79d0cf45d33ede88c6db17f8ab363749dcfee430ff4b715333cd28868157790a

Analysis

max time kernel
118s
max time network
153s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
16/06/2024, 18:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b49bc4f26a4c57dc991241c7afc71647_JaffaCakes118.html
Size

49KB
MD5

b49bc4f26a4c57dc991241c7afc71647
SHA1

0616b79609636349752fc5b20a76fc97523e2416
SHA256

79d0cf45d33ede88c6db17f8ab363749dcfee430ff4b715333cd28868157790a
SHA512

00fe5145062abcc64b8a01efc1ab4cb55ea88efa5dc3fd56daa81bc2e44b1c650ef5eaf055ecdd7b5455f13fe14b54ffad70bcf1c5b6e5d6986d6e9aec5c242e
SSDEEP

768:phLna89M7nWsN1Ew//Sez5eWUkUpu5L6E6kFck689GcWIjiHBDm5FJBBWQvVD:phTa894nWsN1EDye6WE7IavFJVVD

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a80760000000002000000000010660000000100002000000096b972fa5259613395c1bd8d911847d00130f186a4e42ea6cea06977b307328b000000000e8000000002000020000000e82b90ca1a15bd527bd088f8e510c4e69e21790aa252305659e680215f261bf7200000006247e9fe3acc0859d4a0bd70dea47e01e898e3dbb53bf9a23bbd89052a93e50e40000000b8eb0215c5ce9f48befca1724d8ce56aa1ffa19cead8d3a40e85b076ae884fad42b2a9b0be271e27dc1bd495892a1fbb8163ca4f00944f22b09bf5f8cc88b65d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00c210921cc0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000b4fcf1b04b157b8126c405f01abb36ea3324539f16bbef4eb14a19c1f761f7ea000000000e8000000002000020000000d7f2cd88820f6fbb724462e2498ac621fdc6f0344214c39fb6a8778c850389509000000090f08e6b61f8db03304d5c302148e8570cec08c0fa7e71ba3b62341a0590f7c09147616904e1d0fc7d302c57bc8c5d6ec1656f3a040eb8a45f6978ddfeae87468847f1ac765cd7838f739d497210dd15387b7ad53c4fe4bec60c4a74037d8fc438e50c26da4008ca8e9e498b9cad3a0994ca076bba700f352713c179f33820bff4a769d08729ae6a7eeddc94b5d65f754000000094e91e1132afa6314d3047170a94de96e0e04a6a4de51908db7f6b35d67488a23fa304cb0e7eacf9ae09695bb1cb1f28ecd8e580ed5b4e68f037392ad320f496	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9151DE81-2C0F-11EF-8156-CE03E2754020} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424724961"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2248	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2248	iexplore.exe
2248	iexplore.exe
2136	IEXPLORE.EXE
2136	IEXPLORE.EXE
2136	IEXPLORE.EXE
2136	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 2136	2248	iexplore.exe	28
PID 2248 wrote to memory of 2136	2248	iexplore.exe	28
PID 2248 wrote to memory of 2136	2248	iexplore.exe	28
PID 2248 wrote to memory of 2136	2248	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b49bc4f26a4c57dc991241c7afc71647_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2248 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4cef0f1da6ba2807630f6231c2d1b911

SHA1
863cb8fa7a5a013ca184b8e41b4dd1dad03a56f6

SHA256
ffd0bb27fcbebe32c518de05e9bd008eeaf19b3c7f426fcac13c375e857d181e

SHA512
8691be59cdca1fc9029762e7ee3fb207c51d655774245287db2f2937ea583482fb5a4b7ed09bdf6f9fd46b61b65983f3923544df8234f7800d22dfd8f2153a2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
df2816dc3b1fad614495c0a8a6be3f9e

SHA1
45fd04130bc8727a0e17b218494d438843bea8af

SHA256
6cabe42ffc7642dc84a5d153b35c189821f7dd56c970b507a18740265b3db2d9

SHA512
ff69c683f0c2dabf9f5011392bcf23656ddb27cddcf3135a7851a1a6b5c1ecc0a6d35d7f0eab1ef33df698983f829f8932eb7568ceecca0300f75bb718d43c80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a16ad9941e14c13fbaa9b615977beb64

SHA1
a943fa9bf471e2e83f5f81746dba98a0a6ea16f7

SHA256
7faa6c6af426a3a841657d5e356f03ad07b3accec6c06e31e486c96eb1336e97

SHA512
5b268b30e0a14353d8b00a977799ae5775e6621b1e8037c7bd2befdb1ec9a5875629735bc420af427d4d31ff5b4d5530b0cd16474c004befbde304bd7e9eec3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5e78642ae652695567675c19f318cbed

SHA1
24b5cb07f1f208b6984e8039aee83d09194060d1

SHA256
c8a6b76ace0cbb121b7658d524cfcde017d2da7f4555380ec8a3a8f1bf6c6de8

SHA512
ea84692051dc0efbec2fe15c3fa1175ce043b32aaa76cec49a39555e4adc1043875a7e16619cd36e0a1d9e42c67550df74bf0f8aef7b47f218a2c5ed1b88273e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a7ea43699f74923ce21368e80cfcd738

SHA1
c61afc58265e41dd5c2790f70b32982c1b25932a

SHA256
a2d15e2738f814c26444422a37898187101d14f8b7ede5631a66aa97691cf926

SHA512
53721a92727f21f737e3874f0b629279738669fb8f76c77fadf2bb311c527eb843627e1ae019a2dec76e165821e5e183404e8266bd910261b22abbf845aa33b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a2cbfda7db52ddd2272eacfa1fce30b1

SHA1
6ae5489d7061fbee4d73931b81ebf1cd831b920c

SHA256
c182871e7bce87e583fe9c3be2daba5cbc65e20885684e7506bcd96029ae2d12

SHA512
5a7d74a8e3d038d68cb920b0df025e2c4391b5d6f0b357912c74abd74abed293521bc05a58087f745d31e92c1bdd3031648d5205d067c7438523964c49d4f966

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
52923090bc467c416fb2e148c23de9f5

SHA1
72dc82e1bfcb8e4524e8449a791c978e3e93adb9

SHA256
faa414cb32d4fdd5b45b7eb02e68fc5e62257919b5c4dadebd3087e434847491

SHA512
45c36ce24aa8b543e266fbee1f86cf673706a6de04d11e8b6dadb49c020a8ea5ff5fa40538e5a9de9061f133d7b6d3f526812b078087ec19052ef1f4f79a7ccf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ecc58051168b793c58d22b3ade24731b

SHA1
728b1e100b1e2375840caac2a2577d80d699d64b

SHA256
0d00de8ed406747599af0a5218b31c0939d71685d2c2db0b3303f36002cf49ef

SHA512
09a4ab9337cdde2774179d4035a988c7160ae6cb1493d0789349c25fd5da1a365e13ecfed446a7656974f6f355a8245d699c22917f85a1be8c9c8a83f9d21747

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e4cf9e3512c343cdfc9819d902277b69

SHA1
4552de7cb7c43b26ecbf2d93c8c66ea31015d757

SHA256
9cabac25d91b209d4c31ac95f77003e1ebdbd842d1ea2cd52e917c0134efd4a5

SHA512
085c5cd93141db63d04443d7cc295521d03b16a865b99144a044714e0a3a142c68e6c62da0bc62c0b664cdf236e4d573c53677c649429c1b7aab2108db3285d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
986736fbc1981541c656afa460d95199

SHA1
f42a4d90e4dfbf47bf09242d25b0fc5d2529ea69

SHA256
08fecd1e857bcee491201b5093172fbd7fe667ea57e1ea9d65aafa6b0a32232c

SHA512
297c61bdbdf86c1e90046b386147d86276599fd998d873b676278bef0f79c74aabf82a403a243de4e420c4cf0a12095995b4f8bfa0391548438a184706c1a539

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9d627c4999f894aedb2bb2246b5ca4b4

SHA1
528b88e84d9db0b2b169470efeb23f69c2863817

SHA256
d11166fe0524965e39e1a8e7aae55410c037241b38f366d95c5e08c26429c1c5

SHA512
f174b41649f74ac186e38ffa13096a09a725d1f6efeb606bd97c8ccd90b930a7d355a4fc3cba34eb0081c5a04f40c7c4ce3cbefef960ba85863c70f1f2f545a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
054b6a9961d8592107ffbb786b7e8ca9

SHA1
fbabe8b73c3f1c27864789fb107e21cbb85543ee

SHA256
52a02e8a99a884a8fa22111ecf968d9f659c2b2237ead128a26fa9096e511c49

SHA512
93ba0428f333ab6776e3a0802fc90e06c09f5c706fa506aefc9497039106b4a2c919e1bd4dde40e287e32e4fc7d55bde0690d704a083b7b9bf4edeadcd22a8ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
538171388139a3c8250e527bb5e88df3

SHA1
770bf3c0689bb091c36bd514ea40961be2f5f5b3

SHA256
d7e9efe9b18817364635764ee68fb161bfb107b8f24d44204bec4fe541aaecbf

SHA512
4510b2561cfe99384721f1a7ef2053d88dee9583a114b307dd0f0f2d09ba058a57f150c2bfcd86ac70c27fba2928b9fa7c2156c78cb0f18732a1f45ab0a0dc6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cef6904235b7a28726536c087534cc7d

SHA1
c1ca65b16d33ea139095602675b49cc4b7720612

SHA256
4c4a25cc6d3048ddc8768893e59b839daa479427cd7d3064c59430dfdcb5d7f8

SHA512
5a2e294902787c881cfeb327137322c0ef0311cc4e96654458dc5f361c342da4e0c2709221411df7c62693e03a9e37268fafd3f02b38de0137c7d407e95e8bc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA7F5.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA901.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit