c0fc6e17726da7f9d3e2ef5a826f99bdce891a6464fab2b3ee411653c7c77a4b

Analysis

max time kernel
137s
max time network
147s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 08:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

48fd06da58ceaf655ecb06ae838812aa_JaffaCakes118.html
Size

90KB
MD5

48fd06da58ceaf655ecb06ae838812aa
SHA1

e84c045cc64fe85b641fdd5e8818e7ec0136951f
SHA256

c0fc6e17726da7f9d3e2ef5a826f99bdce891a6464fab2b3ee411653c7c77a4b
SHA512

403a0813ff0ac22a7c46ccc13c9481f11f077321b49aa1dc22517a179094b93f9cc3ea199f2fd65e5982620ce3096339f2b96ae92b24ad9ebf3b42c9bd7fa55c
SSDEEP

1536:gQZBCCOdx0IxCM4V3Q2Ghp+DLeiz9y+YzXDBwJon7Z1Du6EY4ZJmC5GdQ43kzx+W:gk2X0IxiPd

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb78000000000200000000001066000000010000200000005f80002de809dfa5fb64b1d67c3951dcca6eb16d0db0c0d31d37e067411bae39000000000e8000000002000020000000a1ef49acd4754e59c853d2c73df2cf0802eab0ca3319a0b77d0cbdd98da7ed45900000003260ceae59862d2452c307cafb0420fc886633883e6ed4e82e000f88acf8f6aabd07eea5f8e122b54ef39f8e55b78d43227edc2889aabb7b9ddd53d677553288f4fc2a45fb8b74fc4a8f4ca291d680697425d6b9c46d29a71fd478511495b4de16f67b13f3610fd5507a66428fd0b69f2f3310f6c7c5cc50a6b3feb283914af843245fe37fe5da4da868acca8af4e4e340000000d9f73e552b38091640920eb620470e894dd0750337c34819ece4fead9c2dfbc9e47dedd91a3d317d2dc1de73a25c1974dd70289bff7d836cd980fa1459d3016e	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427193856"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EF34E1C1-4283-11EF-8419-5E235017FF15} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0895fc890d6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb78000000000200000000001066000000010000200000000078ad9e2bc34333831ea57bffaa262da25b92e070bc0c5c75a8114d0c0847c3000000000e80000000020000200000007997a892308129db1e4b3e2e67af829c2aa7806568818e9e23b38fcc236f813220000000f531026b53681225f432588f2d3edcde913d27aba8d5233637bcab3dc30b35ba40000000ed8decd85180f62fae42c544a1189f2de96ef86394e7bac3c6d6f248d95c63a61590a46adefe90db1c078ebd631d1308c4d31d59cf0188fca28b3a39f14de574	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2104	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2104	iexplore.exe
2104	iexplore.exe
2092	IEXPLORE.EXE
2092	IEXPLORE.EXE
2092	IEXPLORE.EXE
2092	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 2092	2104	iexplore.exe	30
PID 2104 wrote to memory of 2092	2104	iexplore.exe	30
PID 2104 wrote to memory of 2092	2104	iexplore.exe	30
PID 2104 wrote to memory of 2092	2104	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\48fd06da58ceaf655ecb06ae838812aa_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2104 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b2e4617e7c0059ba98ba450b6ee906f

SHA1
c5b10906837ea3f91bca316d6c55a29ac1e9d733

SHA256
d3fcbe0a52f92ab4e4abcb1fb79a70eaeac651475336fa7ca9554963e16587cc

SHA512
dbe034fc8289307f30bbc2d4ec220acf75e474d55578142988fe983c4e6926bcbdb4a7e5730d269527c162e6eae1463a4c1eb316242ceeabb2d9dea77462c148

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4f7f5d3c652bb2fc16c4811a9e72412b

SHA1
21013d4a1235dea364f5eb11abccaaaeef2c66be

SHA256
ad730587c2cc03dbb3bc767aa0945c4e45f1bb6cbe9e54c1bbc998073c3529f1

SHA512
107d1c06d652552c0fed4098e6cf927a3669df1d01bbb8185bbc89c3006dbfde13c6fd3b0b33ac6199cb2c421d5721a529d3a0ae07f58a1a5937477450825b9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
baccca763c40322eab732827c65af6bf

SHA1
6ade197fcf459449b89873cabdd51e4e3bc4c763

SHA256
57227a5ea40c0a8ea7bd38d0febac5ae9e923cdd49b47fd93470948c8f581377

SHA512
6ce5c2159d363cf3559e495d21605f1853b1c075a55affad2544fcac2add49484e5c02ab0dcf667b7d4014b58a7632ead7f34baa8e242a29b748ef5b8bee0040

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b78038273c5252756b6cdb3d7e31cada

SHA1
b0a617f7d22d0e0b52639b6372b81c1a86e422d6

SHA256
7c826c296480eb61ec7f349252b716b42ed60c6de467a659da0eb65717ec8aa1

SHA512
0dc5cf4e4298076b2e9f767d0b84080318f0e8db0cc28c9a0b4f08c4c821797eef797a6d817b2a99c238870e94f935ebd208b1232780c048580ab794ba89f2bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f2704fb6b0ba0e4ce882433dea695680

SHA1
dd39e33fc6f20de6cc256fbcd398352362a4ad2e

SHA256
4be17a86a79c7a3d358dc36941acee2bed37f37ce52840b72d3a8cfd28fb0a5c

SHA512
7243038f429993efa84daa314ed9e9060dbcb27bf60e7851178e964be8ee71bc49ccf8c0409a1b72acdb55288fe785504ffa12f24ec218178c3ab1c9647a98ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6283cdd51fd44d035b8b367acc04ca7d

SHA1
836c11a38c24ce93333c8ce55fddac820a4cb789

SHA256
e1e9c68f9c3835882ebf663af0c7b900480c244dec268ff9c661d73aee712aac

SHA512
8ba4b31f1f2d49b76b021193dccfb2e9094e232336bf018eda10b9a68d3e4a4769a311c5ebece8d5a7ece0a835dbf0e8a75e1dea66e99efec217d05af45bf34e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1f2db3e44541f85d6519732a4223e6c8

SHA1
f94e4ee584ea308ab8ff1c13317e605678cfdee8

SHA256
9e17fab66c8db339cc9228673bd93592c2c2c07b13559e8cf2fa31481d4f431d

SHA512
eeb1c8e72a187b0663a4270c8050951d2eb183ac3322426ade5d3ae6716fad202780d01ae52e0e67245cac9a869a4747610e6e87b94c91b4da78571fefa833a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e59c368844b58d7b1dc81bee7986f0d1

SHA1
c8013070f10ea31da19044833eea028cb7e23807

SHA256
08f2673274d8f16fab92540c457e1d6b3b96345a43d339b45621ba837418ee63

SHA512
844fd77435ebe7e94d2096d3170b11a1625f9557dc8bd36e1f4ad420dcaf25e6dc3d08806f8244d8a5882b7293ba850c1492a979f87216abaf08439d282aed65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
04fa8f15ccd894daaea346b1a755042e

SHA1
4e1d09a56698e0db51fc25f1a1707621e7fd6812

SHA256
95b2ce05e075a40b0dc8e03d661c52e1c3bba173e942241b156d319c982d67a7

SHA512
1259dbe9158288d4ab109fe00be8987b53a47d5063ed78df0ca3f505be829fd3a38191510b64b94d6f05991d981830982e30c1c76744a791f2f8161fef3a76da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e4084ee427e744fbb768e9aa3f1636be

SHA1
28f8fd0846cdf9022b89d9eba642c78f1a492e55

SHA256
dc34cb079447b967831cd303196eab47d8f13cfceaafac34cff924d59e3d9134

SHA512
13a5ba23270dfd1e1431aa8bb4c34513c7ddb676d2f4fe0eb81930c05e47d589fab26531cc6075a0411191c83162e7a980edb12e894c13b1528bb3962647862b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF96F.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF9A1.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit