8699fd2b5eaf787478b271fb2c89b475f81399eac44296526fa8320af4e49936

Analysis

max time kernel
139s
max time network
140s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 06:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

49d46256b47ad20c68757360216f405b_JaffaCakes118.html
Size

2KB
MD5

49d46256b47ad20c68757360216f405b
SHA1

59ac1937f5f0fb9497e544ccc6bcd3a503e5d0e9
SHA256

8699fd2b5eaf787478b271fb2c89b475f81399eac44296526fa8320af4e49936
SHA512

966feae17aa3244af2e7f2640a19bb1572bed55e60d3cd3537e0929022ca2c2d04a9778d9487987f1fb4baf02f4c092b2c01087971b30787450cc017a2cf11f5

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422003325"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C90BEED1-134E-11EF-B2C4-6A55B5C6A64E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1952	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1952	iexplore.exe
1952	iexplore.exe
2836	IEXPLORE.EXE
2836	IEXPLORE.EXE
2836	IEXPLORE.EXE
2836	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 2836	1952	iexplore.exe	28
PID 1952 wrote to memory of 2836	1952	iexplore.exe	28
PID 1952 wrote to memory of 2836	1952	iexplore.exe	28
PID 1952 wrote to memory of 2836	1952	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\49d46256b47ad20c68757360216f405b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1952 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e9de32038082a6509d6d4ac8d8ce07d

SHA1
40dd984cf1e64d487c1adabc051d69c1b08afc28

SHA256
58fd87259f37a13963f20174dfd0ace68134c53cf0f19f64399571d5247a5060

SHA512
52c435b13463cbdd51c7522c04d3170798d46628b9fa502870d6ccb1a31a9f8b3855ada11b464d41cc8108e996a81ef11cd6f7dd3a2dce2e313d481fa36532ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71f143d6d155d8e78672712dd9d03d12

SHA1
b11364357b6fc3ee9f6277a14b1b4312157c2141

SHA256
3dee59dbf67e7e498d98958a4ef75290405e9dead427c6f4ad8f8b8a26589d96

SHA512
25af9457bcd16d2f2451a6b6709ea54cb2ebd890d61e15b03e4c3bfdea0c92d3dd0b972ced58e7e8f738d49663d4eff68b197f0527b81c2e005b03001cb7a4a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e60fc3408fd0a7451366c0a75b46b49

SHA1
e4582a9186498ea7ba94aef7b5d4ca8c16f761eb

SHA256
24949ccbacd4377577852e43f9ee5d047876f23d37fa12c5b8bd584e5da7c9b5

SHA512
41f7fc2f34691d779b09914f45849de1b9cf34174acedcfc6357d5320d3c51344fa361584f0a5c3d984fde67bab798f35c0a67568c896be880600b81cb092be5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d8ab98fdc0a0e2652c6077cbe9ba2d83

SHA1
7f9783cc1c5173135d652bba474eb4c22eef3170

SHA256
2aa090fa12f4b165a31fd97260e52785fe561dd4772eb08e2334cc3163c1e773

SHA512
8902cdd8b833023ac7a0b4627fd35d8c747fb323c4bac279f22972bc8767c9146f834a273e5ae284e16c00ff2794e606bbc508733a8471eb4f94fbdd3c799f09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf1e71c64ab9e41d61b6a9cbb7fc20fd

SHA1
e7e92d2e22c70c9119cefcff5f7b16aaa00adfe8

SHA256
73e9d474ba5848494d78a5d06b4b2c5a44a04a100b2edec609fc7014528c14f4

SHA512
c38244ae9e71fc545bdef62bdaa8d3d078d7e0640c197719b002c5557eea30aa6b9c56a7df248c64bae8e4a63de6723a56be36a2439899651e9d8e5d6ea460d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a01892772eb1fee91f56b6c8006898f8

SHA1
7e5ac106ca0eaccc6bdabd6a1f3ae8cc7b97e18c

SHA256
4d974b0a9e1c07824da76833d25f1f3fdf347e3094bc7b34558e30c4f356fd74

SHA512
a6f17a28bc49d8086648d12ff17214190538d81a8b31adabb86cf4b060614c070f778dda3267c127ef1445e11b59668910cf7afe4e94ce344e4ba0603b4a96a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6fdbb8b83aef71466d3c73d085f29a7

SHA1
86cc956afb43b65d87c11d5c51fb3163a3570b81

SHA256
41b54d5917624e8d94292b7773ba74e09c5d0d7da28b9855d72e906259002427

SHA512
63217f0baa63d53324072d8265bc4d2c7d513d6c4643b7ae002bbd1635b9efb9e1f003e202f50528aeb54302fd859cac98fee77e480159260179d393087e772f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76e07d49984f55a12d4148d26e2e9052

SHA1
3c5a8a5045b95c087af5526e55396e319bfb87cd

SHA256
649e46b24b7160eb3452b6b5f649d6171f1314f4a7d9098cea48b6b476ff58fe

SHA512
9c76893a9579ff61b828f8c65c6502da190b3e2238d4354637f5208d434f6cda28442b2ebeb3654907c128ce8fbb7fb1e64b17550fbd09346c7f621faa183027

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2a43d55a73cc05c86c682593b17b3df

SHA1
39d007bf90763693a954e3834986318c23a47e00

SHA256
c88f57abd0816d21a97ff5dc7a4b24289b7ff040a3719f86f9325c1392863d66

SHA512
dc7255404be2b610a3f69213e75998fcf9a274b37cfabe2de50ff51033a806a60ecc040f15ec8ed21a6369553fbe4d85e0091630c4762c0c11c383956f924584

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2898.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar295B.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit