6b77c7836e7476a50c75a0fff9b08c56e88b0273430c4bbf25916d58ff49a77a

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
28-05-2024 06:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7c01130ef557e0e9831ffc95a39fd044_JaffaCakes118.html
Size

238KB
MD5

7c01130ef557e0e9831ffc95a39fd044
SHA1

34aea9b69f68b8584a08fc458b7c67f9e28d907f
SHA256

6b77c7836e7476a50c75a0fff9b08c56e88b0273430c4bbf25916d58ff49a77a
SHA512

6246fb677b50d643fe61fe95b7f92e89e3133f3093170ca582b58affff602c94e3e6f76d1ce970afaf7f1d39fba5813fba9a91bc7f90aab5a45e70de254d5126
SSDEEP

3072:A9cp/XynlWy6jrMIcYPE7mM/UOWMPGuH3sIR7IhCyvxTGHgo/xx5UWrmOzqwoy3n:uuB6

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F8B142A1-1CBA-11EF-B21B-FA9381F5F0AB} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423039351"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2408	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2408	iexplore.exe
2408	iexplore.exe
2980	IEXPLORE.EXE
2980	IEXPLORE.EXE
2980	IEXPLORE.EXE
2980	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 2980	2408	iexplore.exe	28
PID 2408 wrote to memory of 2980	2408	iexplore.exe	28
PID 2408 wrote to memory of 2980	2408	iexplore.exe	28
PID 2408 wrote to memory of 2980	2408	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7c01130ef557e0e9831ffc95a39fd044_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2408 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2fc38ff09f46174e1a570949fc1e8cbd

SHA1
5cc95e71b58907369a87f5acad35e3636fdb9a3d

SHA256
4df1ac44da5eaa78db025980ee80827c6cdeefaa94c7bf14b1f2148d1c9d9444

SHA512
d3a0cc1ac55375308d84aee8433cd792ee9635fed2b52cbc9f084872c0b8090d878fe84166002d759a1a73457e1df0eca205510ba38350d56046b26da3ddf2c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7736ee22f845e342e36da894b16abc1e

SHA1
5b72a36bf4a5c8cec15aeea27f7c8d11858fd3d4

SHA256
60a8a0d575119b387ad976c1c59e79b2be5ecc439a9d7216f81a34202619f0f3

SHA512
3c0fe1626ea9dd917c4b26674b65b03ba999f70ffc9bf01a5687ee52e42a308a9fd86c4c6a4fa4c3fb531f1d79d39d3fe9bc3ee2100fd33aa7d87fc2963815be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05129976402341a0fbec4508e61f0db5

SHA1
7fa004b5852bfc2a9a6595ba132d7a09093c87bf

SHA256
4e868fc21833249805d4f941bcfe719ebab04dfa58a711478b249b12ad6b40fe

SHA512
def7ed0c775fac232563748b32e29f4cda7f0037f9d015d079149b6a5177fa6834f0b1c0bbd37a2211a5ad75e94f8d35e6de832ba68046bc1840c8a5165a9857

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19800007f0e5e3fe13d55edb761653f8

SHA1
025f8b6c234a182def461b9c5104bb68c092c9f5

SHA256
def5da40cd487ca0596577a7d60b03ad7b1dd98b6c65f2069f5a3080b1de5605

SHA512
e834b08eae71fa21def4792fd2d323aed19e939a63a60a6e09363c970f5d8bce17136557d2ea8979c4a871a13364f409a73e6e582613141642d80799f9cd2bb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b95f5d5a646bbe036ce794350abfd66e

SHA1
43271c1a146480549d872415a20da73bdbbc64b4

SHA256
35de690db1f46a131aecf878d3509f50b6da3ee372b9341f91cd22f4b1cc70a5

SHA512
a92f90eef909d960736aaa8a9688db5372b4ff381efe0159481779f051a9bf6d8073dd88914ba65202961b82449918835938f9f20dd2623debe1a5f902206d77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed9df71fd8355661acdb3ec27c066939

SHA1
4a406823ae590da2f0e036d7535cfa4593faf659

SHA256
50a9c252ead419adaee7e45d15984b4b390b7a420fa3603483fd5cd3f03a3e9d

SHA512
0e9a3f57ced1604477d25c002a9da9289502fd25b96b253b84705f312c216e49fe7d71d4b784391c62c9012c42100d0620b573bf9f78b70ec563ac08879989bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2a6f9f1491eddc1dad6f7d219f5cff4

SHA1
476f95894efc480fdef5627c351c1d9780a44aee

SHA256
527c37030818013dfc5e8a4b4437704c32d7055df31d83640e603578b315f61e

SHA512
155c35cbd0da136bcfb6ac7039ed64f2d81c026fa32415c8c79140c0121b6b4a28a35927b2443901fc3faa45d59c7593d794c7882752c3800a864d8bc7f4cbb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
308a390a6b3a016b527eba6a8c8a9f66

SHA1
ed2b4f407735c49473b6beac875d5329c079e0e1

SHA256
68904951e78fc6fb922c31030a01bdbddac7de3839300cb8fc0bef691a9ce0ca

SHA512
c2d8e3586467c7507383bc78234aeecb9411e1e4f233e9278ef1375086102c650908051932deb011bb756f3bd1cf0b0aef240ce9f5422b03bf9c2b7b47437899

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a791ca8886422c27980a307026158b24

SHA1
3eb242fe806ed352bd27524c24563eec4661c6b9

SHA256
b8e50769b6b84e30995f07b48215d927478a3df5a92332d3c049a39d04052489

SHA512
0b8fc5f459bb655bcc1bf768edd36bc57d52e84ec93c58ab7da7b86732e89dfd18569cc424d29f0d87c59379f7a2fc2af2ab6cb5d0f66a62e48675bca72f606f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2138.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar21A9.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit