ecf3eb063dc3d1f29ef5a2a982c59c9df25fbdb0fd6a9a864f9bae9b47f57ad8

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
05-05-2024 06:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1664d704594d661bae81568d2403b8c1_JaffaCakes118.html
Size

463KB
MD5

1664d704594d661bae81568d2403b8c1
SHA1

fc6eebad60e745ea30b980587a7640edf33e4236
SHA256

ecf3eb063dc3d1f29ef5a2a982c59c9df25fbdb0fd6a9a864f9bae9b47f57ad8
SHA512

149a304bd5f6bf4d24c3220bb3f27f21fdd087b8f12c7578e211ccfdb89b025db97593726e6f74cd22f61c84d7c086f285a36f1689659925c38aae669916ba4b
SSDEEP

6144:SWsMYod+X3oI+YCVsMYod+X3oI+YZsMYod+X3oI+YLsMYod+X3oI+YQ:b5d+X3e5d+X3L5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000005c0dd86c15d995ba2c7a574075d51af17ce712bca9e5b00a5f8035fe5ff224c3000000000e8000000002000020000000d51516432783614370a2690a5e7c24ef081a175c0bb60df3187b3dfdfedcfd93200000000868cbf3fce1015a7194a5cb53950e3f81853eb6f385980bc8d2d00e8897e29d40000000c3d2418ccdc11cca77e8d7f304541d62c364e8dc106e18f77cb55b5c425748e125371be29bf3393ab4b0cb520b5ec4d8bae1fd3cf309569d8e00a01b3eee5c62	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421052360"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A5B3C421-0AA8-11EF-970D-EE42DE2196AB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0363b7eb59eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000ae4060b09cd6dc560dd4fd32886187fcfa39a235bf1c0f282dd7f2a4a533bb9b000000000e80000000020000200000004e923861805692932f92220185cc4044d04ea2b0b96af4fb2f0996233544dcb49000000060fcd21d4f6c65461e8bcc92171ffe5a54e3f3c510fa06cd144ce7e392bb16f646d3c9ae9c6ac0861b946ec96c7f53c32391eb9982c251f86cfe9064fb455f46efbbe2876281540921bf6dcf25a3b6851ae8f714d7ef2b6f7415878015253a23341f303612a3df9324b507a4378532a6ba1897e6a01a4bae14f62b6669ec83d66f49f1b9620ab8fb590fbd3f10d9e85340000000b52ad1d2f9a8c3db824b79d2544b21a077657a123f815b9adc3fdad466e67fc56767691a7ce93635cfdca9559b2360d98da0c611a934fda21a725375c079e91e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2004	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2004	iexplore.exe
2004	iexplore.exe
1720	IEXPLORE.EXE
1720	IEXPLORE.EXE
1720	IEXPLORE.EXE
1720	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 1720	2004	iexplore.exe	28
PID 2004 wrote to memory of 1720	2004	iexplore.exe	28
PID 2004 wrote to memory of 1720	2004	iexplore.exe	28
PID 2004 wrote to memory of 1720	2004	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1664d704594d661bae81568d2403b8c1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2004 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9eeb7bda527be95cc2e38a690385853a

SHA1
4c05747ba074f4dceb0d3c8ddeb5be983e290fd6

SHA256
a48028a264ad72557cb6ba153026ee74b5c6c70d277126a608b1a21fcf10f1d6

SHA512
814ba0a24bdfbc8fa17cf11d4db697dd93cd9f2a9f33fee18722203fa1897e9be362ac420805d1d7e6c13ac94d4a0fdfe4838d2a7dfbb9cf6cf6283b21b89084

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
04887ddea3ca52e421f12bfaae141c8f

SHA1
6dbfd76d4db8cc9e0e1643ac7967959447f7f3aa

SHA256
0b08ab6ab9f64d22b3a695320c787c80b8672f8a9884103af670f82c59e62573

SHA512
665d4a1adfca7e3ee156873760330bcf28ec962edd8f89065f58b37304d59b18c7aef98b86e17e08437b12c9a9621311e85dc1544525715b6b949e3afeca4b93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e36fec1a8a86a9cc364c880d1299bea7

SHA1
eb249d29e3893e1730055919d9c387533a053ea3

SHA256
1484c1a02bd2bf30b5177e84032aae7d5d62041224ae7ce3d0640dff7a709e8d

SHA512
00988668ee25cd2e06c18218959d002828966b0ff3af4eb17ad30cbc1badb86516c265c0c62999cba93ffbbb72ea64a8848b8323271ee04cb9fe6233409a451d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5eaf657ec3b7ba221dce64da40fadbaa

SHA1
3240f96a8950d9867e98bbe98c2dda5402850b10

SHA256
e94236f236cdaed2223a7b747668a01930a4db5f88de1a33ecf1d01b26f7c43c

SHA512
9a1c6a24dc96c0e9819a6b4958087b35cb743d27a94cc76cd3e3e91133fbfea079a1696a7c93c67eac3e9d0b09eb0b31eec8f7de5c85c47feba739e14a04d624

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36ff5510ba9e3d8b943f48371e16aa20

SHA1
44c599d5ab26f7216304a61940a8f39ffac27d18

SHA256
3eb8ccb335c53fc7446cc99d875cbfe6ccfd42a79550e511a59ccbb1d9f3a6b6

SHA512
45483f32316e689d1395f90768516bf6cb80f218e7430044cc3bc8164adac881344915dafea6ed2f4f41a5b7666573fe89aac6ad76d5f01fe4136138d5b588a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ffeaa730c99ad133088efb575a2a307

SHA1
73226013d4d8d87ed84b77a19a21af10c955fc9c

SHA256
86351e9f29281b54655a5310f0b879926ac877ba8b2c13be50faba980c287627

SHA512
86c5e9f7da630ca3490ced296150a66980f6234c2f8cbcf91e06598f108f6a7545fc1e985983046b8a4ecba2b67f3a67d7e2aef205be4c0a29ae5e464d5621e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50982049ab367f2f53efe774b33ce578

SHA1
10a6a5bf5af1116afc8c6b11223e85796a5fabcd

SHA256
8597c62519e508d5609e437cf42f97d6ed41690e0e7111c773f6e517752336f1

SHA512
7a9c73ccdd8cb6e9d2ac16c0d1def204b58c7dae83e4eccc9c2076e4850dd8e5eab237d28c08ab1e740597ab5e7a9cc17766415eb3fa139a5ba27ce480224d29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f5e2d9c918f439a3454f88506a1d5b9

SHA1
bb28f9e09776948d7f767d530d8dd59c548d3c05

SHA256
a38ea64e8e82addadffa1173d4cc65e230bfbb08a1959943247bc67ed0d08a5c

SHA512
53a10a766e4ccc676c02e3e220e5d9307376b2645664f868c0e84e71944a08627449c07453c7bdf1b64b391320ec7eb0f8dd64e74a4d0f7bc97b4f7d3119b925

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
41383ee2ed22052aed88726c7606dc39

SHA1
9dc1a9a841d7e07622b42a9a43bff7a9ed5c1f9f

SHA256
e1cd0ec348bf6dfd27949f6039f98a4c7dfe2af12d33865cffd908f5c32f1256

SHA512
602a6df6f9bcec8744c7bfc5b521bfb106629026aff4a4acd03b5a89fcac33c5ca713ada49a99197b631711f4f81bab8d0988890171dce82b1de1e2bef1e3803

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
012ac05721b9f36dbfcec416b32f2731

SHA1
4a25df636505a8ff7375d8a59e9b341895f9759d

SHA256
e5e93d75d80f28abb260fcc862e967766eab52b5c40220dca5e21531f09843b9

SHA512
6b83ad843274357a69afd1bb85880fb7b31cb16a663e9f6a1b521514356bb7d2e32cd7a9b7d7f022779611f520d5bdf28575589212e94c344dddfc6e72df8a29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91a6b4bf73c415d68e6da5c1cc90167c

SHA1
d6e30aa97bbacaeee239aca5a0510b2d5d3b4807

SHA256
bc758a7ae7f6bc580c837d0ae18a5b3892fc557346ec5f3492156534959879d4

SHA512
85c6327e9f5f799338fff7fa95057254d718cf03117c9e2dfd2aae2ff6d4788bccb8888ded66271e0d851ebad199526f2e0fc4ca3db52d8e3c968e6598822747

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0793acf7c0d29515ac0f19f4c53afd52

SHA1
d7b49c18c485320f423edd51332f49e88b5793cb

SHA256
cb7802bc164e3aaf20870d47faaa1e7b6568ddbe36c389dcb674dc6f7c15dbdb

SHA512
918eb610545c2796d7829016345431d6bd3d0008e169bc58aec96b8498155722dee3b693e3738f8616189f86de4ef4c31e973c24e6089e7498b0cd64c7541fcb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa24c0526e976351791f7de8738f5f04

SHA1
00ff773e04a356318fa94e307a09818512149bad

SHA256
f1190511f2db584fbdb5419138b81a7b2b6374807810d9c6ef82027fd966b1c3

SHA512
37e88610717e5fca40670a46ac2362c8a30b4d62479d1074e4ba190d6e941cb53d7071f59a8a78144c6ec48dc1a33651ef1da20d4170e62970764cac7159e86e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5a0416946b7dbcf155cdca745bc9940

SHA1
8e9b93875c941fb883c455fe1ae939be944c3fc9

SHA256
04c47efaa8d89d0d924202ccf60a11db0898b9e89daba18b6e3583685a3a0a65

SHA512
220c82fcdfe224366978004e8020ed9366981674e7c8da15d5a7df50ac38bb348684671669a66c02e03b78734e2443965b72dae78438d3c1f2c162430fff6038

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43ccc86d691a6c32ec24a312e629094a

SHA1
19b9de34054c67f3a98bb97571618aaaeb461924

SHA256
a9a288efe000015c454fe939f3abd75c6d07e0ee87f28a82157c0f22fa2b4ec0

SHA512
f7d5870b40ce71636a9b362e7f2b7b1d2aed115fada2923013efc182f700feacee86624d2d353dc0ce26390addd0edb600aeb71c795f64e2b454ee283174261d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37ae321ebb1dcf7a57c41848a4b71646

SHA1
c7c901362abe85fa57cda04297a5180ebbb263a2

SHA256
2fb255f1d053289a4a39ad14c2a877df7a25c0b871dcfb6a806e50acd56d613c

SHA512
0702af414a9eaa6d8eabb1708184699c6a15b2300719985289773c7bb701bf8eab8aae21e38cf34cbc646e7d87b0eef1dc3eb7216bef64d5dc88aafc17f98251

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab394C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3A0E.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit