2812eca559df30def213ce343709b34ab4a1016e2e1ac942356685ff450093d4

Analysis

max time kernel
117s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 03:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65cc450910b81d662f22426b1120feb9_JaffaCakes118.html
Size

111KB
MD5

65cc450910b81d662f22426b1120feb9
SHA1

03278be0bf5478473c8a54336a16446f1b424c1e
SHA256

2812eca559df30def213ce343709b34ab4a1016e2e1ac942356685ff450093d4
SHA512

565f3d6014a4c98c0a8743bc8ea05e42aeebc28c9af28754c0f1871c8778e0f6da00fc3db042f75a3406c7496e3b6eba2ae7859f37c31e22b6ac0c346af76d66
SSDEEP

3072:i1Oh/SSodbnckaYJNQMcZf+fRCqw43e+srrND1r9qA5D:rh/SSokjZb

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

14 sites.google.com
21 sites.google.com
22 sites.google.com

flow	ioc
14	sites.google.com
21	sites.google.com
22	sites.google.com

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000003aba638d09e12eaf38e5664a98488c5321d0f0f3f956aee8393ac241731c9180000000000e8000000002000020000000b2dee836099a09e5fe877b4185b4e6e2f98c04e35ccc846dcf349921e81f7ee6200000004bb3d8a609ee1b95d34983907fc5a92eac7b40201c4034a3e46b6d96feeb4bcd40000000b172448024ab3eebc701271223ad3344147ddb5d90c44e8cc9d7126228345a5e2578bce46a40566e6e09487d5e1b5013fe28ebb735c347ae828a6601ffbb00a2	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422509059"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000004232af97cfbda221ba5ac25071e942bd1ce6677203e54bba95e5af1629e79232000000000e80000000020000200000004e30d65a326f4e0d0fc3e18aa1dab76a149d1036fb54c6c553096c458aa31d6090000000acc483d3877c0537ed147398985598bc790bda5332759263264536bc0caba65a2aae0abddf8903eeeba3ba09cd8394951b1a8983ccb4fdd3af1b6c1a413f6e7750252f650a2af8765df4385a5598ed521f7d80b1daa2232eb0fcf1be1689d85d1e06f02865426dbe8d350e7f91a57dd35ad66ca66cecac53f12984ff5ae8d3b0fc131aa1198646595d3ec4c3a3ea985a40000000daf860b4e509f258d6ae78b029bf7b2f80850bcf167c6618bb080e3a6158efacef95d2c26365dbebadfeab1de515dc74e5c6b1e69d92b5d12af28366c57a2de6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10d3462bf5abda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4A952AA1-17E8-11EF-B6D8-6A387CD8C53E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

IEXPLORE.EXE

pid process

848 IEXPLORE.EXE
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2228 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2228 iexplore.exe
2228 iexplore.exe
848 IEXPLORE.EXE
848 IEXPLORE.EXE
848 IEXPLORE.EXE
848 IEXPLORE.EXE

pid	process
848	IEXPLORE.EXE

pid	process
2228	iexplore.exe

pid	process
2228	iexplore.exe
2228	iexplore.exe
848	IEXPLORE.EXE
848	IEXPLORE.EXE
848	IEXPLORE.EXE
848	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2228 wrote to memory of 848	2228	iexplore.exe	IEXPLORE.EXE
PID 2228 wrote to memory of 848	2228	iexplore.exe	IEXPLORE.EXE
PID 2228 wrote to memory of 848	2228	iexplore.exe	IEXPLORE.EXE
PID 2228 wrote to memory of 848	2228	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\65cc450910b81d662f22426b1120feb9_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2228

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2228 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bac3f6f7bd4ee682dbcb277e5969224e

SHA1
013fbc9eecd154b3bcdc546ffaec21512c3c42e9

SHA256
3999baca24174ce277d959890b6b88c0bd8e72376033062a9f9eb3a42af4299c

SHA512
e34d58dcd77ce31b4d5e4fa5739ef67d639a4d76717595ce7042542010d42f627c7e28bcb08da757ea7e2afa7b099f3a71d655f53a9d5769c104b26f8ad74347

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
512eb8fb248a97325fa00c0ad83cbeb0

SHA1
e4b6486c71ed23417d4299df8452de95b1d3e8db

SHA256
707a078e9da501985658c022ccf4c74f388c81ae4c4b41f4b4b75a625bb6cef1

SHA512
23449e5871941620e576bf238f6693e42afadbd3c35e7abffea98381967a02a9613273b07fefc99906eb48ef4cbb358416b3f31c04c77343ac46d538c10e3099

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
015e94690704ad653e27688676af4aac

SHA1
4748d1f835559ae82b4d784cd6805a04869b9129

SHA256
c96762e7f9dbf4c4056b3599920d6aaca4f10f869751dcb940a5306c0f4ca9c2

SHA512
20c8c65d8dacd6a7204f1c4577270ec1e0ddd67798dd87ca0e65e5e8be3c67426f98ee0963e9e9cc0499911c25d696c1e6783cc7bd40182a7706f30f6b677a95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7fc6c3c92338335325309d651caa3248

SHA1
82f2ff1a8d96c0f90ab5881a8e2788931a48ad3c

SHA256
6b2a91e7fcd343d648439b96eaf0025d0686e774f777a35bb5347934d81b4eb2

SHA512
66a02f4e3aed423ae327e2cfe63225cdcd9050a63d23a3065147ba06d8e2f762f34db1bf47a3dab3eececc287c2f3a6d2aee1abfb2ba1f7c220a665fe56cf697

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7011244b1ba01f117da7b77325e3ba12

SHA1
7515d8acb9cd1a5d871140ae333737cb0f2382ae

SHA256
ca016a0b127ee5be5a12c77c6943c67dc8d5cece0dec69cf1a307c7a2c3ae87f

SHA512
57d7b62620f735b9566e91acfd0e00fdee07805e4f4ef2baf953eb4fb2b6c554be43e25b4bfa562c03f32aae3612b551b51d625a8e7bb2adce4a397af66026b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab0e4b6f063c97cd4c367a60e0a52a84

SHA1
919f33db46d5a4bc474638d65b3ee9c9981b3267

SHA256
bd83aca86b83b13870a4acae2a22d83164bf2c151e0a4ad128c60abf71223b64

SHA512
d6bee65ec7aaa2a76fbf3e976f061132c9ae0c53967f6cd6abf19b8e2d1919d762b0588530a4cd93fcdca282eb2d6988bb3a73e1c921448a72169d6db0ee6aad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
584608bbabccb6fbb6479e0b2e543cc5

SHA1
8a93f36da7e1ce486bbd2277d361c43224bfdc84

SHA256
ce035aa2c781b058cec9ce908b22d46dfc78fd0bceaa128e1d4ed7f75750464d

SHA512
6e9a8b7bbef56ea878d5c370178a036a3d0695a51c75c7ff9506bccfe9726bb0de699f142bb8f8897f43aa15e8fceff642423ae3c7fa186e32f9e35bd5a2a294

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1602ecc0898a02961a54999bff944d23

SHA1
94f2964fec07cf7857bfa4f512ba86f8a1471b3a

SHA256
41a9e14c9227f9158285d719c5cbe14ed736311292d96c4e73da931b83516ab2

SHA512
19ab045f95f2b6c0f2d2d552d883507253eaff94967a8a8a5d55600d2c2b3be78eb7adc04b7abda79faa28c79440e4e5eab4c07b0eed1d654d2d0242e98e12c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dca4485f880dbbe38f2d92b89588220d

SHA1
6c787fdef9cce08409b2f2fc4281964464b02abe

SHA256
7c82e643696129ccaeecd8b12ede67f627854030ad9a03f64e504e14917b0a93

SHA512
e49c803d347e0f52652cce1c36bb28981afd898e357eecb1c47a2dcfdac2af5af51092238bc9421969d809a0b13cae096105b6e6e539eae4449509b319a4e7f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df6a75dfdf6d2b9411d6b2f88f50c15c

SHA1
004c301702bbd720c09efeb1c07cd3c33ae87492

SHA256
8a3d61e28ad9eb476b3657031aea2e259545e5bdebc6032b329600fe3b525048

SHA512
e7609eb29971d7d123760beaafb5465e746a2d73ec3eeabd6c2dcdf3b88781f2c2f86c1a3c69b2cd7c750b779e12e4333f7cd200f90f6c1ff37525850467c86b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa9c864d32a759a4d9be4fa7aa656286

SHA1
32872367437bd5de3dc885fd87506e8c272dac5b

SHA256
8c98a7ba6efcbe4c23d7bb2416b9156ef3340437da53ae49c83dc833ee02d45d

SHA512
b6567508d23146a8e3049a4d066823926b6f744ed84170ab1cd4c7e19a1fa4c41eab66e203455af5c43f7b848b622f82599e6e0ffa8d6c7605570abd2f10bef8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8078.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar807A.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit