1f8ff490b2b7448b80a9be4ed6bc465df63209b8fb485e2e0fb2b21f6eba3369

Analysis

max time kernel
118s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 11:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6e6e0822c3b58118fce2e498062898c7_JaffaCakes118.html
Size

2KB
MD5

6e6e0822c3b58118fce2e498062898c7
SHA1

ab8f41efa20b76aa7c26d1674e9bee4e2b0a1279
SHA256

1f8ff490b2b7448b80a9be4ed6bc465df63209b8fb485e2e0fb2b21f6eba3369
SHA512

5b921ecf8ee42a30ae84e1a62b0d0cbebdb7cc934655705938d04eb4b4a8f2c4149077d52e271c1cc310379d95aa9701628f9c3be38560fd18de0a4c7ef2977c

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422713662"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 906abb7fd1adda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000083cbc40b1f13d943a5ca0cdd4dc9fdaa000000000200000000001066000000010000200000002f6584d17d0a2e9ee4a2062b1bf52c815e5c69a68a702bc21d157d96ad84f6b2000000000e80000000020000200000009dc9364e3f425c024917ce43a017d2e6714efc7fb06b527c4fca0f83ebc164c79000000099d8d9bc551c67ddf93ca36d8b69cd0eca8365b46b1ed1cddeb2d40cf819693b3a79a6c1549273709baf6420fa2dcb9a782c1aca53697a8e4e4cedc18e327e78cbbe69388fbc9f810f7a800380a82dcf8208cc9a2c00d3414892ccc28ffd3de2718e10e16488afcb468663edad424ee2f430e5d9c26d9e62e7cbf6a461a230de197f0be6b004aee2ca7bbb25b30482d940000000272066b8511e46759d93636745a7da1389d458384103878992585b806ff32e5d3b7dc540c415c760d50d2c16f8b0f413bca4026a1297860646613380b6526672	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000083cbc40b1f13d943a5ca0cdd4dc9fdaa00000000020000000000106600000001000020000000f554eb5eda3247255f7c85f3dd606b875d21d1551a0850cf3b847bfdf8b506c7000000000e8000000002000020000000c9603c0e60040dbed84cd1a75b9fb7eb7d14345918a246543f91e0566bdd1a52200000005d622108757b10bac7fe125be386eb7ccee24d3af3b4ca5122ff18e563ea115240000000fe0922ea0ab71ba37cae83b2db189c6421f36b274b294222450d0bd0f263d93252955ea68ec87a072a17c943172a6a087231f7189a9a9f2396570b492f949f1e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AAE8F931-19C4-11EF-9966-EA483E0BCDAF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2164	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2164	iexplore.exe
2164	iexplore.exe
2528	IEXPLORE.EXE
2528	IEXPLORE.EXE
2528	IEXPLORE.EXE
2528	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2528	2164	iexplore.exe	28
PID 2164 wrote to memory of 2528	2164	iexplore.exe	28
PID 2164 wrote to memory of 2528	2164	iexplore.exe	28
PID 2164 wrote to memory of 2528	2164	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6e6e0822c3b58118fce2e498062898c7_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2164 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78c402fa076cb2403b6442edaf94bb05

SHA1
1578ff873050d78d5f725500b8f7a52cd6183612

SHA256
363ed3ebf326037cebe1d07d9aa2d374cce018c4fb7e1c032ef46e9d58db52ae

SHA512
92f0d90761977775f1d78dc972fb4e0ca0af9bcb7dd6beb204ac1dba10d35d8d6f1ec94f5311e4ffc2420e9b79e6b6b971342e7889001c8650303ec3d4e67869

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63c7ef309f00327f00705b71163a4c72

SHA1
511b8d830350244dd482a192be1ad86eb73da8e1

SHA256
386142f4d4e46903d9ee2d2189cafbf55b5122b0c4d090c93fef34b212b98f4c

SHA512
eb914b3b82b0cb9a5a27e945a93c832adf722a7204c848ad2cfc834c710e5ad1e3e367fa4978c12ee8043e77dfc7de3675c7d45a0f6ea94e90b61fd083c5ec67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
481ee49f3437d16ef288852aaf67dd5d

SHA1
e454b59de60c20e9ac2bd96fc23368095e3a039d

SHA256
083395f11e4b82cfc48dc5ad35fc00886422cdc62a299fdd3c41c0a2f5eb913f

SHA512
f1cfc1f5ee0d05e044c97c823f54a892684daa6204f962f099800c2407fd60301bd32f68b1712f523c1ce96b8d8df5da7f9ae6d997839c45c5362393a7bf9ad0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f75561db6b34c5225f21b61ceec8c5eb

SHA1
e516c24571a7c463d97abe2ef6ba45a14d50796d

SHA256
cf684a29d81dffcc3c676d3907af4260bec2473ecbd4753940ceebb3a4cb9941

SHA512
d0abbd7d120a1ace9c93c564438d2a5973702aadde3126cfc4776a17d60256405ce2204027054106d0f8791d2f96267828148e8de2c0f6b05a6876a7402283fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25c0fbb5a70b88306f65f7d58a547cd5

SHA1
854eeff45e24bf0576c86c33ed3494a2d2606a98

SHA256
312457da00cb645da19e6134c54006d5f1e8220e71c3adc9fd4dc9565946475a

SHA512
6d5ef3470be5f0328bf952e8fa8cc144fb60bcdf7d4aba458ff2932a1cdd93b959995cc96a0d156e2a455b8af7f74fc994c160facd9fee116b16ea3b332bbdfc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9fa1ae5ec2d0afff9628bcddb74dd344

SHA1
b8dbf428997965e13a2bb41c7f1d0e471476d43f

SHA256
98f48cc83e82ee94801bf6135af446af33fc2e52a0281e3002ca9ccf07079068

SHA512
01bd157072c264ffa0d7acdcabe08a55bb2a98517e38fa27a6f95948d2053e766c7ccd146ac6da3f9f02ae9e4fae971147e9c66d88fbcd51295de81b672d3b60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da77158d6578742f78878c9a8fec6f37

SHA1
564a3e0d9fcdc74e4c79b718fa01e15db19cb4c7

SHA256
93eb2abf5f5724f65379eedfcaf992a57b8581071b12a1db9e543f7850abec2c

SHA512
810ddaff797eeaa9b57ff625dc14d7387328bb2ddc376a7ccd2f78743fd0f9f73dc2aac5106537c5ad6a95cc661bc19752a539103ab568f73f9cb1cf21c319c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc59f6842f5338be4dda6b8f6e2b2128

SHA1
d444ecff3f5688866d086782144157101068fdb6

SHA256
995494b9f5f5fb50e19a981af51b3cc57f69cb999bf02a6b452b1ce612841100

SHA512
b74c5012adfe87daecacc3492e23bd04e74647f99f490bbb0b8e01e9841849416af97a04a6404e7d3fcb5b918a918eb59e5c45641630769137a7a353b9081ee8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2639b9af9b37de952b24150d24303025

SHA1
359a4bb4697f0312b6798bbaa8646d6152b98376

SHA256
a551a6433969cd93d9755414b1673fc47a9530c839bc8ea12a6d33184de20069

SHA512
347e3f80bb4240a8963b2b9ee49b37634be785ef0da6b270644ea937b80bde5fada7af985aa56185106308b90ea353a28b1307cc4fc4d081e1252cf1feb51eb9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b97593940f44f5763383e04ce4dbb934

SHA1
960a8d823018ce0b027db3f3baec473485e83dea

SHA256
3668bae3822f98c5ddc2b3ba022340b3ec6cd7ef34cb6b1617d78e4bd3aa7ea2

SHA512
460a968edbd53e25e51d1988e7ff510e62ae56f0054c9c70f6f622484c2d8e2a575af054606945c595c3b7304757c3ab4d7189cfee1b1702a18573f327620148

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
852771d648ea3b3e97eb7e89f4ba598d

SHA1
7a93fec610024346f7dc1427b32202f169a41835

SHA256
0661030d5cdd32375bce37fb2e53f2c366f50d05d94817fe6f39ee3417051f46

SHA512
4589ead05a7294d7ea7550ba80f1cf5a2ad6f55bf9a3334eeeb4487908322aafb77685782f4d96389849117edd0e0fce6f3dfdb3bfa27df631a87ccb1cb38ac3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b56ff425894f2b3af9e0f12f30ae394

SHA1
dc12780eae4570f9716ab629d3341df7c31046e9

SHA256
cf23ae85b756b05c6c34a6c7d27eaec4bebd41e726c7f3e831f9eaf87ba465cc

SHA512
9e017dd2e95bf609304eeaa23ac8ec62c34cb8cde5df07ef0392322cfe63dec8791f19abc82c94f6f856973a7b8592fd661b0d6fb6f8e6948ec6a39844293784

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
95916aa5e6e5dfe0aa1d23a4ac409a40

SHA1
af94910fd57ac191a073fa991392c7bb443f4c1b

SHA256
f7ab296f73dbe6487fcd026f3d1044ee52fd914d67545473a5e22cf372c7b4be

SHA512
e0ba253b4a618e9714c2aa659a6003bc9884a00c5021cd410a6547b2775ecea78da7c485f2e13b613b968fac596e7bf3926d9b22401f5c2eceb135f658c0d281

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bddc59b481e22823c5d5a350a57eef72

SHA1
6bf94aa7be7deb06a796e5fc793f378fd3fe6ce1

SHA256
443ffe0822209ce50542c58a158bf9a6358e6b37872162cd7dcb292288b4cdc5

SHA512
a4ac30c6ee8a3513d5021c153a2d71ff4591b6fdbec7cd184b334904464930208bea8375bb53ded8afd00b3f87f26420898be8f1a28017c70a495dfc73128475

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c7214594038ddbecc78ddf913253639

SHA1
521f9d31dad82fda0cc9fcd628a9859c2a987052

SHA256
c707e950c7d9ce3ea3a1ae274578122445c9b41d2e096418a6ca8625e0769680

SHA512
a06a105c4f235852de4ead60bd20caf70d448010b88a688ca5b3643f291619505f6ed10ee2d26dae434ad5eb4a0e2e1a7bb694b5fd25703e5108274d3098417d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c5d68a352d8e7ef75ede16c32212f7c

SHA1
cb62fb5181475f0e16852f1ac4c6179eed3fef1f

SHA256
a6da9c9c2fa6380dad5c3f1d2e83c7b56596740d8e46b88173bac87e1bea656b

SHA512
6536914a217cb142ff6e79e612a724d41392addd6b13a5ed7359e245a5f56038c52c62dcbaf3585ba267c5be0e9bff84e0d26fef6dc85eddb1c8afeeefd59b7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3C67.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3E42.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit