c3b5b5670a4ce73880b80577ed1ba30cda3caf0fea3920d5aa73e647ff46c807

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
12/05/2024, 21:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3c164c7a019d8ffc007a3e72fd74936d_JaffaCakes118.html
Size

141KB
MD5

3c164c7a019d8ffc007a3e72fd74936d
SHA1

c6abae6d50da83c07daf2e56d504928ae8ab1012
SHA256

c3b5b5670a4ce73880b80577ed1ba30cda3caf0fea3920d5aa73e647ff46c807
SHA512

f711be87f2b064a8ff9a214300cf008926895c191f9b9f0d050144a2613cbebec2fd5859b0a01a5a46fd1ea3d08d8ec48a88f8e0c4e589dca24d00eb8df15d54
SSDEEP

1536:SPxESOMcNgtX1Hx76vuyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXu:SY3+9x7dyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7907FBB1-10A4-11EF-AE65-4658C477BD5D} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421710273"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1952	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1952	iexplore.exe
1952	iexplore.exe
1260	IEXPLORE.EXE
1260	IEXPLORE.EXE
1260	IEXPLORE.EXE
1260	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 1260	1952	iexplore.exe	28
PID 1952 wrote to memory of 1260	1952	iexplore.exe	28
PID 1952 wrote to memory of 1260	1952	iexplore.exe	28
PID 1952 wrote to memory of 1260	1952	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3c164c7a019d8ffc007a3e72fd74936d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1952 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b71c60dc5f87a440d45bb7f94a05f417

SHA1
55eccbf238a23da2ee6f166551260c0a3a9382f1

SHA256
167dc14ce790a81f9b58fe72b0881cbc8a0f5203a700480dac53e1acc0bd7c6e

SHA512
ff8229cebbd0947d20c0b8797d0e7299a68fa3aad43b9abacfafcac83a166b343e91e95aad6ad6ce808fc02564faf0fc560134f4e507ad209b5e801355926c4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fca7ae2c287a1b1f3f4882fb52e18a4e

SHA1
4ca928019aa63512836da1300c6701124bfd30e5

SHA256
2f46a07a711bd9296cee9890004839c9229200e8f9771741c0c01264a7d652bd

SHA512
095b5e4d3a3b2ce45a9cf6dccd16899bbfa8619aac44716173dfcc460f918188baef9187bb5c2bb8725dac5e82bb4a0f8db4580a5c6d621c2ebba3601dff6ac2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5342fa28e086a86414de5bd04961e7f5

SHA1
d0c71586745bdf0689a32c16b58040a0c4baee0a

SHA256
82ac364fa1d4815a4af6635f0037c572f40dad5930a4ee5f1578c223dbaca2d6

SHA512
f80f3270277e3cde98e88d748c138b3cbcf28d6e62d0d5857225c97cbf0ed55ad740497cbc7892bcc7941a95f4b4b6dd48b0e24d836b5625919ff1470e5a2d47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4cc3f078b4ad980a57ca9cfe1b68de37

SHA1
619c8297cc2970b7556078759d77198071375531

SHA256
ea320fcc1a573dd805e5c83bd6da3500939c75cfb3b0199e390a5bc7a65cb130

SHA512
9d9c1c48061f4103c3537c48d5afcdef33a97e9cc92e1d070f04fa7d5a10a1c032ab268d21505ddae4e9b11b69025fb17985780c16eb7860e8f8c6256875080f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b03e73ac85ea161905eb652097f11848

SHA1
05cc71027d8acc793cb5fffa29959ece36c61768

SHA256
e67b302b2adac5cca13eda706252049fe5af86bb12d0f818f63fbcb0fa05baa2

SHA512
d6b115de875894f241e068d3d826a2867abd9442162724dc2ebe004ac1091e35c66b7088539607cbe4eac1708347336c395f2a400de726ce23c1f875f3662f71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59e9e043f1fa62326635d621e357ad3a

SHA1
5c0390e584951e43d15b6bec1ff003f1e9b08b83

SHA256
f293ae19dc12ab641ddb6b2370b1eeafd822700ca3345dcf1f0ad3b56287d188

SHA512
8ef0deec72db799fef0322e4a68b58a4f7efb0c6ff76246ec93a2ad676dc21c11f3309edf65fadf5c555d06d63d0f322ee39fbafc62088bc3bd7413065e73e90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e737c85b92de8ef0245ab951e622847c

SHA1
d57202b6b40c8adc8e208f60d272b981574b64a1

SHA256
a260b9dbd3e3171ba116154897bdff8168ba5c895aa92892cd4dd12369705598

SHA512
257700437d134a95159b4d415b1f7568ff389876bdaacbeddd12b29ef6bee735fa0252808233e0f6acb4ba8c51d430374eca19856f298a9f325c575b76d4cb77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
436f89ded2e7aae3ecc5a67fc3fb693e

SHA1
08b72b50238c5ea35845e05370b119d7cfb88e9e

SHA256
b43450141e14543f5617ca796d5d939756f5b8dc673d95e8668dd8affe528e0d

SHA512
d61f0a5604d57a4ba0d71498a135cb0032b98c6f527c19cddad2b44f75165c16a7bc9fab010f6a7cf589167e35755ea83b920358efa50632a0ee3d940427a14e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40f6e92bc87a9d0e1fdfef7b4ec2748f

SHA1
7a3bb69033a71d67fdfc25bca773dcdfd1453503

SHA256
85f40e5f1a0b4dbc62901fdba30b9e5abde3741942bc115faa2ca5376476eb46

SHA512
8b07dccc17eb3c26b52f1884dbb56d6833466f81606b97d9c9ba256e80d875ea23f9e4eaab4bee340c19fdd1425d7c781d051fb8ac3e101710c4ff72ed2e59f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab16FC.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar174D.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit