c799638caf050127afa440868890e56653d85482b6a96a6080facc66753ef687

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
650a8272bf3282899c7eaef4c7a410bc

SHA1
5f5121abf073e26e5228a835361f19baa61b117b

SHA256
64234e25117464f236372df2a094c2dc06f26a1a2f375690fb89b3541eda0fbd

SHA512
f9a2a94a066b5649a3c055b2c4fbe44b5cf89a1a0204c2fb8711838612107d4fa583e1aed8a31eae5f5e336f582d4a88112ddcf82f7b7e8b8c67c94e6e76bcc0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3BDA.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4110.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit