7cdc230b0fac93e8b332cf81c510fe4e31fd9d290c04e15bb726dfd4ab61bb95

Analysis

max time kernel
134s
max time network
130s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05-06-2024 07:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

978419a8efe83723e47c36084ff61763_JaffaCakes118.html
Size

12KB
MD5

978419a8efe83723e47c36084ff61763
SHA1

ab85630b4aa33d4044bbcbba057b205aa4674f02
SHA256

7cdc230b0fac93e8b332cf81c510fe4e31fd9d290c04e15bb726dfd4ab61bb95
SHA512

ab12a625a595c196190f6a520c65271ad10c06f49848cc4ac023287bb0e480c01dfe653330cb2f98820eac03350385fd7c8775369b308b6abf06e35c0ed12840
SSDEEP

192:FdaCYl9RJq2xgP/ttjifrR7YywM+GV5kCJk7w:vy9RJq2xgP/e7nwMRV5k0kE

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423735385"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8D43E7B1-230F-11EF-8FBA-CEEE273A2359} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1984	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1984	iexplore.exe
1984	iexplore.exe
1884	IEXPLORE.EXE
1884	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 1884	1984	iexplore.exe	28
PID 1984 wrote to memory of 1884	1984	iexplore.exe	28
PID 1984 wrote to memory of 1884	1984	iexplore.exe	28
PID 1984 wrote to memory of 1884	1984	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\978419a8efe83723e47c36084ff61763_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1984 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
520fbc6fe66fe8337877b4ef5a9663d4

SHA1
c306abc3385a5c775d908fe8a5ce605d5f512b1d

SHA256
f6c729fed26b034048b2a65a3284a7d219c06f5193d85f4be2b0369505253925

SHA512
0ad6c279330e3b189a92dd59e74d9ae56c7d5548883ecdd003b79f6e8b1c0da6e9c5ba8bba30bfc01a9cc30ea9af7e3240598d365747f553ee8e19627ba9b684

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
07e3868f4967d34d364d4eb87d7727fa

SHA1
ab109659b30d7c7aa7c6cd40cf0f2b778c2cf4fb

SHA256
8182d2c8d65433304958c605f891ced61b34a57cd60dd2ba66131831250c27f4

SHA512
e365670b75f0626c87243ff1d3d73b6f00c1cd6d1f7d2d2aae7435c033bad6fc5c1120b1a08891bd059d87f6d13001d0723e35f1d4efd0c34efa470fc436b3b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
50abfff0e5777513d1e9b42c21faed5d

SHA1
df869083c1c0e476f088ab8b348d9b9834889fa5

SHA256
7bcf9ab47f7787e62ef3cd2f540d26d1921fd3863f75276633b9ba06a5e152db

SHA512
242631336cf35f2b75180748f3876160920f3cb038a0d4226fa72cf24ec1811d65baf295ccf24301c0eb3b7c7a1a74a3ea6d388e4df74527ee494ee937b70ab5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a80404b52df50cc2ba49cd7fb620bda3

SHA1
80154b59857a5d0c24a5a5bccf0ca9d3b083d135

SHA256
9d6c7ca236a3f51bf0638e047c898dc205b6a9e74c6560aab916286c66ed10bd

SHA512
bdba36235f95568f0762c5b9f1cce54aba2739cf348dd01d640dfd6403e7298d734f11fe31e6706f5df3bbb45b3d0e914c1f81ac4aea85a7ff6b2ce6fce37985

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
24acf777bb6a2eade22f46507d895af5

SHA1
2f1ab70cf02749c62e61f11f5137f2c85f6f10b3

SHA256
e44a0c4268b7953ce7155ce08c46915958bba7bb9ba251c7fcfdb5b8a8898b32

SHA512
b2a84117a236903c9777417d1d0f60fc52c77df3a1ffb3911bcc47be93e0f5304debbafbcf2b9327a8be23650d1d506d8bfa7b8a1e4c412b8773a39ea2b40edb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
af3a0f9890e13ed899c33e7d10476392

SHA1
ba482ba9827212237bb3f0256e7e4b2c505f5357

SHA256
7e1da17f0fd99dbe32860de8de7084aacd6aa20507b2c5a8111229b2331cb842

SHA512
7afa23394c546dde3f3d040a68534ea805077d0fdd0d7a9f3da3c34d7b86adedb816c028652b2cb29791e6aa869d5cde7e32edc7a9ad382001f17a099da6bd11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
94a543e77743b9f0c2d324221e852c12

SHA1
ffa42d91ee2b3f5cb96cfa5947373ceb7b87f1d9

SHA256
a371f1da068c3ed4c846dff0c432934c45395056841d47c4a627b187b7832e14

SHA512
b61bf6c25ac0a07c1953b16384cea79f29295acf70c20460d6bd43502867be5c3c85f4e2d6f6000ccbe7d0be674d3cdb4beb221bdafbe34361a5623bfda3b073

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6e3111820ff35583b9e7089bd24cdde0

SHA1
d71c447ace2f5f8bff6dea55f2f127731f21cab0

SHA256
63f53ec4cb2927bec0b534e41fe5e6a3aa80cbf7b4acb5b436d8fbf53fefa1ca

SHA512
eb1ae16f8d8cddfdb9b13f659a8037df3f2eaf29c6abc098e61ae922ee4e7887f2b36b70c5bf42b5724517602b7a874a6a3931490be7a5ec622ae446d11f8988

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
45599ad320393291fd13efad3dae17d8

SHA1
8a0cb4eabeacfb4027c0608c8a65436f63e6ce85

SHA256
e46e5af98cb7c9ce1b97291d607bca2fe83538e79e7f50931f908f949e91cc94

SHA512
31734463d2364b3ce476de06b9e02940964aaf20fdf98eb92c1e7b0d5020a8c78b209a9912a5fe93f34a84859fca86385754402bd5ce844fe275449dbc4116bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1863.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab194F.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1963.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit