48c13354cdf400efda6cbe22d4fc24c6a8e2fc1a04a4d4e188e40111ceb5717f

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
17/05/2024, 10:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4f827281e5dd1444b924101936e161d2_JaffaCakes118.html
Size

461KB
MD5

4f827281e5dd1444b924101936e161d2
SHA1

c9c53498e0b0ba904caf5720fa3acdf36895de1a
SHA256

48c13354cdf400efda6cbe22d4fc24c6a8e2fc1a04a4d4e188e40111ceb5717f
SHA512

c1db785fd77cb235d5c1121425a27b7d6b4d4ee00d461c8bce8d8d82000770b02eae6718bde988428799f21015bc4153b75f82d3e3b978457f854a806066ac5d
SSDEEP

6144:SFsMYod+X3oI+YZsMYod+X3oI+Y1sMYod+X3oI+YLsMYod+X3oI+YQ:E5d+X3n5d+X3P5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000c6a8fb164022bb5f3c5b0e6d92ba07cc270e06d73e7b0bc09d197731257fade3000000000e800000000200002000000052c7cda5312efa685002102e6531de3972ffebc0febcfd1ed403bce0ddeba1809000000038d25e86353830b5d6dff55b46e73d4f64978e53f04def7517df5e5707f5f58af3d0f9d86746e7c1d1a3d372b762cfef0fc49112fda2763962581b1eed7fb8adb212c16f2ddb231018b9474d53e77b67c547914936517506779f8713d8b629e65d0115ff23bdc229a43bc769587e7554f8142442ad14da15066f96a362dbfd4400248c7bba400c3be85fe2ae63fe15124000000068fff3610e77e49ec7da3a422e00e32c272c06ec0b978ecb56abb87a399d45561aadbd690e1ac03047f38eee564fd68f066ac10d07e3060d200909dc8cb458c0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ABB9AAA1-1436-11EF-A585-5A451966104F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422102919"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10e5598443a8da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000003e99c77b3855eded6e383c4e9cbadaa54feca81031e4c2e6cff0fa5831f32b3c000000000e8000000002000020000000ba1228393deb58f42681e29fcb24dec2bc865d7697f530d3529a10d74b8523e020000000341b59f0d1f3d694c1db48f9830bd2850db0f9a8f4e915eb78b5c441eba41e10400000005a9ac37d2ba85538f17f92b46282de0fb8dbe4b43ce837ce13c7858891c9115ecc6251f2261e3b300c863a0cde7e34b535e5af5986880ea05de505789644fbae	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2296	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2296	iexplore.exe
2296	iexplore.exe
2568	IEXPLORE.EXE
2568	IEXPLORE.EXE
2568	IEXPLORE.EXE
2568	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 2568	2296	iexplore.exe	28
PID 2296 wrote to memory of 2568	2296	iexplore.exe	28
PID 2296 wrote to memory of 2568	2296	iexplore.exe	28
PID 2296 wrote to memory of 2568	2296	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4f827281e5dd1444b924101936e161d2_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2296 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47245f9912a52ab4f4bf81d076591c92

SHA1
fcb031079dfe7ef850255ce0e792fe60421e0cb9

SHA256
06f8a86c7c5a1d3c9aec921c726d1dbde09679d5a4215e71f1f7e6d7f7fa990b

SHA512
e537b7b1a5c903db056d04fd85677c09828cbebe67ab35660741f614b4931d191be7c4da3187f50c6cd7bf1261f3520b639c4814615c0361220964a05172b6b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f695c5870f7d030d4326a2de45037b6d

SHA1
2ebe585c2d7474231a2ed467206fec9459a368fa

SHA256
2bd538d1e0bda147106ac8a73af41759a50b3d3e70a05fe70d63e7773c8bfc5c

SHA512
9d122de817932d28d331f9a45f5ef6e87b3f15e6a4697ba8a5411035e9ce873dd914d9857d40356bf9a2b8771493822626aca2e74bd3cb0a2e619f02b5b7da44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ca65fba6e23a119f32e42c0e6d78a52

SHA1
bdbf2e0c672e551edbe16d9c25e1cb1284dc0b09

SHA256
f239e4d031352b8d5399cc48e7d41a2393fa934febe3227a48f294db3e4856b5

SHA512
e1576da7186c0415c3640ff141b82476be3142e07938b1efa48753d13861a7efbde59485a4adac4e9c264c5e47e4cc98598a2e27b5c4a494bd10e357cfcd9447

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6757c5e5071b98d40e22d13a1256c369

SHA1
3c1c476a68bf2d7491555c7f92b659e0f1de754e

SHA256
140ccdce59bf4a0e40b265229c4dc1d4b485f0123bebb72d0c02d796c3d37cd4

SHA512
5f34bd0f443cbd3169f902681d0e64a1de41e1165f682cb6b6234dcef40a044c792939c297238f3e606db567aed8fdd3fd7cac17c5af99c4123832c016057ad3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0997ca80bd665a6da5d007d8da514ad9

SHA1
2fcab24cb8922d87befb76b3595c80a64cf9db90

SHA256
a131094546621cf6bbe31c8bef5422ac8f63740edb32b1393674ad5bbb0bd674

SHA512
ed7dc96a1e45f2687d4ff1889f6b4b2f9978b34e749659b71d16b4d4d6aff88fb6f2ba33f85661a33f3ae477364d0a0f8c68825cb8003d5d2b8c76f2a2ad0b1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
31e559659c16eedfb18041eb48f0ee76

SHA1
7b70dc7154f0d017c6605d1d17218d3fff136836

SHA256
656526b99a41a7ee5a9514c52fc17792efd7a207b1ca06af3c67da8f93316fb3

SHA512
e00ff513679a2a7656633adfffc7ccefa7241d52e63a89d4d236b43bfb267988c2423b53fb28979aaba7bf3434c87fe4b9ec8468893ddb3e159eaf8919636647

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
92abc8b2794867f5f6f46e6ac6a6360e

SHA1
6e11d2cbb1de59039282d8e3582678763e430037

SHA256
4a9e06330392d15c11978b0322a23a5be1c2f867b23a59867425799e5ef210b7

SHA512
d79ea692a6505805315ed434d31415f48b0332a152a09321dc51ed3046cccaf6dc8f4cda478347b0440e555281a67a3c2b89769a694359a394fa3b94af78e899

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d165f5f3bac866b918a0359b2718cc0

SHA1
bc04608d71ac398f9239291dac6cb829b2d7f18b

SHA256
949c922e7f0b628cf2d8b4995253c1ffc46f87cbd7801a177ece124c6ea66206

SHA512
a4aac6611cec2cd800692497229e6de29ab5d7cc62ca56162f575ca780295cc027404adf12a8f6a11102004eb6dd90f59771694b97852a57ea6473aaec9b8d63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d076ca14bbb562acf10a7b7aa790d8a3

SHA1
be5dc9da190a45b16155032242c382c75e89fe30

SHA256
b08fa4af1a18ab1748c3e94f0b0e55251e02e836a03e5d9ae9beade2007304dc

SHA512
a2ba098d85ce3c2118527f21c09aa871355f8e7d7039daba0f17b953f018fd7db87e2dce97ae1c112f22fd4cd6889b3849756cf58d9723b35c12244acabfddce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50fa16adb99eaa53801def4363a2cc42

SHA1
e4f20354a808d4f49c3d7e2e7c08644cdbaf19d0

SHA256
745350656028d5d9bb4d25026f7710a4e6b9b4cae5a158cf54052d2107178ad8

SHA512
19f0af0aab373cca795de81e7eb5836b1af82211d8e344c60ae5dfff72b1f7d26a6fc95ed292ba27fe0f646b6179f810afb428a7ac21016f46915e582c6339b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
65c425473630cbee6b322c2d75b51436

SHA1
6988107d468f73ab2fcb9c5050303d1cc3e2115f

SHA256
b172dd9e681ca5428b03190c433f15a7391dac4840b51494f331e91dd613018f

SHA512
10cc5478cb9e3e318a1bb30e52ddceb30d67a28510d6987a4f25148133e16fdf1d1e723dd7e8e58f901e193d67d8c6883c78145c1f6e6d801fc757ae09cbf893

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab427F.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4EB2.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit