00c9995cf405877ef17a8850e9f612d4f13e5c9c55dbf6093830931b709b5600

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 06:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

49c0b719a555260f79863f125387f8b9_JaffaCakes118.html
Size

132KB
MD5

49c0b719a555260f79863f125387f8b9
SHA1

354d431f43f60f3f102a0b11502af6ec8e111b51
SHA256

00c9995cf405877ef17a8850e9f612d4f13e5c9c55dbf6093830931b709b5600
SHA512

799689b0cf5121bd308d9b35a751c1dfdda3427465479f14f2b6e1a1e5971b2832ba62bd99bc32aa59b8416d159937abf8da4a7b5d4284517dd60e9c3933980f
SSDEEP

1536:ziZydlEbbA99YZHqRHHEExx66++IIddtt77bbSSSSccllbbFFDD998811qquuHH8:zxdlEbbA99YhV

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422001956"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9914C971-134B-11EF-8221-D669B05BD432} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3048	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3048	iexplore.exe
3048	iexplore.exe
2884	IEXPLORE.EXE
2884	IEXPLORE.EXE
2884	IEXPLORE.EXE
2884	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2884	3048	iexplore.exe	28
PID 3048 wrote to memory of 2884	3048	iexplore.exe	28
PID 3048 wrote to memory of 2884	3048	iexplore.exe	28
PID 3048 wrote to memory of 2884	3048	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\49c0b719a555260f79863f125387f8b9_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3048 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
4d77e921170085aab4a304ea8978a21e

SHA1
2ca16fe49fcdfe590a7b1137956f609913034e6c

SHA256
8c486a3ccc58b1b0df119fab94c33978233f50b603a85fdd296a2905a0d0b841

SHA512
ac9e12ade7105befcf2837fe1d80ae321b7666ae07c6b1bc7bf00ec915960976f9c9519c2da30a7694657f133dce6f3edb15aba12dab51d723b8f3c9e5149db4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c1d209f2cccde5ff9e4091be5afbc57d

SHA1
b460b0f9de578a4d02bf88c7af3a33e3c26e62a4

SHA256
119344443d3b178b2a6193238653dfce87d6aa2b6017117e115f83d5e6cc4374

SHA512
f7176f2ccd525cab6adf7490870c1bb8be03d32d77b5cab0619e2469c669d7ad140e936e82e2e36fdc7a01833528d3f9fe7a6c1a356aff4c4def70ec2b648aa0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd8c1a704ced62955304727da866c52b

SHA1
1edf15cc4e54238d2c04dd9780e77796785c98c0

SHA256
b6c296cc199fe1dd3c0c773b7e8e52c0da6cc0c0a9f17a565777c4b28dfef513

SHA512
4f4d9726facb859c0de9dcbe95a8f28c2a773c216238ef790f9878efb9776f9e49211dd722c4ff85950b34fbeed4cdab780c71844c81d6b2f4d8c9165f16960d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9523b99baa77306172f28bff8150086b

SHA1
0fb6c3a704e480e25d1c5b5b258a3cfed8d0e1dd

SHA256
b1ad58b50e030cbef47a9402bc8e155f4d930ebe1284aaccf92192b0dd0b7788

SHA512
0ccd5223a477c3f9ea2f70d3bbc96944d08458e3bdae8672d5ff5f6b7cf536d327132223f92927cb08ae02f51288bfd911b07d1a5aca5037cfee797cea803735

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb5197797ae95b4b34e4368d72220747

SHA1
51bafdcdf1a36d8d1b901a296dcb8c6999fc4f65

SHA256
d813c5c4af2e207e1eecdb4ba87a196837b8121b4b1f4bac9f0e3423107e96e0

SHA512
d8b681a85bbf122e5b9bb21684725f06f8937c9c7a7afbbac7a1d61da445d5a50a44054a3b5f6e7ba0ece33ece3deae300a12b2b4306b840aae34142ae3846e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c128902e56a6f6bc0bc02b1b0ee36d7c

SHA1
6dafafe1724e4da9242a8746fb102c9da3432f6b

SHA256
9480ee4adc66e46b917a57b63cdb485e824eb19f8fc71ef24af74caa4477fdcb

SHA512
7e50af579d39c9bb4b426aa0285c4ee9053ced40517c4593c65f23f0bf9fe10543b3e0b80399f747bc00673a8ec312126245c90a26634fcff9b23873ee5a89a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9bdbb93b1f05e13326284e1e118d49b

SHA1
c5d4ccb4c90fc7f1caa8d5761b6600f6354b0b08

SHA256
e3fa88582a4a0ddc18d0e86b581a414116a1fe0a9447ef47de4da3f747ffa073

SHA512
8ea04ea57aac79de6349168c80295f44e040f9d082560666da973b918950391fc0a9d8dd2ad85e55ddc83b092e9d9aeac28f2e2071a92d5486f6b3eedf575857

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e013465617177d87793e4891ff4f022

SHA1
23e0aed0ea5c6dcabaa1e0f81072327330628e2c

SHA256
5311da06fb258cdd55be7c737948c5e67f0bdeea5a5f1a3ce7ce87e48aae789b

SHA512
df0c87bb4fa07875716332954db4727cf5655f26a015fafac7aed6d830063841cd76f225c54b848a5d8ab243be32f0902b8914becd0cd17a9702fb55de0f6321

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
360692c3720e6c34549b9ec936c843ad

SHA1
bcc55250b9dceff60070d1ce1409c227e227bcee

SHA256
f45e28a76af4b823428ebe22e0be8b4fdb1d02785a648d714eeca9bdac7d0b32

SHA512
fd6ddbdd6167047249e087dc3ce3bcbb27b97e7ebb309819ec0213e4ed812dc719af1afd966642a82090dd37255380a2994fd800afc444fd28fc2971002f502e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
45a8d964dfc9b3898bd4fc4fa4d7ebd2

SHA1
7b2820c8cdf257e01bd7f1fd94655bc4acfd7b2e

SHA256
81b3ebd2cb1041e05ed212ddd102a81a09d58cabc73ccb81ecb84b7990c76de4

SHA512
28816f633c3594bd5328ed7da59f8ec9be0c3aa6bea46e2886d402bb7608ca8d5cfe79de9ec5a2a844982ad30fe54d46a0d0befd3f8a5bb73d3846b24e3d87dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
f292f7b0952f67929e69227c284a0834

SHA1
327972e56d644edff4eaf4e4c60ffecbab16efb7

SHA256
8c705a9df78ab7b7f89d37ed65c17e1d8ad170a389c18ab14b5ed32c29cd1c31

SHA512
9d8c54c362e73623fc5addcc9886602bbc944003c8e99c4f1ff7e77a020eaba684c7bc01fee5d4b99c04a92570bceaeb9e02a5821a8758860fc95961b46a575c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1B33.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit