fcdcba16c2f214c01e4ab8b80161eddea04d8a03ebf1a189443dee9ee81aa335

Analysis

max time kernel
133s
max time network
131s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 16:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3599fdbcf1621acbaebaf2f452ddc3e5_JaffaCakes118.html
Size

2KB
MD5

3599fdbcf1621acbaebaf2f452ddc3e5
SHA1

2e8d6930200d51ab8573f5c138bcf67debf7bdc5
SHA256

fcdcba16c2f214c01e4ab8b80161eddea04d8a03ebf1a189443dee9ee81aa335
SHA512

e0bf64e3bc66b6b6e2cfdc50cf7767fa735ae4c85889958e8b9df7b4672a2047b282bba6b49f6f97515a1e1f8c73552593cacb8c308187cd061b947ec061a559

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{26AB9EA1-0FB7-11EF-81DB-4E87F544447C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30b062fbc3a3da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421608344"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000a4944ac42c8f31a90378da1fcc09ff743f31bbe3949c4bfc55c551e1c7562f8d000000000e8000000002000020000000b181656e31b0a7d3cef562c7f79a9b8ebebcecd29c9544ba9537838ae885b5c5200000001d7657218e541c8ada3d99ef0565bcc9157814c1b1655be50a25d076228c1fb3400000002c2d6e076d7c7d58d8e3942a82231c4b03ad1942cdb22b459e0fa580b308a7fce5ac7e842e988d5afcd251bceac8e42e6efd904de35a6791834636f6734e11cf	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000064de904c5204258b20cbcedf95c22eab7100ca4941a2ffef81a87abfcc5cf24a000000000e8000000002000020000000e755aa10b9a923e0e249b99c4c5c245fc95a781720d678b4977723037a9a11eb90000000819c3d166d1d9461b8590b5396336dd7920309033e15bf19bcef8ecdf9c6500b9b24a07501b3ccb88781f5075780fa652e66c426c367cd08837481fbb645c7421df883e7e0924f6fd64ebd088cfc8cfafca0de0460a949af065cf394b74e8f5b0aa7b6b8a78c0dd82deaf273d958fe9955882d9e8b292cd690b6204e8a8301f31031103b0b6ac56b9c394fcccd642f1f400000005ec5f4f6ea29449361de5289dc6fe8a61b3208b8be001e21ae760f37c562bca28ee3ba3b6d77ee1ba54223a7ee837d8194bc7731a5f0cb90632526b02bff60ca	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2180	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2180	iexplore.exe
2180	iexplore.exe
2444	IEXPLORE.EXE
2444	IEXPLORE.EXE
2444	IEXPLORE.EXE
2444	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2444	2180	iexplore.exe	28
PID 2180 wrote to memory of 2444	2180	iexplore.exe	28
PID 2180 wrote to memory of 2444	2180	iexplore.exe	28
PID 2180 wrote to memory of 2444	2180	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3599fdbcf1621acbaebaf2f452ddc3e5_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2180 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0787a29fd0e216eeab889832485892a

SHA1
7926f89aa2513ce8f070c29488219501e3d53fe3

SHA256
587e2b67e3a81bec7ee13e88b4df04125ae237f46c2496f23157758cb4c593ab

SHA512
934f046a03cc829b9cc55c91fb8cbcdd47f312ceb2dd722e67fc7f4449f5fef8d5f2d09f1ac20dc1ababdc990a9fc069b9af2e23ab9f88b748e565b141ecd2a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
706b051ba8326f07c01c03b079f5e1c1

SHA1
aa53f0984e2b74ba75a8ad93c1a2e5610be90653

SHA256
b7a8bb4268c26cdc215494bd87418ebe31c604a8447036422b1b0ac1de1df61b

SHA512
218f6f5054a5a7511cd31f3217186c3cc7292fa52e0a8c96933fc38bad490c3e904fdc45675200420d232dd1661677bf5e26525f72f7e9583a650e8d4c7c9536

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63cad332876569eb378d1d3174548b10

SHA1
c81a55c781d30abfd5d36dd3a0294e3d403da0b2

SHA256
219157345d75785ba2fc4d9c4d9e2ecbba4fcc996e2cc86d570ccd124f1b909b

SHA512
6e1033cedf92ce288066e873ad6838fc18b9042820718b4f20c128eb626324b1241079913c20bc7a9ced03dddf281ae9cd084a4e810f1623bc72869431bce9bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
332c41f59d709fbb2c39905c9c7e0082

SHA1
b07168de486e16d4ac503b35dcbfc51c14f88a08

SHA256
7a42959dc41f44945c7b1ceb5b5c36158486f3b98a8e251e43b8e15ecc298b32

SHA512
23ee70ee8dc7e939a25df397e5715abff86476acced2e3ea91a8fbd8df56b63873a62381b5d03d65d6bb08c6f585a21b3a2c83e9241f167f4a7346513792355c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ceba90343571ffc6fecbf0c8b3daf057

SHA1
6cb9ded61e5d52c0bea27541280ac524ce4cfc82

SHA256
2fcf94959a159c8db8a36f5aec22eff25958e1c556a9eed5e713bfbac18b5c9d

SHA512
2aaf3d2adb204cf515d6025460154bb27310cfc32a9bd71982fef7d1297c41176f90c9d2d9ba57c85210c5f7f7d1df7febbaa7367812907bab91c6b9b2af5c88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7788cbc96c660e73ef9f21a83c722398

SHA1
d99cea1f36da474f22eef1273a3e61ac05e8ba2e

SHA256
d7d6ede0baa1fb6319ca3f1fbb12e6d427c408c9afed4e31e2f9621f17d836d6

SHA512
b04a07412f045723c29b2ddfbc52b40cf36f201cda93f482ed817090b40160a15e9b5f012c352b12cee5e574591ffe70478bea73f6f32abb7b5167b10accac59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da59e9fcb46d451e24aa501fe38ae872

SHA1
d65c77d296d8fceb64cb89e42e97746e623b86ae

SHA256
b07ee0d4a9c6d6a260111819ff4bfa27b6cb0e72f56762f885ef92ad15e76744

SHA512
fea9a14ddd05e62be070690f898a5cacb0e5031e7457d69d8fcddd80d2f0667f4fa654d111cebd56387a7da46a4423f659063bafb035b42aa201fb00f5b6808c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
65947e6ac0dd00086758c84247bb615f

SHA1
3fde21963479f3889996322f510c94a9abc38fbb

SHA256
2f48066fdd33fa461bbdb59f92ae4bdb7683b487200f4ce2d9694c36cd82ba79

SHA512
a2d94fa18ffa4694e00582ad3a2c4c9c91c9c6b37deae18013705bfd9af032aa4b9878812135af821961670ccae9cf8b15760fd1a803cdd41a5a494541ff19d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a613cd20c788ee9d886c6a943b126f2e

SHA1
9b63589c6d386a973f07c9f9cfd8713c1ed5a617

SHA256
b4cfba6cbfbaa35edd120c8bc2c1f3a29405b3bf412275ebcade9043b2315642

SHA512
96422d8691481e05f00492b97a63495743d54cc713971947cd405a367e440d7ced374a12cafe0c05039cb34f31326c7b766aec65bf93daa1edd5899a50d1fe02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7582fc3a796294c389bc23a39dea6ff9

SHA1
762c5126ce319010ee22f852784202ae450c27c6

SHA256
15c0b161e752209ad8587f2866ce6859951fa7f477eac6ac4e11633b44b180a5

SHA512
c515979772d07ae843c01b061c64870e6062dbf32ac7e064be07bea7af77a29edef0e6adbfe232cffb70f784042a5c67f629035772ce32e3a73b64f4d764cd71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab6d0f2295101397ac9071f48fa97400

SHA1
e14a6676d47f7baabd8e73b65f71d3c7304c2fe6

SHA256
57d4e76c93fcc1258d5a2d549f79718d7d3bb4ec9dca73b99f861bb3a56cd1b9

SHA512
ae31f0cabdda21f4aed436623983a9abfd1d1dd4a8254dc654ac1316319bd039c4aa05eff207f8d6e5584d39dca410da9b1cf94e4da2db4374cd799dac738a84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6ee22de8297e4f93254d9ca4cdb1697

SHA1
506a538c826f4791c007efcd08b5d41947028b4e

SHA256
4bb5b605ac59321bb0b3d68b8691f1e0967f3f8bde2d4525a136c1acc054a26f

SHA512
9856a9c3601ad4bc34dda235d3a0faa8ec66a415181e7e16b4ef485e6ca252af88dcd0f5d9b089b6ad56672f0f7cd1fe3aae558e491941bacf81842d0b34aa26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
913d94361fd4ced1e3fc8585c200e536

SHA1
33bd2a735bbb9415b8fc6287631638e97606f39e

SHA256
3d524db525f9d8d7d798d348ee314e16742f59b30afe5d0b78957564d5d87425

SHA512
6a2e46b09823be58fa2ebf16f00bd00e54d99aafd3c3931d5bf90b35c20f3eec00152eec24e3eca02330c87d2ea0efef1079fe2a6941c8977877ab4aaf11920e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53bdd0f9f7ec63f15ce1790f9b11c094

SHA1
4ef494887d3afb4171f795b1736df290c7248e83

SHA256
073e7b9ba53e212c90bc645b6c262ba5ad973f4525c1669bf7774d414364baee

SHA512
cef3297dd8aa8a3b44823388b40732bb9e49cf36ac0daea2ccb63fcb8d7ebc432fb8cefe100d745c7d4f2f45538cfc9639fafa08fd0ba1247398e08f7a312a04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2a7c0b2ac8240aa1942f26157716b18

SHA1
ce909b743f60855287e7b07b3d91647784132ed9

SHA256
15d7d3ff8deca8756a302683ec006f20d81bd381bd478cbfea6f8860fb641f7d

SHA512
1ac920d0a59d8a4d4ea8191ab2325a367e9bfe108e5bb5a9e9043212a32ac5a554c77cd497067c2fd83521d66dc57462575b2abccd568ce23d13aed28db1052e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
817ef7c9a56ba193ca6cda09935a5286

SHA1
ddd83c43f7b200fa03bb270a668663bcc6c522cb

SHA256
c65b8f7c49da35c11d5f9a12e0a9e2369f704add461d474eff748f4c8785d60a

SHA512
7f8db6574b770011cccadc4506ccfaf20c10db20c9ab5ce95ddd12db859bd41dcb87aaf74b1a6aa715f26fc31e84074f8cc72589c6d13dcfe0d04809edfef9c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4546da2d404b6677731d49400f463ed8

SHA1
4f4ceabceb256f9122efcbc4021241f3dca57c31

SHA256
49838a345f1919ef2dbf36ae35493f9162d459db705e1dbfea193dfba785f021

SHA512
fcb7296d71535545da397c245a522f5b9aaf9e2b80b8cf6edea728ef0f37f0f09a66a5aa06a994efa4e14912cff20fe11fd2d17bbea506ae7fe0ede4d21a83c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a0c546ce14531f9a4314b90cef56c6d4

SHA1
65d5826619fdaf8f5d1ea08be5b5dfd2fec4d941

SHA256
619b42e9e8c727b5e1ed9bfcce940a6a20b352f969abb97eb25be7b4d719ce5e

SHA512
0c5e6a6e9a33033a1ebb5ee0657e9405f2b17933dd409dd2fbdf8aa93d3ee42d6e24cbac827506a1a6344db1b56a174a58823bed5e7ce0f68d6a5fd225539e24

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3102.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3172.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit