b37cdfd508798d7a878fddd2b4a2b2773bbcb7151b462a35ae598a75f7f265f9

Analysis

max time kernel
122s
max time network
130s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-04-2024 02:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fbc3ede303e8207ec38df9405a4f628b_JaffaCakes118.html
Size

24KB
MD5

fbc3ede303e8207ec38df9405a4f628b
SHA1

0fa5adac25f2777105fe3f9b6f0f99e17c495cba
SHA256

b37cdfd508798d7a878fddd2b4a2b2773bbcb7151b462a35ae598a75f7f265f9
SHA512

cba8d5899de8fa5e68ce9ae664f7ebc4d3bc3140987981a9e7eeae28acfb516a72aed8a2e9e292f205d2d8b42e43de2938cc89b410e58d61ee7d2ce93f8e0187
SSDEEP

384:/X6qUVkczFiX4pmOdOiuoNo9oD0Vpt2D58tAYsNN2ceo8BYU1ke2D:/lUpzFiX2XAt26thueofL7D

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000bdca8ce3a3371b947ae9c7862676af89b099d80d385a6095d25a13c08dda2735000000000e80000000020000200000003b90a1674373eabe0bb778f1bbd96dfc1566d4e8b2b41848ccc9f03f49bcdff190000000e42dfefcb48c4e37a8fc0226ba7bb11e66dc24748506007a1ed2090d12c0fea8dc855391ea4d1dc242df21c4a7abea88a4f8d4941d989bee407460d7f1614008711dd74c3343321fa4cc96cb05d6414af33915482889607c3464f1839012722599c76b1ecf774ba4b1b2dd876d8de7aebf9a2c6909ae2186a325375ce63fe84a4f6e78d88d1c10806c2df13a2c4cacbb40000000f19d23591812a5261f0a6f0f4a1ad55e8610cb52cc04ebb708bdde55adbc1a37698eb7ee70c1e043dc50ed362ae006bbd60ccde6556fb81f84423aefb4ce974a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D1423891-FEC0-11EE-8FBA-CEEE273A2359} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60cfe8a5cd92da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000005260d76b88b70548ce5872171fee4414a29a8532125fdcd9dcae576e95078a10000000000e800000000200002000000022d8147338d37c317d9c9596427d9db1b18eba31416c1b378f1bce785174f86120000000fa31977f800448c503eae4240df27c6cadb7b417f4c40e9d6fd3541af0cde4ec400000009632e5530f27f0e76c37d26352bdb11dd0bade5ffe679f68bdadb9ee70c06f8efaee65d0f8210e394a19133ace1c824ff3057ca76c9cd04d7a5965d8cb86bc7b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419743327"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2256	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2256	iexplore.exe
2256	iexplore.exe
2500	IEXPLORE.EXE
2500	IEXPLORE.EXE
2500	IEXPLORE.EXE
2500	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 2500	2256	iexplore.exe	28
PID 2256 wrote to memory of 2500	2256	iexplore.exe	28
PID 2256 wrote to memory of 2500	2256	iexplore.exe	28
PID 2256 wrote to memory of 2500	2256	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fbc3ede303e8207ec38df9405a4f628b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2256 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14143b6cad9b0bda949d6f282d227cc2

SHA1
d01a4cd55fb1dbce86776600d7481199b78d8b34

SHA256
83dd7c72284216cda60d1e05022e54a6bb97d0e61b9006c5e5b4fc6794921937

SHA512
c3b05625d0b5dd0c84c60735c1133207892b7da5fee1ff1e88ebc0f269a9a3130681970fa584707edd9bb99448c65feb20eee22aa794e5a02dac521c5e40518d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
81b03415434fbb8b4f492f6685acd33c

SHA1
091bd1ca94214875ecb4fdb0eb5c092a684f7689

SHA256
92747375a5c93e935d26122056852599d17f7b21ded6d917e26c5f5e20e363e2

SHA512
2d836b10f18a11133607d0595fb3bb8e8b47642adaa8f9cc79590e9dbb195b2427a098d68fd93e0fb33a4052a49c42025357e299741ffbc623496c49ca30348b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b9c1e895d29a94f8a9ceeac0ce73989

SHA1
d091eac316227a566994060d73cead555ffb04aa

SHA256
77095a46fe290cf30987d9738d11278e89bffa304e38d85701be4c91204e3054

SHA512
7ab5f7d2398477a6421adaadc76c9e924913d63607c997455c3198a79c98101f1848eca8e391e267409baeac4cc2a9524e9737149021cafee600f2e41786fd42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4751bfee4a80c745850a9e15f690252

SHA1
2c5a1ac6ddcc6052313ac427155e5d005e4fd3f3

SHA256
4d15abfbf9df2001243e1cf3c324a1348595c7911a2c4f5804ced0a62d60dc1b

SHA512
0362c43d72161ef95d623f4c537a9f1dcac089385d584630baf109a1ada710b2c95fd4de41cb1b1bc7e7e2e6bedc61c8b51651520929beb0330f744b2b1727a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b59abca2e186a7c8c629fa42e1bb8147

SHA1
0447a4c8ddb364d1c5c3dfb0b5e1199cb2c79247

SHA256
9e16556f11a8660bbdb3cdd2431ff6ccd4d3c18dc00662b7f602ae861e247285

SHA512
7f4fbdc17434d870acc64281f8d7db9d2a9f4555ea93c7ac39979756a26d8534ac28a58f9c57bc63fabbc381565fbc9b7c9268f1f44f1783a3924ac26f81b73d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
947915eb203b2ac0a7b01135b24f6680

SHA1
6461f06dedad4c8154d25f032f9cf4ed6ebcd088

SHA256
a677bdd4fb7e1d369c9888d48ff74a2caaedb90cf8eb26027b46366fbb381b61

SHA512
fa08199596026f0bc6ba1b48a5fb3b71f91d6b2d3c9aa25f0e20e7f7e18bc2a9bafa3056935fed118cb8ef07d0d0f4dafcebd3a13fe7e5cfced46605efe5812f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eff4891be4fe0bef858aefcd6859025b

SHA1
90014183a58e9136681546f4fba28371f9057799

SHA256
826909820ba9da3d731b61a5dd1c6e6a67d332c2f8fe77058bac4ee4a9336ec6

SHA512
fa822c493b7fd371a903ae2d4ae234109a59b41345d0c33907a7718057ea5f56ddb03c409570e2020c216e9c3b66097dff13c3ce3c679495f3e524037f3b5139

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a854fb6a569fff04bfe36654ffd2f44

SHA1
44279cc8912b5e758be132bbdc792b4492c8a0b7

SHA256
773443cc78d3844d60c0d2e8086f3069bf2f3f133a78243a5ad6dc45f16264d5

SHA512
83cb701bba1af8b35b6d921113411da3d6ac536891d5e00e9fcd097ffd5ccdce45df18196774ca128fddce0d6f092c62d65a313c03382f562c536dc19317dd7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9311bb0faf855c7325a208a7f4fdea8e

SHA1
fe1665981896492a0389fda758a87c23b07d0cb0

SHA256
a7268e7908e60409fb2a461562022525b85fa3db35cb90f238e85624fb13cd47

SHA512
7849e4b2a596d838142b5291d4609088d3a3dcf931a29def0a13757eb8e06d96790cf9fb25321c817195c34431674cf6841b0e3839540c6783ae6a68f6c58b87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06e29907e4c285c9dec5e0779b422217

SHA1
7e1a3a22b90a37e52268e13349ccdb49f5d53604

SHA256
545f995c77ff533d4c2cc2a3f7832628914169fdd148ead0852e7a193e6d9265

SHA512
30214b0717ea4255744addee71b6076f7e612230850333a089b55d5876f4eebb4408870594ab390e877ee145c5e2fbb015b84b28415512d9927d268ef5e3c63b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
96f8c6fa4afc1c1edf0429b64c189aaf

SHA1
a85fbbfe8d5b772460ddd469918151dceb1e2d86

SHA256
558ad23944f524c1f49c0bac0330facf955ec9fbd5ad86f8cf0b037019184c7b

SHA512
e8fea9adf899998bb466a257f413a9bf1c0ccaa565feca66a1ce3380b89e5c5eaede246e38da16f9bb42cc24669f4cc4eb4768df02d29f42f254a5df5e55020b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e13bb3ede52215ec8bbfba10bea4aec

SHA1
018c617710ceb779f50f86575a0ae92ba1b47bec

SHA256
8fa6c76a2680ac14dafd22b05bd5c3e1cfb340b9797acb6890c6341a10fc384a

SHA512
7e3177b122151c96f6235b9b13576dbf60cd74af1eecc00615afe855eff8f27c49f909b88dee5b1e94b58b528839f4ebefff7ea7d09b04e5c8c67d61e0c8fda7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5185d4a94fd61a60a66b3b1844ab2cb

SHA1
ffc9250f027174d5340f2484f1416a3b9c5e062a

SHA256
519bf758d5ba8128a4fd122c64045dd12bf935d1433a2f0705f7413e8ea74903

SHA512
a83a9e619f07280b6dd457a98304c71f66c7bc4f9cd6b7b36558616d28c86d6d781567b1b9c55d90eb43528279ffff33a13b5846fe59e6b1ecdde69d20040815

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2EC6.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit