c63fc3a25e116282c01db335ee7cebf5beed9c39861097b1a077dd861d977639

Analysis

max time kernel
134s
max time network
134s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 11:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3f3ec1065159e154985c41bbd57fa604_JaffaCakes118.html
Size

73KB
MD5

3f3ec1065159e154985c41bbd57fa604
SHA1

21efe81db3e03e3184717710389e8868a2de55fd
SHA256

c63fc3a25e116282c01db335ee7cebf5beed9c39861097b1a077dd861d977639
SHA512

cdb5c63d0bb3ea68a5730112d5e2c3d1fc2169a43ddc047b35aeeefa0b2c2b0b14b578d8c3d615d2578f8ad718a83985dde820ade7e5f0d9596ff1afe403f761
SSDEEP

768:JiegcMiR3sI2PDDnX0g6sm6S/LHe3yWoTyS1wCZkoTyMdtbBnfBgN8/lboi2hcpq:JG/ynTzNen0tbrga94hcuNnQC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000001e61ee36d0092dc0fff05caa6c8f7f9a1f5b73ec7532f3d72d0508b1462bbba4000000000e800000000200002000000046051d88a4be5ff4fed33a398cb6a6bc21dc29a5b04f755a8676ad45676b1a6320000000bf4c8a668b0b8db4ff635896e0566d25d096a44e533cac27581447f7a3800c64400000009c3d7e560f42ee6678fb4f97addbaa50284845ba9762676ee580a3636fea2b8cf500bf6a3f6c96d5a15e655968f1d061602cedb1a692f92bdcdaf50d659df3e2	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 501fc75128a5da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7CD02661-111B-11EF-9C59-EAAAC4CFEF2E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000c2eaff7a38cee5e07ccce46d28e68fb023cc3399c36229f9ffc29195d87f8100000000000e80000000020000200000007d1edd81995712130c0b42baac15b9cf53b5a5c1b0d12888c10b0256f589be1a900000000bfa2ee9aaafdbf797afa8663c6d723a554ccc8e2f4f6928c284cc19f2e590a48a95d44ae0276a39a692d8e3e164b0f96798b41ff39eafc52f864b3aea09eb892094048cdc4b654b05f327aeb8cab7a85bce1ea75da9bdedfdfa60425283365db0e748f94f8b549d244760de68d4261a0f741099acc23d853a801b1c54530dacaf0e3df482fb61701acf4e3bf44045de4000000060d061facaf797f2c276533fa6373644c110e8fbc32f7cb264aa33ec564afcf658a94f11193cf1132630a9ad4fb8a8cb53b496ac73141861f82bfdb824cf35dd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421761392"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1100	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1100	iexplore.exe
1100	iexplore.exe
2300	IEXPLORE.EXE
2300	IEXPLORE.EXE
2300	IEXPLORE.EXE
2300	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 2300	1100	iexplore.exe	28
PID 1100 wrote to memory of 2300	1100	iexplore.exe	28
PID 1100 wrote to memory of 2300	1100	iexplore.exe	28
PID 1100 wrote to memory of 2300	1100	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3f3ec1065159e154985c41bbd57fa604_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1100 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d4022ee577ce496c3c8f974264f1faf

SHA1
c263f7657079a4fd6e76bf294248f32945f47777

SHA256
98b2ec5a86720423c5890a000cbdc77f0adacd39a21b4ce8d653daf568a333e2

SHA512
3f004106c3103514248a0491dcf7e0b3d4f8ddaa487b34ddc40aaf803e1ea88b96542ac6b22e3b89b6704af02c670287ecce57d8bf428671c1ed5afb107aaa60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a43d6de8c2d4b557dee88d1a7529474a

SHA1
2705caea8b4178471afc866ee7a09ca557a26550

SHA256
2c690aa0b68cc9fb7cb6e16c7dc77b035f86b185614f3b16b48b8643577a4e4c

SHA512
1d1fbfa34017b0a53149aee6faad24cf5663ac754c44f96cfe556ef3c07415403f03d0e05d4d89ff5b2daa2cd212ef09850b36aaa3c3dcc3ba0d0096d7cabfdf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
09dc09139a95f4a0545dbf3c17575f99

SHA1
ebee6185e51f9d32b0993c14a16355a563f232ca

SHA256
bbd304c369467b2b5ef2ef9e1ad54155707e4dff60b04c7d1496a63ec8a4989d

SHA512
be48f8fd0bc98514cf2e11c24b2bc8fb0c910591fa73d7e6a3c04c2d7feda0e13199c1ff2089ef750d551da9ed31dc4ce74f1699650da51d6ef38d687d115918

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
027121ae0bc40e7ab94095bf31cb79a8

SHA1
9e5224a69bd829cbbc67be9e5acf54b24cb257ae

SHA256
223c9cb8677fa32a640b80b4881cfedec9686435fdfe079674f50d8bcd3e27bc

SHA512
8e016b613aee02be712a30c6dc065b109044c536a1057ea517e4e45e16ee97df12cea3a0f2203390e51b764c36505dbd4282ddc4b1e1b4fca0359449ba9e8ee1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
980827459231ca929c33003bf015ee83

SHA1
9a135320ddcff854b95c569f5070c94196929b80

SHA256
6804886521fdca4d8bf778a1b9bf9064e08128448437798f494ae6d47ece53fe

SHA512
e3bdfe17bd410749db70a144c42fb102a607e5d28f4d73c32d26b8a968640e86714d517dd46a2bb1dc9cf140434a65f0d04abce88a8e2136c08dcf7c43846899

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75a1134dcffc002c896259c79000a1a8

SHA1
13c7a5ac97694af375fd3eb5fcbb2985aa651bcb

SHA256
f13a7693b9e0b40fe78174d74ec7cfaa692dc3d5cfccd65b646162a0d121c4c1

SHA512
3d1363c81279788ebf63551e892bf65a9a495ae6ef8a4b59065a91d99103c8217b6787ab7a44a6f84ec370f58bf5ba2611472e6bfccdaa6c7c8db288913033c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bdb209ad0a05aa026a20d2df494147fd

SHA1
47d3c652cfc6df9d1e6a30fb0115f3a53f93b526

SHA256
494990080b88368f9f351997594e7035fb499d527afaba79fa9ab83cd11ade8a

SHA512
1ef394f24a2c607aa22e5a26ddc900394667c220715ef078c196cb6933820f245ce56399daed573fe0427423b8e8802de6a3f909f41914f8ad5264ddf8dd8970

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
171560258463e7a5dbbf8b1bdd17c1ba

SHA1
4eb349ee67c46fd12d8695cd2840df1edf87f29f

SHA256
3bfc632a0c60c0599a0a693378d643246869433c8b2903148b45381b3c971185

SHA512
910128b996a7a039732531328c91ff5599f26cde1267779368a49c4f3880a89d7b0e18db668aadd21ff73e4dffd53aa6d22abadcc93ff92270d10280b42ea001

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eed19112a66ca398961101a5b0c723c2

SHA1
2eb5998bf529268a56222a58629dffdcf30de960

SHA256
fef6374b265d5d0e9351edc0c86c171eb89217e659d6aeab2514d8b2d5f1a5d1

SHA512
b087e78a7611dd0c0539762eac804527ce0cb46390ebcd3b1d3d6f299fe76f089689acf818084b1d5115b93ac053b914c7b4f1520bf3fb98a157bee78cd40ee0

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabACF3.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAE63.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit