01df74dd73380cdc58d2b6c1f9d3d556f597f0c4f3ac4f73a0e362edd0b11c51

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02-06-2024 17:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8ece55f5c407adbf8147893ea74e581a_JaffaCakes118.html
Size

189KB
MD5

8ece55f5c407adbf8147893ea74e581a
SHA1

b7b90a57a9f5914ac39c6e921282267ee240bb2b
SHA256

01df74dd73380cdc58d2b6c1f9d3d556f597f0c4f3ac4f73a0e362edd0b11c51
SHA512

a0f50793909c9071a7c26223ca365f0eee7b716f418a3c7daf4bd67ead446481b17676bcca6b972e14610e31481e96a3b89d24168e5cd99d55fa34a7c8c90706
SSDEEP

3072:fcKMohCq0OpxAKzjZpC0o/pVyfkMY+BES09JXAnyrZalI+YQ:ffsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A75A12A1-2102-11EF-8A46-EA263619F6CB} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423509943"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2336	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2336	iexplore.exe
2336	iexplore.exe
2164	IEXPLORE.EXE
2164	IEXPLORE.EXE
2164	IEXPLORE.EXE
2164	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 2164	2336	iexplore.exe	28
PID 2336 wrote to memory of 2164	2336	iexplore.exe	28
PID 2336 wrote to memory of 2164	2336	iexplore.exe	28
PID 2336 wrote to memory of 2164	2336	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8ece55f5c407adbf8147893ea74e581a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2336 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
53b095510b3752a7f9b7a4f633a611b2

SHA1
df4c269471f30955fe1c546331f8783f70dff56f

SHA256
245b7a070ba90814329d9aeda4baf201d0d0d30e554cdc2a5ad854cb8bdc6655

SHA512
8d1060f4293bc039f5e06d031322df7a534ba92298396497f0980ccc1b7a657f2fbe001a4cb2a89c703b4ed24324441e235cc9b2af3b4285cdaffcdd3e5666aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8756bd697dcccd0b0161508f47a0ecbf

SHA1
1d8783c1ce2e9a136efd5e3144beb6508c999941

SHA256
1eb0a776ff8cf89ccda682d0e7f5618640ee624f379652564ac0b12c524cb0ca

SHA512
6ecb43c653d5c98624c6f7a594a22d0b17328ba89694e7027c9b950cecf9aa53da1e84b6b2ba2039a716bcabe1d58a0f946627c136c549ed589fde9db7d39c03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
caadd69e99614575de02c0f4a6c50077

SHA1
300cbec0b189fedd9c12333d54c9751ea21b7dd5

SHA256
38e843b5dd753263cd8cbc540a9f69b86a104e412d08a2ffb1d2cb2e663510e0

SHA512
b5d9ecac4ee9e481822e2901925a9d61e6bfe2c91057f8a5ea4d21253420c6034e18d18acc6171bfb1b03c1f7923ffea1820aaa67576440d54d9fdbceb3bbf4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3722413f777d9bbd46e48c08d1826eb

SHA1
4dee0d3561ab41c1706cb5360bf8a5835bbed9dc

SHA256
d9221ebcb30ee22e5be43171aa74d5f6db18ddf73455a1c782b43a41d1f9fcfa

SHA512
289033700f0b7b018f61203bc0e9c147e2e1f6ce6b070c3ea500987f79aa30c30747ef5beae457212c0439df3a5dbaacb3f46938e7751e9656207b3d971adf53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae7de001514755e94ed9895613bc70d6

SHA1
55df7db4ca24087d0f9ae12fc999cb50eb60daa6

SHA256
b5eaea45dac943fe71d1139d3af4c0902a62d54add8a11c7cc48b7c42383f063

SHA512
ead894863bcf12a559d59775fd4200f91720a78d29a01e18a4de72e698c40bc528439853ae686ceb7abd6bb0ccd550f9af0a9df0de8b3c2c21c3538a45565f78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b3b5679b4b506040eb4f20bb3677920f

SHA1
62e9f95434f8c2280e8d538d8eea30af2893d35e

SHA256
9eff4fd51985d7116c005cbbb7ac91c86ff38e2c7e76456b1fe75a366772b610

SHA512
a32159d3c2a025c8e3ad5b2397ece95aef9acbceb095485e85e085b9becadffe6e6f86b692dd797b408424a5fb5ffa55e6e46860f348f2a01464ecb7b109f15f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e7659dbbfd134bf69b12ae8d07197553

SHA1
2219048ede0df11699c875a3009401ac109702d9

SHA256
f796ecc78f8ba8565a32d82b74d03a7d595796cd4e7fdcd366a9553e1190bb7e

SHA512
72e47e7b30d65013ff8c78c4b582cee5011fe9f0905312ea4e75980cac7a0135175be58aa802d239df2444f4530ba2ebc26262f6d155a4000c16b01670f7d411

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c26e64625d2f55e645bd4ac667dd1f8e

SHA1
fb58dec940e8b5a8169ac8cb1fb0815fe6b98942

SHA256
d97550bb818648effee42e6f140f4c8ef60dd5e6635f79e6ef4d62af3cb4e9fd

SHA512
8e44cd2836245be341b84feb67fb44590f8c0b3d688de2305ea147e6162f9c992fcdb27241a17019ef865b5ff59eaaf415e5707cafe6f60298ec531267d07f81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
64f7c43f1496cc267b053d3d12dc3207

SHA1
be55fb80da0c9e084b49e2df2f1a7dfbfc98cb19

SHA256
8e1f0946fda2b15621039845ccc6f38715afe12661fff75f1cc032bb96bc5846

SHA512
9816c84ef8e7b99c6ed871242a5cf3a2f8577f575cd17a20b603fdd8dd03bd8ea6f0e4450eaf8f1dccd25b87e00f3f4c8ca5250037b7f232c14e1dab3cba096f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c3a18b8178c2e3b0bdbf15415462f191

SHA1
4d75a502d1d0524f1a602222ae5fc6741b402526

SHA256
274c25eacfb071f635a046872aa3895be9d5180c75734a43a2f010ffb792c54c

SHA512
09bcc603ab4b912eb40c2a9a3e6923ef2193dc70d41aa659376a386dcc1722ad65536fc9d77ba72df4711138e7268afffbf629b826ff6bf4247e227af71ccb9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aca176dfa607ec8b485ea9fa10a0b133

SHA1
429ee25a83dceee4f67c3e5af3eb2c6296227783

SHA256
67fb441e715611ffa15ea0cf7c6afabbbf20316ed8b0be30512e21a3a278e8d1

SHA512
37e917d0e276cc6c651c8d471032c266f67916efa2627258db607b2cf252b437601abd40d232904741b43a13027a3fb0c2e1e2cdb015e7e953af084896b170a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
2279eb49f360396d2840c4d96a6de7c0

SHA1
7f7ff45bbcbd5639429f596ff102b9abdc5f5538

SHA256
ea249571774621ad6ed2aaa9bb0a29a736b7256b92c7de979e62bac645c77f4f

SHA512
2212cad28d0cb2aecae0044c7e2482d6381d10caa675925232f1271e3915527314eceba59c44959b23721767d3c71b7f69af3491e7e3aaefcb5b586b3769e38b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab20F8.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar210B.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar22B6.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit