47c8eb7e64a7ac4539fac65f6165b581e3dbf1bf867559993e4226e6d8c6fcf9

Analysis

max time kernel
107s
max time network
159s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
05-06-2024 08:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

979dc24678f5d492ea9c5a3d2bde1470_JaffaCakes118.html
Size

139KB
MD5

979dc24678f5d492ea9c5a3d2bde1470
SHA1

d72217c76887dc3087897b731a2e0d6bc8cb6ce7
SHA256

47c8eb7e64a7ac4539fac65f6165b581e3dbf1bf867559993e4226e6d8c6fcf9
SHA512

4d4c75e7bfc2ee1f833aee0f74999f2fbe0de27d75036a759166fc288f1bb159d3cc8580d47a13763008e97e41cd025586bcaa56e6d70d2fcda78920b2d3956b
SSDEEP

3072:SbuEjVsHEXMKStQ9r5OT69tdrRSeFJ+fm:SqErdjrV+u

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423738128"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E6EA12C1-2315-11EF-B0F7-6EC840ECE01E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2008	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2008	iexplore.exe
2008	iexplore.exe
2588	IEXPLORE.EXE
2588	IEXPLORE.EXE
2588	IEXPLORE.EXE
2588	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 2588	2008	iexplore.exe	28
PID 2008 wrote to memory of 2588	2008	iexplore.exe	28
PID 2008 wrote to memory of 2588	2008	iexplore.exe	28
PID 2008 wrote to memory of 2588	2008	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\979dc24678f5d492ea9c5a3d2bde1470_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2008 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0239be7436226df6be75c68351d7ed34

SHA1
830e3868da99970ee740086514bbbf3e398e35c9

SHA256
3aedd96fdf6818af63d0988d49bc2cfa390d42c8d836ba5afa7bdfa505497da8

SHA512
15b67389050668a5bc0453421eea7a10f9feb3f706809533456eaad279522273d2823e18f087d068f401b1dbef2b16b7f7add0adc00814e17d6a836d0deb224e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1d5f4dda5d0077a57bac54da227b89a6

SHA1
298818bd1a0d8636707e3bdb0c05a6f8104a0e48

SHA256
10d5b5113bd47e0a19921ddfb037f6ea96f1e347efe71b917e6cf548176e2f8c

SHA512
306374e77e2ff57b454d0c58db89dfb476b8dbcda2f8bf00dd540f8835f206b2ea1e0203a859f40f8c6309bcc4d839ef6e673056ccacda24f2b2e32d4159d342

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ec810c66978ef7009481be6713b64ab5

SHA1
3f50bf101a1230ee038aa15de8683093a7d11c35

SHA256
4a7f697d0d4c76e5102bb9ca04b4886c8406b2579cf206f71d2b47c625957e48

SHA512
8b026b9029d065a4a7c53f9d225128d78d72b9706b69756f02de8b20355b9a96958fc8dc73dca950e46f5a40c5a929569ccd650b592e11f11d7220d1fb6f420a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f6c459c67f4db00aa2c1201e19d86831

SHA1
2dfa9d236b18444f100dc23b758502fb89d0d1de

SHA256
a04192b0aa21abce3756f149b60907b662fd46914d7113111a4ee861c0d7bde9

SHA512
a5249be14d86ca8f6d627c76de55998b268f07f12c247e2a58cf7dd8122beb636fd1d4d03cc6fce11aaf4ff6ad1a4fb6ec81c2279c51c34b6368a4ffef82fa27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9bd0709388e662987773c57a81bbb999

SHA1
276557c24fd710d208de217121e0d2595fa3c9ae

SHA256
7ec893967d73af7318d62ed63feac17ac153f63564ba9f149ee23c794f55eb40

SHA512
e086a66c3f856dd106c64c2dfad15f5111764c91ff361a2d217a85ab1827fd3fddf5089d84f5db4a7e1760ba27d3f102fab4b57b266dc0f1bdc0a5a3a952cfc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1fffd158c1e87eacd5b2ac8d5efb858c

SHA1
6dc9c6d9dd3e7aad35830ff2b1d5d4e3e11b1359

SHA256
13f832667e98cc6280c1dc3d2125197833626e00a5fe5534c55a533996c56efb

SHA512
7277133db74bbf2e82dea30df5d5b1f6a2cd0330e4a23b0e796215362801780898041ae930019ed268014886088392c1cb43e0079a3970600fe0f5f67716c6ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d206416ded2f39ab5ff73a835f82361c

SHA1
c25d58701222488edcd58b808c7faf900645109b

SHA256
611c9ff761f007512ebf5f2142054825c7d70c20c381e741174dae8b724c0c24

SHA512
5d335981d6f78060a71ca06d9c84ec6c2b873fd0cde313a37825d685befe9c47f9bccb4f78c7695baff0056e7a448767cbdf3fb0c1eab30111a688b3887ce54b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be36457311960e3e6e26dc169010973f

SHA1
f25e9166d658b7074a0df9027cf5af08f4510b24

SHA256
805cf01916a15aa07a5efb489b86a707d704b03d547b0099eabae6e539c3424a

SHA512
8e8954e0c25f7b9f4bac1b1ad92aa860ba83d6b3fa3e04b6c9e572d902e3a7bc35cb623cc086a3c97566d7849175af19120568912e6d6ff6b76aed3cacc2c242

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
405758ea9f490fed74b6a163becf2e4a

SHA1
4ccd084b8a8452f07a3babc8004def3e815a2b7c

SHA256
788c03dde5ba5ea0b146d70a511d0da107c58a48cce20bced2454a41c77049e9

SHA512
c850399f610b6bdb0a3556f9fbc19807a9cefee1cd3b38162c4c7b8aaeb9195bb187f70e0b03c188361f5b622cd080d930329939b06417bf946a4120bc9c15ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
94deae8c2b0b0fd39934250a1aa4e978

SHA1
82dce7b9c6d5b90eedb7b7d476b1d76d582e5325

SHA256
e710075d97649851521b61304effb0e70883cedb79fa5cd5393c63088e2c95aa

SHA512
e510103b17f99c557f7d5f47a6a1fce53b372eb1baff2d646369e9dd9c82e2a0f6501f89f257296c21c4ad5cdd5cb0fdbfaf98de9506c00629df11b87a652cbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\902LKC6A\ab77b6ea7f3fbf79[1].js

Filesize
478B

MD5
5dd27f8f2b042194c3cdabd62fd80110

SHA1
c035036a939799d4c29b9c0f7229ae1953d03109

SHA256
928131ab2183d971cdbfe2ed1329200212d0021db70574a35c89ae169c0f6e0a

SHA512
95c7b2dba57dd75e6120794c0ff14750258d8ca3c86e6efcf04790d347bda18e246e14d5fd8ce645e46e268f978132407bafa93ca97fa003103b59c6135334ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OOWQLMJV\11.0.1[1].js

Filesize
106B

MD5
fdffada99a6e326385c9d6d22006b6c8

SHA1
f69101fdeeb5282659ebffa17ec82e89a0cd09f9

SHA256
c58c444af409b74761d5cb4a86fde4b48ee2d4701252b439834f01868c8cb955

SHA512
a7190172ebb6023d27a69629801b9b71cba77f7f4889aecb129ea8b8e84fef7bd1cc21ca3ee2fe327bd4d97f30bee5ed40927f2a54d45a13c66edca653a60f3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4D48.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar528C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit