3c3da07160ef8a75c1dd9efd6f18ed55ff5dc56ecfa954c3d6471ad1b15bc6fb

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/05/2024, 00:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3d299fe43f93326f6867648f3e42944b_JaffaCakes118.html
Size

21KB
MD5

3d299fe43f93326f6867648f3e42944b
SHA1

3f52b87ab1c43015d773b9a8c6efa069cd828ed6
SHA256

3c3da07160ef8a75c1dd9efd6f18ed55ff5dc56ecfa954c3d6471ad1b15bc6fb
SHA512

a86d903bbefd027fe09b38393ec712e4c28293be10b08ec26ea635ad1c0332196b0ac6feafa6465f693840d74d8b775bfb7180ff5769b8d33feb41386b9b1040
SSDEEP

384:SIkfeBHk+Gfc+4KKzkgRpggg4vpEGpzneB6pKvlZuNM3ZOza9CAPsqzC07twN4/7:S7fSDEezMZlPCzW9fpgnVR6

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421811583"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{59E98631-1190-11EF-BAF4-4AADDC6219DF} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2856	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2856	iexplore.exe
2856	iexplore.exe
2964	IEXPLORE.EXE
2964	IEXPLORE.EXE
2964	IEXPLORE.EXE
2964	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 2964	2856	iexplore.exe	28
PID 2856 wrote to memory of 2964	2856	iexplore.exe	28
PID 2856 wrote to memory of 2964	2856	iexplore.exe	28
PID 2856 wrote to memory of 2964	2856	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3d299fe43f93326f6867648f3e42944b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2856 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c93d677c5fe7f9d616fdbbf5e004266

SHA1
ee19defb0d4bfa78472a8f6c4e980be8293dbc56

SHA256
8e6fd1245aaa2381bf24af3f540d56df3182f4ad6d149c7e6346d16d40f86023

SHA512
9ec9310743223698d084d94db09cc52baf176de819b0c5b9e1be6f90c6b8a5c82fe9e86570bb535a962f5fad2d11984ea49b3d73691ebf96f9b5f11315224ceb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27a6b72f1dda512955aa6eefb403eae5

SHA1
a090d95d2dad04b6ad5ecbd1b99a7b9701269722

SHA256
921ba4837c50f778e9d0d6adf0d5a7f92c23b5e1be8a9ec0c1148c11a5857683

SHA512
3c052df32d8134ceecaf4243c369717e5b144039d3803bc6a92263b5340a8452c4cd4d9e41268687e380c05acbf192d94c7fff141eba724f72cde83e05a9724f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6409fa111765e65fbdfd92114247df89

SHA1
2a083433fcb082481c24d2c8b77929dbaee275b7

SHA256
efb97a1e441a232b2fd9949eb98fcec3c64fb71a02f13218e4ade12c816b3c0a

SHA512
eabe129b8c70bacbeb5ddb771124041c69cbba572fd1bfc78696b4657ff00d5aa75a9e623e85bb8e2ae7c10cc6bd66a5ddbf51e23ed6ad06bd38c2a702219ff2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b370b9ac13b070a680416f3285f8758

SHA1
b7975e0d062c5922ac2e28e4bbc209d7ea9d57db

SHA256
a5c26e39c3373a1a9d51b3716157ae03cb09eb0d79bdaa10b7e0ca39970d4cc9

SHA512
4269d55f9e10e5e4f32a85cfd60ca8158d70a5365371a9ab3d619958c064902b9500cb2100595a6089740ef83bc186fdd2deb53df6d8b8bfdc94c03fe39f28bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a144b0a79198e5834aa000f126eb34a

SHA1
b83cf99846911b6725efffbac2c378bef1b49f0f

SHA256
771c4f5075ec7931080c26ab69b0efb4817f3d2a4f0dd9859c67186b8243f3ce

SHA512
a34423d2692487ee44a0b16c63dabbd3a5ac3d8beb211ab99a68493433796dc701e7149407c154f9927e110131bbf8c34c773c14c10b780cfdd755fcddfe3a94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78ab8bc565f21b8545c5668fe7c9dd52

SHA1
8c7523c6495205fa66a2d3bfbd6fe1dfbb5ef617

SHA256
0a58271956035d94ff380f78ac4857a38b61190f7607c8bb6a7d7accc6629c97

SHA512
ab4ec083d97c2acd45b5b6f4c98c7e644fb5140f311ba6bc59488c060ee0242fe96dd5a95ed45d27ffc28e0aab1f6c60b0d830b545fb6c1a96c992d739eebaf4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e25bc2b1042436cebb0b467bf4c10716

SHA1
672a607b78aa1849bbb433be4a653d4271920cd0

SHA256
30b6e696de69f112e8ff1b2dd6ba7f845140c5d1754336262f2407f9da826ce1

SHA512
0611111b00dcfdbce19184aa8810639520c1821b00f7b0bcf727a628fa46a32e540cb83c237e49e3f488d8a8e6bdbab8516fb92ac9bc439ff9115b2560032dd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3fb108036614ee67d048c40bc375893c

SHA1
44cc0755a2cd3cddad1ba7c6c57277ff007d2dd3

SHA256
ca72629b13534cc24ec27663ac920609c482d28f8aa15db1cd95c9115f863704

SHA512
f74305fd9f31a64329f826e8d5cf2c7be25337d05d52fa2ea5887d1c5665d00a7dc635efd05cef9818b5da8ad4dc62ff3e77c504a9ebcb69ceb5119cbec5cf32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5efba1deecbff0d5e0b923e53e936488

SHA1
f783c11f04e5ca1127bb6ae414217e237314959e

SHA256
ee9940b7c672f3064ab1ea9f1154b81bb0e54972cb95779b991892da0f3106bd

SHA512
46928840e78a74385149e63586210f2d54a2731cac171bb7ccd418df143802e5bdadae08e05b57abdb477c2c388dc42b233da21510a8325f05fd31742e71aa61

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab258A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar266E.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit