c6502198983ebe560051907366088eb77ddde437bcd3a126a4cdce1d751228da

Analysis

max time kernel
118s
max time network
138s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/05/2024, 17:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b567d05222dcc14562211fdda1702bf_JaffaCakes118.html
Size

229KB
MD5

3b567d05222dcc14562211fdda1702bf
SHA1

37e610fd71bb6994d9f93443fee785fbe245ae4b
SHA256

c6502198983ebe560051907366088eb77ddde437bcd3a126a4cdce1d751228da
SHA512

821b38dd4418ff81126aeae1a840cf359a9f983747fe2e0a36d2aafd08625db0d04a35cc015b0221aaf52075398bce657444d6ea32355731c988c4e57aa64cc3
SSDEEP

3072:SCnyfkMY+BES09JXAnyrZalI+YuyfkMY+BES09JXAnyrZalI+YQ:SCysMYod+X3oI+YLsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a960690000000002000000000010660000000100002000000089c2ebba75a16822a2272995772fbcccd82d96f1d1aea43a6d4c350545b8434f000000000e800000000200002000000045af46ae9f21c56ea6e88a463ce0c6538bb308bbda0314f536908ebf2315e23920000000683b11ee214f7c856efb600768f8157b64766e3764d42fdd7b30ee43957345bc40000000a5e51d2d0d652a9f0b7360c997b55d95e856970d1317c3e655147ea947b1e4d43c708d333ae8afe682ff8069cf336b6cd82c457d5e1d5553b76f49f32f230e2d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 105e7f9894a4da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000f450535df833d7a13aa58b26fd85a4349a2a9130081fe4765db515e38a904af3000000000e80000000020000200000003335f56204a62d5316835d38f8cbafcc163aa9a2e08ea376269449b30039d93490000000fa4ebbbfa51203be9f60bece9e78fa6c62e2d6b777fc7564144d44400e2d3ffcb67bc1c56b6d19464861afb08bb6f695ca275c2c71268d57a1a0973b9608368e067106219a24ba6986b593a9bab6ae187a46af3a294a560e5aa3226c29753cfcd09718cfa936af6a5b4dc85812a8d81bc3a098c3f56b7b321114a465ae351af75953bc8a5113cd7272325027d241dba34000000042d1126d56da6268ebadb49e8f9097d5c6751924a68c74c4a0e2932a29e6bd0f842d8de012d3e600c72b51e7f003728f3ffac5924492703d629271c3cb86fc1a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C3CFE5D1-1087-11EF-917A-EA263619F6CB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421697954"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2884	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2884	iexplore.exe
2884	iexplore.exe
2908	IEXPLORE.EXE
2908	IEXPLORE.EXE
2908	IEXPLORE.EXE
2908	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 2908	2884	iexplore.exe	28
PID 2884 wrote to memory of 2908	2884	iexplore.exe	28
PID 2884 wrote to memory of 2908	2884	iexplore.exe	28
PID 2884 wrote to memory of 2908	2884	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3b567d05222dcc14562211fdda1702bf_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2884 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb09c9d304051cddc7ea375e172aa7fc

SHA1
cb6114432020d7bc7b8e0b0f571288b7157438bf

SHA256
0a847469e7f7106d5a384cca5d0cb021dee4e5beedf62d364b5ab4f18e62b2c1

SHA512
589b20052323be3c9441d7c3ebc7c8d137dad04602a2a4ef2f1c6c12097ba761a2558f92cf3544113cb0db4358320e3677c4b1fcf23c7c456c4f39b0b5394abd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5fedab240a4bd965c740c09ce0f27399

SHA1
f86b039b00ce0ed57b3c6d34a6fe1f6c99788c5c

SHA256
60f754c96fd63263ad0d9b79a5474b69ea1e90924617dc8993dfa283e8136aab

SHA512
4b12372ca65a83a0bdd2dcafd45134706b18413b62f83b8adaa6ca271c3ec868b67ac259572e49d5d5badd821ab0cd5a5185dbe28a9cbbfbee2257d156de32d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba3180d851536e9bd58a30e3975eac48

SHA1
3a7b5cef4b066eee26de58794731717344aa238f

SHA256
faac44d6a6378081640bd420a741b0bef49d1ccd7ada22ade91917e22ecb2145

SHA512
a5f580deff15dcbe3904df826d2e0ac66698160b692d0f5aecd105e37d6ca45ba5510badb6d94753b60c0d19ced21c996857214bdafffbe93142c2e9c7e3ede5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa06fa2f85bdc190cb86dbcd9d38a9a7

SHA1
e57e5c24f8f3dbecf6344abd7b823fd2a21519ae

SHA256
65616d526126ee32124b69ab54d76cb13cfbd8377cd3466bce2eb6b76ce4c840

SHA512
5d03ac3ddb0cd27df9122799e330b6ba9b6f2640b766d6f7f00a6ac8e8f2d2158fb2cf88a4ceeb1823227ee2f9c9cdd3a01adf4790e937f5bee344af95402aa4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ffab74aa711d32b36fac9c4f734d479c

SHA1
00b3f72d173c8608ffa8d91ae3878c0142781d94

SHA256
2f78e5621341dffa0ba30b9f5a81b9330e83f24ebe6acd068a66115ad242656e

SHA512
af5f9f2ca6b38ff95e391f8e83d09ba8f079383df15ca885514d185395637b3a0273f6c7b55b982099c604c2722fbde6b222473e88cc286112e6c3833a76ed2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
731f9ce34f7ba5de0b5d4db75df3361a

SHA1
f282b871d23c7a4084bb621cd08852331a1719aa

SHA256
bd46aa2f240481148239cc387f59829406fb3af13f0f41f8f474e6a9d29e0e6c

SHA512
e8459ed2a26976d3d5b65a3c4db7a4eb0d9ef57f0ae30b1df2e9341d28350927bb5856d82f395daa40197ffbaa02d29cd3cf2507ce83cc419385e4bf0aa0e321

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d56471b64fc36e8eeb095303e839882e

SHA1
0ed7e9950da23f9bcf175b1e6c486f8dec16bef3

SHA256
30301b62caea6e371c4235c664e360666c8cd458c8888c3eaab08288b57c7af5

SHA512
882a104d457049396012a4aa4078cd721d88923f3979d9bf80534c6a7f880d9a1248bfcc001a640e21a3d372194bf95118c9db8500d13ea2c1d43e11733e8d57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef5698e92388537afa725b6cbad35480

SHA1
ecf1b298ce7bf9440a9a41d3a8601a6dce83bbce

SHA256
7219898140d8c6b2c5380028431bf87e91263cd3f95259f7275cb9d296784410

SHA512
aba0be03f82375c26b83cd0a6b9c5f7e1fa0a91ba018e012d512dbb599a320184cbd25469fc50a704146e38b431f74587ce94f7768ae36800794d50f085b4d51

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7B6F.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit