a3296289291808d26fb1970a7e99baaeaa9eee472d6b399017ce530fcd0bfdff

Analysis

max time kernel
134s
max time network
133s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 06:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

49d901ce3408841706da0de3c25d3800_JaffaCakes118.html
Size

312KB
MD5

49d901ce3408841706da0de3c25d3800
SHA1

39110b517a41301042f78fd6c9c9bc21499560f3
SHA256

a3296289291808d26fb1970a7e99baaeaa9eee472d6b399017ce530fcd0bfdff
SHA512

74c96a32382c87726bfab99ede365daa9fe3179d7ab1e7035a7b4494e7b8a34e40a4270065dd175b5450bb53c3f5b94aa2b2d99edd565fc18fe959f5d9512eb3
SSDEEP

3072:LcIcFFsfuPeeXeSkigWdHtPlKtE5Pdh1jV40VPNM87+PysZvcP5R2f5:dkFsfuPPXdNbh1jV40VPNM87OyKvcX2B

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7DB5FE71-134F-11EF-931A-4205ACB4EED4} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000053fccebf225ee3ed6ca994c262cc754f9da7e921268a2acaec072423e6eec72a000000000e80000000020000200000007346b92ce555cfd7c4097b94dcd89ab412479309b4100fc40432a432ad04d539200000003d38fed64b9900bc03a7e0257112416d4a36c29aa1070f998e8e528df6a90df6400000005f72785a88c33ce6f833d92ce620f4a43e7a589562ca8ecdcf97b276683bc9fc7bf1a999bbe9640cc6e2f24eab58616aa18729036d992c1b683ec2d219f8e12c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000034b820e31683448891f0db201322190911558e972ffe8bcd3efe03b6aa2993fb000000000e8000000002000020000000745165457386dd85701412628c1f8bb644c25fa077d097fba9dc1b65b2f6e7c99000000036fe8220b28e6e29eda58aa10444b54ba50e74700a30ecf8cc505fbfa4c76ec463a4a1502e2f305537004414f65bdd43bfd54e6b20ed3ffbbd0eb934eb4f328ed36261a63cf13509a47612db54431ba45a40217937039be884c2c33603a66a7a44f38a001898ebc240d047f902b521fb940be4dc656b4b64afbed4e86291cfc0100f7fd19ef135b3cfd40fc00dcc46c640000000a6bc1c5505cb031d7fa43fc45beccb7cd1734bf656df532aaebf1a24a4f29a48157d43a97f0aad685478a818cfc498ec76e76d4657c98a2c603867b858364b97	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422003629"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c09f3b525ca7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2184	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2184	iexplore.exe
2184	iexplore.exe
1836	IEXPLORE.EXE
1836	IEXPLORE.EXE
1836	IEXPLORE.EXE
1836	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 1836	2184	iexplore.exe	28
PID 2184 wrote to memory of 1836	2184	iexplore.exe	28
PID 2184 wrote to memory of 1836	2184	iexplore.exe	28
PID 2184 wrote to memory of 1836	2184	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\49d901ce3408841706da0de3c25d3800_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2184 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9dca225465abc1f95358b8749e1c8e89

SHA1
dccfd618b742e219a1bad5567296b81c3287c25d

SHA256
7b5a2b24e8db0bd314f68dc2fb9794584850962e6715563dea568efed56945ff

SHA512
e61a3d2d302422b4d8ad6b201f5520da1fe86327a0d7167a7ce6477580c19ef71f1e9d6d38f7f49994a333217787854e9767f25d1a9d02e5e13d0261c5f84fb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c17d038ab5a8826bdea85fdcdd57ba1

SHA1
a6c945790fbd8176382c6ee4ea020a4056e1a1f2

SHA256
bf53d19efa89f172389e7da4686e903c8064b5965e9ebec8d5cf3689ca484d15

SHA512
1fb0eab601373705363646db72c7c5c2bb843d50bb80d0e5449005fc2af4a0de1dff902e2a124afaf0037e1355c4f0fbcb9a5d1021b38a80714051a1572c3bf4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02b84965ab82d0c15fabdb6f2d0b0feb

SHA1
1d2ceb913fe6ff1ab7392ebd434bbc2ea18b9394

SHA256
916c8ad73cd051bed1c876f62f7383d0d9c6cb9550d01abfa62b9978d5b6113e

SHA512
79cef5c4993f8f25f09c6f15a8154a8999981fbe4d8ccd4b4b8288780419786798b2440179d9c18b1b782da32e84d1ba054f16321fd11ce8cd7fcdc2baf3c3ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d42decaa00988d699c01b89c312e49fd

SHA1
808f6669b08a4fe3048a195488156f7dc9b8bdb9

SHA256
b1ab86e35d3c91e73916deb1d997d85d358d2148d7ddc1da13f7ab0690d60900

SHA512
c78e289c407b72c1f4caed335c1825b22d6bfed0eacbb7686cb8c9f7063db189d4c456589b0f8c79299be1d151b9a80256f09f745b314250013774a15490869b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03353c5ae562e703e3a700fdf96eba54

SHA1
1cf869a3b01838b8e8b508507d26c8b3c99220e6

SHA256
692096063960517136016403ee3df589f33daae39d45408cf320d839be062955

SHA512
abd736091b9a155116662191807468367972e3a8d9266b1228a51d098ce2a32a8679954f7bd883dcf556e5759abd213924b2a0ab2efaaa8a7a81d57a0793fc8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
039e6acb1e27e3e949f35628115c1992

SHA1
d4770db270af9907af4ee758f7da3998524bd9d9

SHA256
1b3778fd1a0e122c3f6424f74bec2a16c32bbff9572930be8aa1ff7347c658d8

SHA512
a6b87b68be5337b12d21f6cc4402c4bedaf31564b68b88ab19330c7962e6a1dd52b615599dc68ca6680e3c83cb49091dc6ec451e9b80206ebda12db70c59604e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b492ccfd3717e1af5f1a2837b38e67ad

SHA1
695e30a610ff86e459af031cd8520659532a3dc7

SHA256
cd098874bd12c3eb67df445091be64e5532a2d99b48b57f6a636a7507071fe5f

SHA512
90ddf166144b3c3aa3f457e8dd9ef6e70f6ab49e67f480aaba61490d06a401dc6b6bdc751886e6f6bfb8f5d627af292e7251f168caf9f460f5c71244c3d615fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06f224bf6e280bd27a03c68e69e5141f

SHA1
1cf61df9ae425156f3cd987ccb20e2f932e2c523

SHA256
a9bbe607deee6e2f685e16beb3f40d43723a5b365425f19b90506bb919cf673d

SHA512
c454d25289c19175f03ecfc593c9359b204129c4b8c076232e54249d0dbe0720232b95d5137321ad97819c4c94fb73fc101e8f16b19d10fa0017a40f16419450

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
547548920bb9caa1f6a2f69371633afa

SHA1
c3cbc41d1a1094076ed6961fabe7fbe95e4239be

SHA256
93b85577f3b6473f507421dd3e13d9591d587df8e7199243e2326a39da8a40fb

SHA512
804a2ccf71ef12fba8a22c6f301ca24d18fd9962a1862fc1755689057f29b0e14356f1d093cce59ae1bddd5cb132e02502a3fc8878ef28e0691ae5603da37d42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77bbaf66535b7db4d8a9e144a156d912

SHA1
64c6b98075b4cf4dee17affe35953971d0419270

SHA256
372297b62d3ba8128884b677b0b66269852fc9a36efa525755914290508b54d5

SHA512
704ccc1b195ae4d92470ad0bec4befe6dcd7eaaa1a18326945df215c3d02947c6017114ce8760d36d62057c15e1ed06148be97e7495801ed9d5ea1e72803ff66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
221ac7f78c98acf6c1920f6bc75c632b

SHA1
59878f782985707fde94a0dd17ea9a1f8640b30c

SHA256
3fe3b81110f1997634dc8a326297bb9b22098e553aa7f379b5b2f7a3e785d86e

SHA512
beb17dbcadfa564c13cae72b4c46918b066a52dc45f7655475757d9c7d873772f021c754eaa6628aafcf41de7a71a5e5de8b7dbe44234df4ab3d12d7091a0a79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7631cd8f79456840043b566ac6740bd7

SHA1
9826a1bd9a8a8b081f77c8a39e23af392a578d81

SHA256
ce0bd9cdc83476e04fcf582d73e363179253c1bd840fd86b2c17bd5ae82c4c79

SHA512
0a2532c0f2f4c94d016bb72042e343b2d8b94faba857b50bfd18145582b79d6f6d592a3e4719a120b7c3c05791753d2f6c20d052e93e31f7a5e3d42b700f8c6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
11b2998110584a08874613c35dd03569

SHA1
a8a469123aaf2e9c06df093b27b727550c012718

SHA256
9b6690197b6e21f8d11956763f9890a9d7f2aefd146f17c3bb6299a9e1d36fe0

SHA512
9b7d157d8f1398c733dd4e40bb88a9bdb5bb9c2d7d0e4356d99821723050250062e37750eadc7822dd25c044bcc1487d6418823fc52823b387ba946ea7fa188a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86f54b213353edfd5b51d601e602418f

SHA1
cbdf48b01fde7ae258bd5ef5a32f1660b1434c46

SHA256
0939c918597a45605bc1e8e307167fbd8949a8ee62a3759e516c7af921b97c25

SHA512
abb2ca1655b8dab522c35c9b67e9d07ea3fbceb250be8ced99144aaa92967de76ef902a2c562628b497d2b8b7ad43a0a8a456700b6221ebd52ae7a888126ec5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f11cad761ad902e4358ab04f4088f2a3

SHA1
75a140c61b629bba470c3df76817293a58380397

SHA256
6806d603eb8d9cc9e89956285f74094902e07c89ee884679fca4f34e2070879a

SHA512
ff8675d33c0056690bbcb5cce10d8884df65c20624cecf95d627b46fbd8bed781fc9cfd30fc21ebf74db524b4dd59b48928f0f29a69ca9231e4426dedcc88132

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2d9b20ea0e09644195782b9739b995e

SHA1
938dbfa56d5abc083a4380daa2a87b702dd83d60

SHA256
13cbeaba6e72aee18222863f328f2b878cdd728f8d6b7134f90b70ed65ffb2d5

SHA512
1e861d599b08f27f3d5a28a4c18e6cd65d7f2a8ff496c529dec7b0ad6c4a84f3cec248452b7fa1dd92a04cda1ca6a7d721b18461dbc033e6b1f2930a1cdd8bf7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5ab682187874510b39eb62ce41166eb

SHA1
3a9a3b503652c1a7e4a21f1b8ea38c9851805a2e

SHA256
bcead7c921a6b0e2c27eee291584c7353098426d725a157871c60d6e228a74f8

SHA512
9329a6bd6f9c724861f821b0ba438065d5e20169e9f5ec374f1d6b20a2339b0553ac1f0a2ccddb7efcc16a3e68c6fb89cac08175480123b7b314dcb1beca2998

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab34F8.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3588.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit