9ec3cc8a0095efb603de959cfa1e4608c9b91d1cdb268425bc64a700f6b0dbd3

Analysis

max time kernel
150s
max time network
156s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 04:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7bad260a4372fd52a2693f6dbc116924_JaffaCakes118.html
Size

27KB
MD5

7bad260a4372fd52a2693f6dbc116924
SHA1

5c41a3ca1c0a4951f26fdf977d283cb7bb39cce2
SHA256

9ec3cc8a0095efb603de959cfa1e4608c9b91d1cdb268425bc64a700f6b0dbd3
SHA512

4864ba7d3924b5f0bd1d03828f7ffb552f140044a139d58e8546f933c18864ca460e387f006806a12be484ebcc650f2921f6dc437316930201c2237613897dd0
SSDEEP

192:uwbIb5nlunQjxn5Q/InQierNnxnQOkEntcGnQTbnhnQ9e7rm6lXtbQl7MBLqnYnL:EQ/VS91tiSduA

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{76678041-1CA9-11EF-9667-569FD5A164C1} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423031832"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2772	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2772	iexplore.exe
2772	iexplore.exe
1616	IEXPLORE.EXE
1616	IEXPLORE.EXE
1616	IEXPLORE.EXE
1616	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 1616	2772	iexplore.exe	28
PID 2772 wrote to memory of 1616	2772	iexplore.exe	28
PID 2772 wrote to memory of 1616	2772	iexplore.exe	28
PID 2772 wrote to memory of 1616	2772	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7bad260a4372fd52a2693f6dbc116924_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2772 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
604787e1536e55ac6108c915658a3601

SHA1
6fccea9ca7fdc9a1c877ba758dd5196c84136452

SHA256
be421deccc64470351dd95c9c3366f52db71a4fc4a6df465c5144cf05ed9e8bb

SHA512
98fce4cdc0fed91565dd6b2437fcfeb23728a68329d0a06509b9ad48bb2fe65dd9444b2ffdcf682b8f59b2b85b7a3b85c49826f703a098fb4b767ef0e078fe9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
54a49ad6222602b9d37003e8bcd92007

SHA1
70769be2771f631243252b90efd0dfdc351739e4

SHA256
65cdca9af72aed65e1e61803efeb0dc1b906949cf784a3b22cab94695fec966f

SHA512
9be7c47f9369b34a7326581e737e86afcc09821d3b207596e7049f6b3494138f697ccb5cb7dcdb9242b424f0dc14fee5c70c0bb3c3b72a3d5e9607ecdba635c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
61b952e8c5db2ad66a716a22998ecbd3

SHA1
5c2e6a1dfb05f558187fef3df124cf21fc6da9dc

SHA256
9af8b892342cecc103d91246e058437abe9a5e82103af297a14a938dfc42e221

SHA512
4d43e0fa6d2f22a0d334aa30ebea41f119126323cb95ccee4f4f394e1a9f0843041f5e801814aca3e5239c5f8169e97f7aeaa4a563a53c20c3d8ae09f055a6b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b2b4eb951e3288f968e361eca00d9703

SHA1
ca81b2eaa20ff02f4dc5c250d3f3f148633ed1c7

SHA256
40676548b21ffeb5f4f0430960f0f649fb20aa684755147ef0d65d888f41c640

SHA512
1123f1d30277c7e7dc26179400bce84cb419369d99f0127217678e19a2b375cfd5086fa249c4457f95cf869b85aa71dc65de7b2ac41c2753bf9eb60a6a864f84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18dc3e476e5a21d159a04cdb1e52a3f4

SHA1
48cdecf492c6865056ec8dce9a0c3be80eaad2ff

SHA256
67d64aafdc553bca8f761935460f0e1865db379c35cadba6be5e5162257a83d6

SHA512
90eca7e43b23b224ce8069c422942a717ee1bec784c76a3f52599e4077ec9dd246282f3d20ac9c26b640335149c21c2abc6fafc4406b3e7cac4654ff44c6a29d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2859a1da94c70f44bce9156925169802

SHA1
ae39e40b5d8bc7b63198b803514c1b6a1afbd466

SHA256
2b1996cb7453760737550ad0479e66fdc786f8273ac062f493e47395052c3049

SHA512
f3fb254441f7852178a67e05d3ca37b0605862d66dfc57f83185eb4d9621b7561f0d0f4d22e2a8de1d50a012376014dc8b25ba575d065c24c9aa6c49b1122a30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d7ddd0fcf77ff6a6e6c08a877ba512c

SHA1
ee02ff5a65d64c2baaa4fb63574b7aaf521f3bdc

SHA256
67cbf95e0688b579542196effd25d59b097cc4dc92f81d8c02473215d2ab9e1d

SHA512
074a7cb9f0f310dfe0c50d917c029f4280a66a140ab8680ad7f89b5c769b5852e99689f5a08f2a947af18b414967d52b5fb803f2084e11ffe9ddbd559ddba925

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a0f7a7b02f1e17dfa42887e522299390

SHA1
82a9011ae665f801f4254057deb8b609703acd21

SHA256
feabf257a420b5fc18a968d99cdc4e3c8f6a2110e3a8e107724d4e68783ee0da

SHA512
4fa62a7e962068d0b49993087f83524024b388766a9e9305641e1935616a5d670ff3004834ffe41be3467169678495dfeb4d5ca09e02b617797e1535211cbee1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d62e760b464a42f2b229e3c1be35f0c1

SHA1
f01d1bbafe4bd1a84b9acdd884565d24625bc5cf

SHA256
ffd3515808b8bc95ac173858ed2e1b48709d3b7adcc760126a1285f55e798f23

SHA512
66cb8ef710748950f1c94e222a50b605260a476ebb5a20597feeffa9730d7ce3686d9c282f7cc147d8d9d165a8a46622878bf79590f7d7685df4bfb67d57aee6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab903F.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9170.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit