47a7825248d9a8258df7f86b40f97d2e20b68632985d413b51b8c9a2764882b6

Analysis

max time kernel
136s
max time network
126s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
29-05-2024 19:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

81bb52438de4e21a23c0bf4a6f13eabf_JaffaCakes118.html
Size

156KB
MD5

81bb52438de4e21a23c0bf4a6f13eabf
SHA1

69529dba8102c0c3eb2ff609b6e70dc175eeb2a5
SHA256

47a7825248d9a8258df7f86b40f97d2e20b68632985d413b51b8c9a2764882b6
SHA512

512738e080369bdd59c11619d1e1e62828182ec0fca5da5b6efa320427b4825c767a3fa8b9fdb15c66e811c1270be384e69c583b789690825980fa2536bcffd1
SSDEEP

3072:SkkBq//o1oyfkMY+BES09JXAnyrZalI+YQ:SkkBq//o1lsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000050cd65aabd69edc1203156b8a1b3693aae0ad859e58e863d9f55c4e2a49db719000000000e8000000002000020000000d48c0017353a30ebdb4c74b9d0559f601a64b7a1d7711237e04eb808aecdaa5d900000002f23bf29746a02a77188e0fc0952c32f41f266eebdbf8969ecf37caeaf8db6e17cf0401a38f944b1c5cfef833c77616490640b1d172d1955cf24c78c4e20726ce5c1235edd358800f24e2d73499bb6b0567bdf3802af3e83f5abd4e83a09e867df459ee83089718281e03671f2bdd85a12f13261714f96771c4d14757196f448c24fe82e5ec087b43ca97df3cbc01ffc4000000030db6b4e0e0065de259e449511ac1f07d33ab7ed909fe315d2d5ac9567b4f254cfcba0c07c99e4010377509466ea9a18a43c9da8fe9e86b519540d16de474199	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000acdcb2529b82c71cc7a4939cffd2380526a3af6f5e140685190b0002bf201f2a000000000e80000000020000200000005a3db16c1b86e3d66d9b4ac08d81084d27ef7961750d236e6e942de0dab99537200000004106649ac31d46da12ce5821fe3946c3745bad7ce7e088ed68ef75830c1a444f40000000a2fe2b3fdda9c3a8729fce41bf68895d61eac0fdaeb375373c1766f977f0f7abef45498456b7e9b5978a45a2fe1d82b8ccf6243e14bfb869bb6c3a7c50c464d7	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 602a1bb002b2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9C9C3291-1DF5-11EF-84D8-C2F93164A635} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423174488"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1576	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1576	iexplore.exe
1576	iexplore.exe
2336	IEXPLORE.EXE
2336	IEXPLORE.EXE
2336	IEXPLORE.EXE
2336	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1576 wrote to memory of 2336	1576	iexplore.exe	28
PID 1576 wrote to memory of 2336	1576	iexplore.exe	28
PID 1576 wrote to memory of 2336	1576	iexplore.exe	28
PID 1576 wrote to memory of 2336	1576	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\81bb52438de4e21a23c0bf4a6f13eabf_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1576
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1576 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aa2446b02cfb97eb768712dc54d92746

SHA1
48d692066494622863a6d44aaf90e0fc2535c974

SHA256
53920a069b48f3fe58b17d53eff31307ead873269dbbd4ed9791c42ff5bce16d

SHA512
14d23544c66d9366327737e9a63f576e3198d7fbdccfa9cce9bd55b84e6c9b5254d1e1f5e42426ddc6f0018cbfbbe5032a46045b4d651dc7c1041117560a843a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2faf54dc7a9892e948ba8b6d3128c995

SHA1
bf0ceea4f6a7b1a74bc60df7900039f9e73bf1a9

SHA256
f4a2cf120a6ba9d99d3bd4744da8bcad642e411beff679c20388a17f8fc066ff

SHA512
9fe2da0bb3b84b198a3d6e88dcc7c170b1f4e13021275fa699563c80569b54bbe99cc10d21770dc24052d73c67d1637b336a2f922e926ff854a08e82013da081

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b1478303b2c727b369201935fd4ae9fd

SHA1
ac79cede570eecf86dd8ef5d3cd696da5099007d

SHA256
2174f9abbbf4401b1562d7f79525192bc786cbc5b20522c53c5d69428684b201

SHA512
271cf1e9a3e60ac3c6c7f91f7ca5d2a42b50a9cd0985d51aa479c88c6a5c6477bb41671b907a5b9f6ce747816d9518973664adbb5cf217c38ab021aa65f732a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3d47a3ef2d8b58343077f45d46a316b2

SHA1
5197d4dfe35e1cf9a21229da21f864e36a9f7dc4

SHA256
3c923478b4812f03f9354c86b29c9fc7134fddd28b8e54a5a44d08f5005b855e

SHA512
d2948b7da4b47f9559df33955d320a7a6214187092b07ef593d9b3dc782be0141ccc2dc5a14280932ef9a29d797f592b0d9ff70742570935163e2f78e1b28b2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f8adc8d234bc9e93b79bfb725d9c8e7

SHA1
e279c8ecb9d1b12b81c7cf369abf4a33aee2fe7b

SHA256
b4e647539f57f9eb53ba287d57d50ad18940404b50f88e4a7eb3031558277582

SHA512
ef4b6a149af64d0e577dcf090257b78b44af06b66e2036a013cacf199f763a9db0207386dfe0574f568488ec0e7ea4a695ffd116737e11cc37a882793384b5c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
441135902e5ab7b1b0f7d0efc84d45a8

SHA1
91e7a8435d5ede6cb60b955f3f2ef1520ee75d04

SHA256
24153bb582024c8fe6020961a5f484fa7367674600dfd661c5f3fce53eeab78d

SHA512
ba9e6138277a52ba89f158f29f014abdb671d93cbcb5b23c5b43cd17b6d7d9441f6d07a899673f5fad513e0fcf28a9196c3a84a6815c1d986806595fdd62ff76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ef494609daa51da3b522ba844db401c6

SHA1
8beb8aefecdca07a74336c0ffc9f71f679691e8d

SHA256
b4a13585eef7a76fc7fe9bfc33b1a1124d692b84146f12f95f9a3919b1317f76

SHA512
ef98c17349d5a8aab7bd56658939818eeaa8b4e02f7749fd081c17fc092be4a12d95c64fd629ec5ac0c6f2d4858a426092f2af91e20cd1e7a4272cf2c4d06e3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
df82235a4d8e17d29214548d9ded0297

SHA1
6b35feca1421a4ca1f7402e5bb16e115ed2891a5

SHA256
bc858d0de3b3813686797cb8cabd9a6b0689c53f221be4b369b3c116c7f5e149

SHA512
b968b3ad4d1ccb12bd0ff8a9f03b1a2da1c12053f47d0d0fd041e6ba7f4173b58dd2df0c9218556099509c4c8212f187c094bb6a743ca728d30eafa85cecf61b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3dee2785e58d6ba93d3f38dac721eaae

SHA1
20d92c749bf65804540c1d9846c28ea0fb928ba0

SHA256
59d885b19a2162d2056db6d91fd989601681bcc96a77921a68adc3b8c660fa1a

SHA512
b7ce1d29dfc2112f552a5f892535e0126f49398cb1b829b995b29102dc7ab3f126881fc954d3006a4701a7a9cd589b3a6bbe86b00e4d573e857d23a0c56106dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b885ba5f5830de401766a137265bab52

SHA1
913a25e210b45e2d38fbea1d1e43eedf6fa66a25

SHA256
95b3fb2c1c32d71de4e7f0ddd56ef5a032d3ad31b8b74c73e1345cb4f2543c20

SHA512
bf30b342445a8e2f97a69d20ebcd5256f475f3fba933aefecfb42a3b8e98c68794acae5b7d1fbd0f134a1cf8f59ea387fbfa6418705f7f3e3c007988ca4cedbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8bc166091e0d7cfe685aa3802be07b71

SHA1
8cc0aa57ce0389b1a828061c4ee4e01184158f35

SHA256
d43d1ebd4280b91ff6dda7fcc3504d1005dc987d882606efe2614912ad25907b

SHA512
68729cc50722222485844d72103ab600df67d85eb8fa0c9f08eb16507c2c400bfadfe46896a0f6cd657800961c789eb4a7d3ab1f4b68bdfb3c2d38c9a2690cad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
677bd261786da2466d7e837cf6dd41a7

SHA1
2f2cb005bfba56172fd8ccf6ad85f2c8fd0d4202

SHA256
b4b3aff0dd5ca4db6b944ca4d886010b4c4d8226a21db63f1ad15a89d051ef08

SHA512
ff02073472b05acbdbcab8d6542fb108d0666941b7ff003f04d3e1f93c55f72fcfbbfc272778db8da272c6d91f94407e15914b50e3ca384de4a228bd12cac3b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a3829d7613a4f1b41c59974bce720e44

SHA1
05ed1c39bc2990c45e45756551bf2daa5cd3a653

SHA256
c190b2dc29cf8dcc769025739f5b57d1a8d58f556b8645a945173596701a3276

SHA512
67d8104fb34e162f4e3eb61a97c733731303696f86257c40d22c291951cdb08dcf1c934627b4e7335bf45ece0c17469fcb5118e4c9ffc3dad137651fc0d6ab34

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1C2A.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1CCD.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit