e20fde82672c4061013ad517559586485e523b279d52cd8fe14b423e2a446347

Analysis

max time kernel
143s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-04-2024 20:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fd93215273eef04ca81c585094fc368d_JaffaCakes118.html
Size

241KB
MD5

fd93215273eef04ca81c585094fc368d
SHA1

90a5d87c295d82f5aba9349298f6e5654c9e0e31
SHA256

e20fde82672c4061013ad517559586485e523b279d52cd8fe14b423e2a446347
SHA512

6b8da4ab44b8597c4190d9e0cf320a0efcfb8070f76da5df3b491511c876938c2834633bc9fd102b1b12edbfe223ef8636372acd94f76a0cc1d26d9a04389e7e
SSDEEP

3072:14N0gOS+COr6eFodNhMFK+rjXIPzpjmaLH9ZCroYna3vZSP5ZbI0ty/derD8f9uD:14igDUr63+/MEax9YDPngfNwZ8U

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
60	sites.google.com
74	sites.google.com

Modifies Internet Explorer settings 1 TTPs 37 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419806579"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DOMStorage\cbox.ws	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0f0fe076193da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000009507b2d61e78c21868ade405ebc32db5501777bb9d1b4787ed33b3ccac2e7d7c000000000e800000000200002000000011cc76218587b7b3cea94e018caf5634e7ba4532956a3fb74809da41d02f1c1490000000dbc9ddf967cda70d7be2e5ef35660b2b5e4c0c27a08dc8f1f5a671da9133888d0b0fec6d655c819e95a7fe3d44d5d553c14edecf96ca1f96be3e9d884ac68e06552db1cfad2f6a51a8352e215399c8d1230180a975c1183bd9def6eef17af3884fe88d7a914cf4a0baabcaaacdecf7eca4ecec6b66917fb7509690db002870b15b6dc05dc2cc34103055b45a64b61aed40000000ea11fff5aaf256a52b83ff57a3aabfa5d71fbc23d042e62f4adc9c6bd3028e8809a874d77594f4e25a48a870e428b4978c4fd38b6fb79582efedecff446c9b46	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DOMStorage\cbox.ws\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000f845ad4386ac82f16b05a66c0885afbdc723e0339b349b086f1834fcf1fa1f54000000000e80000000020000200000005eec6652e2ebe7ca71a3e348115f51bc740958ab6b8ea4e30a524f50d5eb1414200000004af7651429b1342f67b7cfd93828e31b6e089228d8c2f67f233b6767c398b09840000000b8e78db0d65099657fb655c7bc5c6c6136073884eaaae61075cfd0ee92878e938c1256e726779d48cc85a689b7447958b2a2baa115dca0a903c61dcc18d16989	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{12CD4411-FF54-11EE-86DB-FA8378BF1C4A} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2388	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2388	iexplore.exe
2388	iexplore.exe
2544	IEXPLORE.EXE
2544	IEXPLORE.EXE
2544	IEXPLORE.EXE
2544	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 2544	2388	iexplore.exe	28
PID 2388 wrote to memory of 2544	2388	iexplore.exe	28
PID 2388 wrote to memory of 2544	2388	iexplore.exe	28
PID 2388 wrote to memory of 2544	2388	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fd93215273eef04ca81c585094fc368d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2388 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
70667b80e224baff5fac28511ebf2dae

SHA1
4b3623aa3a4f57b56f3353ebf27a65793c36b286

SHA256
657b98326529ca68623c61d696a58d782fe72768cbbd82f16679c4d96206cb3a

SHA512
a84652700c8b32b627ada389d80956146fa30f2eca11210ca0d7385e317eca01568522656b438f5cdd97f515855f93fefef27aef9b70f2371af5a78c1df08072

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8961e4f02d5c397d73feff5dbad1d047

SHA1
05ab52e275fe05a0ff452b326dc436d02fd6848b

SHA256
dc1e6bc04831a23fe8eb62d1324690c9cdcc80ef4a8b5e5b31b5869e44ee2b2d

SHA512
b553680ec7302ff016150c3f7f9d176829da42399ae9af528f3fcf64c0f6a63f5d600d6c7b046edd5f3f65b91c90a4f2844288b23ca7e23ece327f3d48bea1f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71e45191ea7a0adc228260bd6f575279

SHA1
c0cdc237b86a1cfa0319f6a40f0c519e5c2c9a02

SHA256
8e331ff440e9aafe6c397934582b8a909f8260e2d60abd0a84e4e010869dbc79

SHA512
c975e2cefb8c5c3272044d53aafb07fbb977c9323f9e5bce9e7ce9009b81f6ca83ec453b6919630cec5d98bf1b3ef635a7c303881ca4e3ae288ca221db333278

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ac79be940ab2bc482d7ed54d7df51ac

SHA1
3c06813929d340c75df64b18078e4a035f0b4d8d

SHA256
b96f258f66ff1c34cf3e84f638a5a2b6b2ff9a1e5e48c5b4945f4239f06cbfd7

SHA512
820eaec43a54dff56ad00be7968748ea5b1ef35d9000333c526268dcac9ef04d07c0693529c951412852eef21e9c7618d673c462501bd2905c2dd0f74b0e7cbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
907cfc3f0e9aa6b9f7ee19ff945b7ad0

SHA1
951b5d8cecff2e6a96cb811b8a3cb7ecafe500ba

SHA256
6d7febe4dee3cc28ab42254504597639a206186a78d3c6538408215f4442b822

SHA512
8c49695344615bd3e7c67174699a0d36edcf2d92a0fd5f06efbd123f437f4c9fb131fc2c91f570d447dfc1f530df797f44ab459286732b40b0a4bf41f932e6df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4baf89f8415746e93804f12f38be470

SHA1
2bd3a71182eb41a2ef2056dd41dde3fa240da0cb

SHA256
987e56eb7d8d86daa9997a715bca8a38a4030f59baf337cae5620be332076fa2

SHA512
a571e8d82c6083daa3ff8e6d8ab2321d7a3f8789aa8427da935a5c3dea96c2881f7dfa6eb75dcffe9c53be50ea228c48e4dc1cbc960b78a094ce4bfdbb4b5269

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4cb73d6eb3f0c529860ccd83f0938a3b

SHA1
05c679f31e3d7055f10f1c0e927561879f263c90

SHA256
3efaca6f8ee0013decc9e72cc4891b3636d6f0b223caae6e977d3fceab06868f

SHA512
7a78cd6a0cc242a9a40234fcea1e06cee918823fe7fea63d3b52c8da224cb0e915db5c0463396d2d35e61df719c31e57abb66cd08cee599ca41f3c32a8052ee7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d3203fa60ae6cbda7a6df5d297e733fe

SHA1
d60febbf7cb1ff451322ab60a993d42388d8cc4c

SHA256
3803178bf867316d06e5b24120c332121c9d10127d44a92c66b161bfec4d712c

SHA512
e5cb16c9135c4cb360611751440f1872730f5a14e08dbac9e3bed7fd3880d477ec0d77fb889acaaa42375d8e7adeccf1b80f4c6deb2fe804977bbbd8c40b4e0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85f840bfc6934f78a5897fe92b4a5f70

SHA1
2dc8827f07004d09ddd293d2c766672a3c45e68a

SHA256
8f459b547c09525775e4306477187713813ec57fa7529825e5fa593a30a7fb81

SHA512
6f7774fcfca26d2a554ef3f222edb97b3c6ce4bacf76ec1d55653f9c34b601d3837e406514b6dd6ef51522114a5cc045a1e756b425704d929a8ed541cb1351f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
98ebbef2d033838aff72efcf09bde37a

SHA1
3676c52424fa2d10bcf4bb5026156e2abadf6b6c

SHA256
859614a6059f8735f6c6177180bfbb17c87caad4f0c9db361ddce89388fb7552

SHA512
11f9ea8fbf79609718233b97d0983479f19c169e2a6288827a28ddf8c5e2ebae9f02ef69c0ed5281785745e8a8df02ae2813bbc55571e10a8862957d4daa0fcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2E53.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar30D9.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit