400d0fc9dd5ba0f779089885f05a4fcbee4f690dc5c9aa1909125638bdcfd7ee

Analysis

max time kernel
143s
max time network
146s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 12:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

49cf5001288e40aab072f5d6dc0958bd_JaffaCakes118.html
Size

31KB
MD5

49cf5001288e40aab072f5d6dc0958bd
SHA1

39baacd198c38e0811ffbd405681038cec71849c
SHA256

400d0fc9dd5ba0f779089885f05a4fcbee4f690dc5c9aa1909125638bdcfd7ee
SHA512

a1c72792095a576895d3540412777854328677b8db9994899f18c068bc2b751e6e43c6133d47e484470b29b6fecbf073297659c8d85517a071cec336a0f140b7
SSDEEP

768:GNF02AmOahaSs14+b+14+2PBLiX4UqZiCfL00Eo:GhadU/8N

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B19DDC51-42B4-11EF-B557-526E148F5AD5} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c06ab389c1d6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf71000000000200000000001066000000010000200000007dd6234d4cc63020d002f69abd3aec5210b5909c5ce2cdc1621af6e05bb0d6fd000000000e80000000020000200000001bf43899716a1359b3f9f74384b6dc2bcb5acc909f504616d2c67206010c870320000000239618b449bd7e4a97ef46f3c130fffe6cae6c80f6a9084d60c4e8a0bece01f5400000006808a4ec109a2b9659263b844b3f1013d931401a18f81bf56656a63b537956627b6433b877d550de6015e49504865e04bac0f6de12150a50fc2d593ce2929ea0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427214799"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf7100000000020000000000106600000001000020000000909ad84d19379700a5bdc2a3e89ced7aca9879f159c007468a2549218d8475b9000000000e8000000002000020000000e248b02d8fd55f9ef955c15f98d33e95ea394173b6d861014f917b8f96cc70d9900000003cd7d6aa2483f2d6956baa292b7602fbfc795b3f4e879a22fe8ec2c2f19560519bf01daa8197f3a122a9b40620aa0851b35c56ebd2a32ef415af2bb44512f1bfc3039e46db74a1ca3a4fb5b0ee5cd2f6e2c6e589e31e86df6f9f4cc7c1f37fbaeef09d642d967355ca576c81ce03d34c83fc9de1d0968d894940711eea4a264bed001144248c93913a7dbc817d7485794000000079f1bb647da13ccc5a967b9d52a95382169ed12dbf0f72cc02cacb6365a0cc3133ebf8921d98955655ffd2ba610ecf6defdc8f92da43282ed97400943be2bfa8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2416	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2416	iexplore.exe
2416	iexplore.exe
1804	IEXPLORE.EXE
1804	IEXPLORE.EXE
1804	IEXPLORE.EXE
1804	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 1804	2416	iexplore.exe	30
PID 2416 wrote to memory of 1804	2416	iexplore.exe	30
PID 2416 wrote to memory of 1804	2416	iexplore.exe	30
PID 2416 wrote to memory of 1804	2416	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\49cf5001288e40aab072f5d6dc0958bd_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2416 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
833fd385e9742e5f990b448acec93c80

SHA1
1d2c0cc858ecf7e41f478247d8703ec26ba10bca

SHA256
657a71c42503c91c47fccab22a84fed46e74abcf8f60e3c386c426b10351dc13

SHA512
0eaeb59fa7dd2d3080b9b8b2e4e95b7873878d629027c3da10400b1641c55a57f0c0d912ae949e448d773b0ef198279b7e9d547cdeaec2c9bb983fe3edc57b8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
41fa1fdc3066ec1362f6b484f8481b2e

SHA1
f730c8ab56c0cb3125a14e83e4c52e1377f43835

SHA256
8cffd6f3ef482f5b10fca1ca8aa970fcda24c618d69fa436205cd48307c0a2ef

SHA512
85a512437b11600798dacfb04524a3ac07946fbe00b1c6d65d3f5eb42895a12ef47353f501d379a67c0e69e8a287525331dbf6be58258a4c706cb12fb8fcc145

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d8ffc70f19804441602aedb4cd93f2b5

SHA1
fb2c32596f9ef2a4641caf78e8c9420bdb10adbe

SHA256
c55e0611e1065636c3e02a7617ca9d6e4ca8d8292a240c3cab5dc12811bc9d53

SHA512
8c3b4e7f3a42c311d5fd73cae0757a5bd0d0799bf1bfb82f5fb514194813b6606a5993b3c721df38d19e88edf47413632edf65fb276957a3cc521fca96e5ce43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f2ed4345d1383b1571c71ba18fec950

SHA1
d4f91c9d36485cbd1f09b68a779c3fdeb31170c6

SHA256
f45add7242a64d19f635ef0eb16768abbade7f066c470b284c59080191749cfb

SHA512
e654c39b7c35cc8c8af210da5ecde95a8e178f3545d0dbbdc6f5d90124ef40cce6a7f561128b6d59df5a23607617f35bf8850bc6528d22b493bb1214dd9cfdf9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
06e93de462f5eb25cac50f311ff6ad70

SHA1
c79549e8ec4c32819b76549ce56943a6f4320ee5

SHA256
9dbffbb96416f893293b9f480b6968431961f7ef872404da92c65e5f61644fbc

SHA512
e1a42fc64d6c4408e50db468af84485c0eb10e4ca295c9d7e45bcd86bfb06e2d7f0e0209a47006ee3edaab93067a0dfce4f47012d61a870dcbd551fe035b332f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fe3e0c1a2ef4baee951a3455d47672a1

SHA1
abfc2a2ebe92a106c0d2336e0f0c904a55763452

SHA256
64e081df928366f13d70dc56310a08b1ba68fac99d1fef2ef2d1116117078614

SHA512
3bede1b5bbe4c9f15a4cd28704b73c0ea14b07c11c1ff5623000149c399eb64538712ecf1f8b68a5ba810655106fd09c47ac68e0e237154bc9d0fbee7b41c462

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9ec7ab3a102a492e7385c8c31a22b7c9

SHA1
3dbe01a24420298ca1e9939fe0fe6e013138aa4a

SHA256
045cc7b78ef7f7452fdad276b64827a82fc25da5c931c7e38fee7900afe0233a

SHA512
180a7b2cba38990b3bb1c441c28bf14bfc7b6065337eba6f0f8b4000872979ede95acb1efbfb0ae84b2226ea59a09ca3f12bceaa4e008e1316a7dcd5da89602d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5439f3e0fb4fb36ff670ba8d30bc7d2f

SHA1
ae9d96192c1cf4104926c1b747d9d97c0e58db2b

SHA256
7a628004aab8120f62bb30b0374c00a48fccc344f99983dc7409dd2deb02faec

SHA512
7c68863434bffd95335fa038e7856f6b7547d3d9a0e7aeb5d9a12c352309af87ca0cdc0278843bc3840d1d3f8cb55e88b4df1c5e054541f6ea1bb444d6dbea0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c382a3e91e21fcdf603d23a47436d41c

SHA1
35db118705f75b5702124515bade9317c2767af4

SHA256
e64b3f593fa38b8f5f71c0e6d4cac90ca730411c6944ad085f3c8f39cea52fc5

SHA512
9ff8489653fc0db9b37c30c382a8eafa621ca095a9ab727506c09e052f479fc4c7269d4d95a8b3e27dedc3b2a999f737e2c31360e54e6664d57cbdb55ea39e01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
12b27ba33d532ed2f43b567c3992d8d1

SHA1
edae532a111a21a0c8790076646a557bf77c2a39

SHA256
9b9297d977f959d5101f96e3cae978dee72e373ed19248e4449176036f8fd45e

SHA512
12680309421ec6abcf3b8efaa13d2563c1306dd5bea5792e8b90e833b0638e9886a33050d8f682a1cc398ccc7a4347ac77debfc0328bc5970f813bf8c7067c50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b98e85aa60be96c90306e7dd51e358f2

SHA1
88446dd99a12088e2ee03d71bed5301e5c3ee9c5

SHA256
6eccaccf60a295ac0fe037fed26d1cc90b1e96c0bf9716aea2c4b32b317acac9

SHA512
7fda285be45de14e43b2ba9ea19f8b72d24027c16cfd31b364e7144a39262086e68d0d2601432833f298158e76d6835171898c6f895271082692d28f99740b69

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5FD.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar802.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit