48027e1578b85393bad5eda44c0065a9a5b9eca2f64574a4b3d18129cd306a17

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-05-2024 01:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7f0b2fdc6046cac037fd138253a69f44_JaffaCakes118.html
Size

23KB
MD5

7f0b2fdc6046cac037fd138253a69f44
SHA1

faf503106ef81b014899ae7d0585ade08a16db5b
SHA256

48027e1578b85393bad5eda44c0065a9a5b9eca2f64574a4b3d18129cd306a17
SHA512

f633bcf8946919192c863343ea720ddd51ced97a993aabd27d201b094a36c7e907eba5007127197b937a6aa8f7d15df3e70a84b490fb346e527063da7cea01ec
SSDEEP

192:uWL0b5n2unQjxn5Q/hnQieUNn2Q5nQOkEntPTnQTbnRnQWCnQtOwMB0qnYnQ7tnH:HQ/AQ7/GVg77

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DA0B4D21-1D58-11EF-873B-52ADCDCA366E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423107160"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3016	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3016	iexplore.exe
3016	iexplore.exe
2332	IEXPLORE.EXE
2332	IEXPLORE.EXE
2332	IEXPLORE.EXE
2332	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 2332	3016	iexplore.exe	28
PID 3016 wrote to memory of 2332	3016	iexplore.exe	28
PID 3016 wrote to memory of 2332	3016	iexplore.exe	28
PID 3016 wrote to memory of 2332	3016	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7f0b2fdc6046cac037fd138253a69f44_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3016 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb88acfb46885b0cd3b3c8b753b3385f

SHA1
0e92eab9cb7bfe4b76c1eb4f0ad2bc0e754f4824

SHA256
215d9b788734c87387955ee9f4c672575a55de999731184d3674271aeb7df449

SHA512
71cb84aa51d22019d5df2c51deccc0f8084ce523937cda1d05e0e8668ecd70f7e38fa3d288d34c6a244ae2de2f93786a6b4bd315e5aa2d62c186fc067ae14e53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
83613250af0eec2761814cb06d9da4e4

SHA1
426dfc23fe38dbf668e0112d2c0f6fe4ce472c27

SHA256
957235e122962a62becfcaa695842ec294cbf0fef26b106ac3177c077291bc78

SHA512
f16813500be74f539e86c171b164d49a547af6cc247cc358143b4b7f38b2c0447d218e2a7138d0327512412a94336fc6a3f16d01313a4a136deccbab17307979

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d4865f77a3bb8794b77f9ba71ae57334

SHA1
50db63b3502ca88cf1846138452caaa566bc6966

SHA256
613c303aa5888de466eb38fb8ed7f418fe47a003c2089474609e9ef0cedf7e06

SHA512
1f6adaf65b155b9f1d6a9bf165482c1bbab3659af75fd8fae025f4bc7d47a44b0a810e621d9255ffe35fb3622b48ac57390750ac2f9354a1ef39a9f9e9c6e73b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
affeef6702ab6cef9663822fa5351d10

SHA1
c9bb52fc8a1cf1e8a7e6ada33c1fdb97beb33887

SHA256
ea02cc73d183462058fd2c6a2018d20ea89afa1a70e692bbf75182ba92700c12

SHA512
c6040d85aa6cb4b7be5b4c0e93dd962036b2b0f6a5edcd691569b1167a015f2ccef75a9e2a5724f658732815135261198e6f2e84772b269426cd14704dd5cff5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4bcefe42f9b995c898ada58afb713987

SHA1
af125e0a9d52f416f928434ef009812ba73e6034

SHA256
6a45987cd252e59cdf27002e852762f89971723eac73abdcbeb565b96baa19b9

SHA512
625ecbdd210b50d90c3815c6a7995bbb05d45dc00bc8844aebc5326788da4e186af9ae08f85f961ef06bdc396dcba26155f4397493f4ee1eebcf4929fe81c82e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8e529e6c2e4d1f414c93931e445ba935

SHA1
9aeae85b32670109d1544b523f789ed3f8cb5077

SHA256
a85abd3e3b5b9021505df198b8adc5622200d33573641a68f9cfe10c198f6018

SHA512
1df37b8de357458e1b2c0848260285b0eeb92137df42c11a7c29442810cd0a9cca9c2dc440a866138b34ebff8d420b4a87abb233f2af9eefa0c9248f0df5bc2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eebb3edf394054cf835552660dcdbfb4

SHA1
40b4cff0c256ef724f2a8dbfb5458423eb44ab07

SHA256
3750382b4fb8e6e5d4d98f10f9d8082aeb4dd7f12617f896daf936b560f8dfe9

SHA512
5970cfc18ab94eda10a656ea5c39a4f606bf7532b316782856ec666e30083f816f089030afea4ecd16691c9cdfe4117af98ad6779a4ce497bfe8065a4edd8e5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
affc10e3fe92f97b160926f526c56583

SHA1
56e942ce3276b75bb639167500554b43047184d2

SHA256
ac26615361dc41f2b75b6b0a8789adf96f89caf3ddd54f64e67b98de1a38d175

SHA512
73f1d75a7fa47c4830772e07978d030e0e5ade6c30d74293d08d045ee950dc6bbdcab4d86969e424aaf5aa0d6caca027f0804bdf6734e1e1b7e5990242d5467c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
672aeb4f2e942a2147d92da85579b410

SHA1
6a9f40ecff2bf942288a7a46f38bd9c4b69d4599

SHA256
0fc7d8e6be54bed6532629e3c4a722f8586b51af9d90cc209218553b2c204650

SHA512
c61a0143d777750fe92db6a47b7004ab0cea9c4946d93c3485ac9da4a1634431b2bc4b1d10465fc58261d129eb223003c6da047bfb376a5e2654e7d5f0b2039a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1E1D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1F0E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit