a514a05ab2f2a0356582b7bd3053d44b763970c0177423825a160b00664f1ef6

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 06:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

49e91708f46c2af2edcdc665f204f5c9_JaffaCakes118.html
Size

185KB
MD5

49e91708f46c2af2edcdc665f204f5c9
SHA1

13a6ccf78203b6e684f47bed44c6a89a895a47c6
SHA256

a514a05ab2f2a0356582b7bd3053d44b763970c0177423825a160b00664f1ef6
SHA512

ce89d0a1529198c286a6807e0620c28cf310d3ad02b7be7d40b3fe586b4a00ce208b8e4ecadb78f38ae0ca2c9f126e1f5e4088d5d18d53a9f8b23404ffbbf291
SSDEEP

3072:SayfkMY+BES09JXAnyrZalI+Y5N86QwUdedbFilfO5YFiM:S/sMYod+X3oI+Yn86/U9jFiM

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc2330000000002000000000010660000000100002000000049166c71db36c0239f37f49de8f43f514529d317ec02bbff1386f6a49b8843a4000000000e800000000200002000000083f7bb56d83aab38e04500bbe3056506de78b6c5769b11607dc8770d0669e12190000000c55451975949818784a5ac9a9f92cb314238ff7311c3eec848ec1348861cde4799f29d23d7bd582718d3a4fff1e19083e9e936d2f61a2477da0fb6bb45e6bc938f9cecc1e221e8cc78eb1e1f79462fc798f17aead3dc27790ab2c4a29391f95d25ae3e9323c2ae4ac7f30af9e225396d895919823962484291ddb3992dac162b33244d0e9a4d9f3e7c7a8ddfb3de781f400000006c573fe80cc24f47d0de4ae67b8f7977417fa70a433df5083270684aceae96cb4a73cce9a7f15b413e23a7507ccf44fe11b02f13b17abb90a3d83d22983011dc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc2330000000002000000000010660000000100002000000012cf75edcf262f67e8f4739e86d0a6c4bb7868d8c5bf57a1f84d5cf17b90c559000000000e800000000200002000000083dd11704f6494bcf91c29fc6ed1411d71371787b7d8db3899a39eb1b0898aa62000000003fb21afbef1509f2b5b0a571c8b3b652eb8ca6f45c24ab5439b69915b59444c4000000023a2155bd2b7e94647f949a5a3c5ddf7e24dcb53a36f6036ef60a79b7f77c615307cca9eb19ecb279cc2070d352ad5b060bd8f3601d85f55982a5eb914a248ff	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422004658"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E4208D41-1351-11EF-A499-62A279F6AF31} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 004d90b85ea7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2000	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2000	iexplore.exe
2000	iexplore.exe
2516	IEXPLORE.EXE
2516	IEXPLORE.EXE
2516	IEXPLORE.EXE
2516	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 2516	2000	iexplore.exe	28
PID 2000 wrote to memory of 2516	2000	iexplore.exe	28
PID 2000 wrote to memory of 2516	2000	iexplore.exe	28
PID 2000 wrote to memory of 2516	2000	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\49e91708f46c2af2edcdc665f204f5c9_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2000 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b6c3e15d57f9e5bd5c8233554554f44

SHA1
fd16587f49e69e6ee9918a724fc25ef3dbd81201

SHA256
3ea74ed51ed9483e495011bbd09af95d64480d94208ca60117c275a43bf1f986

SHA512
0509060b70c4cefa78bd4fe2e1c7f615d6e95bf9479435d716f9f5e55c85b76f1ce27c9f91cc71c575087f068c03b27a6bfa280b0b5fee0fc3c5f4352d3faecc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e80098e2dcda965e0e590eea5cda14f

SHA1
3f0f48b1c09f0279dc5dc069ca664e2b0d97098f

SHA256
40c7e0c6c26645b63de04c79ef7baa5c5df65bcdff63e4c48212b763fab7cf4d

SHA512
50e7e9d6ea4a53a8d0f3ee1adb0aceb1b8daaaa977f54e66d676ba1cf358596238a767d812bd02dbcccfb5a3e7de027d154e75f74ea8f179567016dd3706db74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
31d606db354934df1f00dfd0326fd2b4

SHA1
3f7018ce09daf1e50e657fb1f6df3b14bc5da998

SHA256
2d773dfbce5bef111383c470b5832920cd84432f32cce2a2642f8d5c67499dba

SHA512
0c77bfe4b769f880a4c87e1588325cd5badb7c388957920616afbfe2416e81b2bca28d704c9ecc27d0d86f31992fc45132d53aa34feab89a45bd634f121b0e9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c33636ddbe93504ed33d1a2801ef3cf4

SHA1
113fd85c0f1c30ba7d0538a7c13222c617dbdadc

SHA256
59306e57bb9d51581f42f0f72e00acf92930697956452dc14191e8b556bb95a7

SHA512
f01127b96b578900e68e8ececa86c5e40236c1a6ed9f23e048ad2a10c06bd33022c34b65c65ac749fc82f92d6838d6798e184de7a76faddde639f4012d7c7fa7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
861a32fd000957e5d4ac2f24ae066df1

SHA1
68f197fb7d2c27fe0ff1bb40fd148eb2e03eff19

SHA256
b86c02a696e95bfc0985942bff05567bb9a997a0372240f3bf7c1c4a22f19bd0

SHA512
6972c2dd336b00325debdc7a642d74a9049f3ec1bac4a8b76d834a15aa7322e1b87ad001e87dd5d79a559b1388a9ee008d10f96a521ffbd14fd567687cffb139

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9204e1037c18c0f5092f5cee95b98a8a

SHA1
f2a2c3cfc5380eecbe836f10fe47c4a55bc980ac

SHA256
44351d16ba93f0f7b2855abda8470d80c5b42008561df3d382287b43b4f4549c

SHA512
254ea09ae7ebc22065a3c27ae4419a01c91e78502f78155a0489134a5986207bba1a27b80a83e167bcb0bd3667f1851796ef142b33cb4bb2bef1cf910b175c51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a91de665c9ed910280589749ec57aa87

SHA1
7e368369735ff023420fa2d183493b477005eef3

SHA256
5e5baa2befb6334849bdaf8c794593594ad77b33cea7e069897a5e3789fb56a2

SHA512
6e78e696dd06f40aa3dff3f22f44923d0e4784d43bf7467d4124c113296b27c1b05d9ba3f3603e200e14314a3ed84181bfd24966528712916c83cae80976a102

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be8bfa2d7a66477963098cb720d50af7

SHA1
330109a7a6f2d8b21b5893a2be5950ba156e2e15

SHA256
33472df74c6152e6908d2b81ce080a8f76a6aa939d3d41a7de79fcb6d866298e

SHA512
cb621f818bb09c6a8646d009c21777de6305bd09b3ea5b4f85b346d0133157ec9c0b752a77c6efb97175e51712eb1612e01ef66479a6141b3eb94e8cd5c247ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
62a16ad9fdfbcf46afa186cf59ef4b31

SHA1
a0454db7c07de3ca08d77a46bc960964ac3f139b

SHA256
4e43c86defd61f870e309518d320bf6a7a4ca1286077f98d8e48b8b09cbd0f80

SHA512
0173cf12df79d1baa403b60fdc7419dc35fbec209b711e64f0b77fdd795cf62db92491eb7b399ce736e98702fcec80ad2f8b8cec5b32b5faa191dff82c159eb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2899.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar29B9.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit