daa7a3bb2756a0a9f2f308678cd88a41a05d4f40faddbff358d37c38b7e56040

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 05:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

746a9f1ab86bdcf76d8181c4720cfc50_JaffaCakes118.html
Size

2KB
MD5

746a9f1ab86bdcf76d8181c4720cfc50
SHA1

7bb28c40d59d43a135d94b0b971a843caa78e4d7
SHA256

daa7a3bb2756a0a9f2f308678cd88a41a05d4f40faddbff358d37c38b7e56040
SHA512

bad6be445a533f8a7f312efbe0cc1bac3cc015a66ee606d157f344315408d41cd796ddd6152a130816f9135ee2fedf18a80b982db3a86d76d3f11e82bac0964e

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000027f60be324e6172f371873b6429cfcdc1a4828f5cdaa050ea28028f777dd0287000000000e8000000002000020000000a9f322d251484d4c2da06b5e5d9be6dca72e4d76e2246ae159d0a7d59e7b2bd420000000f6035553da0ac3e52a206a9d09bdeca348b472987080db85d460783ce0e0428740000000c764e172210e851f0da7487febac8db4ffb2eda95d8b6dc6402cae7c9641a196d02f075dccab4dd068d0cb6ea20d188e3f239c6cb9465f2690c310187f5457a1	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000076894327a9614e0ba2423c06dd37fed97bb4624910df9a134b1b489c605a90c3000000000e80000000020000200000004679d18923569705b0e3947be1a8a4192189808de25a7b98a6a31552425f5d95900000009f3315f6ffb04ebf36d90d82f9ad18133e44b9bca2b50907b868ed7ce22fb18e8eec7d268a03e9c4bc6353d97e78063addce526b2a9e2b09221b98f852c5af9e4a128b412357d86c789d879f8a84917cbb36ceffa74f295366b96e9d59ac1ac5b4dc48a38900009d5a5730814c6f94589b2739a9eaa1a7af23d744d9e5ff4d7056fe27920d37633563b927f7d051d1e5400000006c6dedf67b2a24922113d2847973a307d998b6d5b15bc4113be8ac8c05b6374a7bade09c7ab883af3dbed622572dbf6182c28974cc0b09f23909c904759d7fa3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3168BFE1-1B1E-11EF-9F9F-D600F8F2BB08} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10033e072bafda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422862064"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1648	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1648	iexplore.exe
1648	iexplore.exe
3032	IEXPLORE.EXE
3032	IEXPLORE.EXE
3032	IEXPLORE.EXE
3032	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 3032	1648	iexplore.exe	28
PID 1648 wrote to memory of 3032	1648	iexplore.exe	28
PID 1648 wrote to memory of 3032	1648	iexplore.exe	28
PID 1648 wrote to memory of 3032	1648	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\746a9f1ab86bdcf76d8181c4720cfc50_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1648 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e9830a8dbc420f1f889f8360d54ecc7

SHA1
ecd43c34934c17ce5e592978fc75c3291527a8b4

SHA256
254ed0ac6f395fd807ac10e1dbd0633e3d3e0b77bae0411494e9eb01bfead97b

SHA512
e50c1b3568f3f2a41bdf280fa042ef0a40830975340dbe46975b30d93eda6ddf070cf3477c4c4305723dea6e2cd7dd5ccf287c95f8366c15f238a355138ee0a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
10bb9e90f1429498ae49ac58c9016b41

SHA1
9e95ed88d703922607caf7296cb0343a2c9d5081

SHA256
a9684f327343b754957b5cf7365f353f1b220d7ec5518cc8b5670b21fc16403c

SHA512
588e533767578c2d2bd73df70a5116ea4e8b52d73dab3201759e2606d47ca3b27712096c5dbc7e538f5c718d5aaa6bcb2fb4ea6c1916b198d24c58a7a6bde8b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85f69103a2e75a64dea68e6bd6a73916

SHA1
c5a350b3eae6608becb0a1235a342ab5c9c4c38b

SHA256
1a7300231efa395047ca440465896cd7fa3ecb74972120fc07c6d3f349109ccd

SHA512
a09d1805cbe6a2aa8a4304e44be8462a1f4c28b33815fcca3f9325d440ac48b09206f8eb10528eeafe5ef7325b9b3a94a2677b86886ad8e40646976c4253e39c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d862886b6f5f31450a851bbd8f0158f

SHA1
b05cba02d7b81a37b6dd71f8dc308af75aead68d

SHA256
1d958ed93aed6beeb905ae804a069a020c2353f9f819203a028604cd0bcf35d4

SHA512
3e62d2b9fd45b0acc455081da0264503e3df149f3fee23feac0ba6fbc7c8b3ad4f276430aa780077a74b0afbf0a6182d482c212c4b7f8c4fa13df4c2c40a7966

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3fd0b2fb7b31a257807eb39d6101406f

SHA1
861a89507071aa5dbca53fe8a8ab5454c3ce352b

SHA256
1c502fac7900e1f2909b6a5f6d5d5269eab77100ae50c57235dc073ba90b5069

SHA512
358914f43ba30953cb2cd34d31a35715abb44587af40ea106e505792a9f99bfed291899ffc02eaea6a0cccf45e2b3146c5013c1580bc034252e44f967e532ca1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ad360fb7197e79a38117dd56f5ec95c

SHA1
a221f26e42e88886c60cf3d9bf34bd801f0e17a6

SHA256
cea71892d27cc883c2b5bb467a573f462abae681c613ab457c15dc6f53fae851

SHA512
834bd2ffb7126f92eede8e486fe61767eea934a8fc0bd2f44849e6db1be3221456c87ef8343d03ed3d3ff24ca3d58e119a85b15fa48214b93674875a038e7215

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
856f805995dddc2d91ce6a868c3aa034

SHA1
10b47369431c9a115315b0f57b7c595a302914e0

SHA256
0bf21137d61180202d1a56b1666426343c8dc656aee831e72a6591efc57814bb

SHA512
7bd23f3b1e66110a62ddd87dc2d4e456446a6b0a4c2c7ed9e2577828723cc06d075b1b09dfb78ff58d2a253641f22d39712bc62dc60c0ba5aa9e3dbc72208139

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
28e4287699334827b97f996e6ecba6f4

SHA1
7dcbaa46b2d155b97d5c78a52f839e8b403ef303

SHA256
93b72f98e59388e15f2a2929f6a6925fc16430fca72e99ddc6e6b5978ab00ea7

SHA512
fdb5cccefee6d3cebd8958a67dc9a3aee7d8f584a8336047ae9d07f5497c7bb279ecbbcbc58a9292bcf5a7cb870da2e5c5bc8cce521395861495f9d942e9b111

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
619e832298936b2ef4855ebea9a8a73e

SHA1
e8176f8b9309a4d927da445b81eba53ebd294a45

SHA256
bfbb5707639e6b904cc8d3bd5fc682b7129be0c3c147fe3ad6440da005c57368

SHA512
5547d35b02223b272d7b3f53c312edcba69edd2a291e11864bebc1b6af216c8dfc28954fa81cad9f14b615cbceaf4ebb654d08583a08a8681492439e60187206

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb00edd03f4e54c98b88b3c935701b7b

SHA1
2048a1c2245eec15b616e5ee231c7b7902451f9d

SHA256
613818565008701abd5d5a190bb4e05ef51d361846b77430c015b4b221c36ac2

SHA512
5b996157b19dc4d883ac2c1f8de67872cc97c38baa394a01f3e1a90753f35f8d4b856b4176efe21e62f746c444462ff18d342a4525a419f28eb65465c48334b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d1ac72698f310014b4e1cbb78c1b3c82

SHA1
56a5be4f5c5fafd3a6920facafcaabb6e7a69036

SHA256
982ca810491ee3f7bc68c868602570f7ee5ca18d701e19ec1f3c6f1efa12a4ff

SHA512
72ca489c530cd2df54a0dc4d9636e151f522882f7e90cf94fbd6775cf0fe912ca4c157ed3c1eafb706cac5ff67c35f5485f26d868a3dd358f3e24292ad53bdca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc715a66cbfc7b6ee04735261a7e2370

SHA1
d7d67bfbce472811284b5591a522cbb20e11a8df

SHA256
9e42773a14bf31fc836128a257c2b290b0433a6c58ba0c3ff20e7dbf2674d411

SHA512
c23b7b3f23bb714c66c84b4d62a3b7c9157263f9a90a3f8e5a5d5d962861676aedfe5aaaeb10e7444a78cc1de71e86470ffa4b3b7eaffc77da369977849c2f3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0cc3a51769da1ab8822e81baff8de92

SHA1
4e576bbf1df30b144245b2ae5308aada941ad255

SHA256
f7f4a6fa1966496acb98ccb0a26347315b23bc4f110987e8b5564838bc92bb6d

SHA512
7f87b2055601055f6d9d9c718e13b8258739b9806c64a586ca512d92d1075b0ef0fe6471cb6bb38126783e29530c9665ba07c7b0219e1feaee2b07875e5ed052

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
98dd2c398f109ea6ec5414be949f2414

SHA1
84b08eb2a49aa58e2d750a179d3d50e0e5e88538

SHA256
dd4ba24beb32f822477f09108432a61b2d586a5fa32d9c98bc04f64550fef230

SHA512
3fb978d2fc35fe748cbf7bc7ac0a2f60d283c30a42efe2d0062b0550161efcbf30441c37ebd3a45ca734f3313ccf37b171520ba06ba98e7a2235894fb19e66a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
61e9db1f15d14e89ca56739ef139451e

SHA1
0b16f9dd07e72b977127642428696867a998160c

SHA256
3cf27d547c34a0f812e0f4cc0ad9527779334b59d91d7113461b192dde2e5ac8

SHA512
48655c12d5a124a52c1945a4a67260017381dbdfd82de38067bb33160b88222d44f6f848e5437b40b6bb4c44e9d36b9e7888b07cdf6456e3d8be917672429bd8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
575612830b23b88d7bb1f7f1ad989501

SHA1
bff689dcd610e209d36822a4f840d7433f67a278

SHA256
37c37f6b619efc60b3c7d3369d30c60306636ffcc4ef0ea6805b58cb22ee7f05

SHA512
9fe9246dace83640ccfbbf6603ada56fa6267190cdc3523141f3659144a9eca76df558e6b42b3a7d9456254a52cbe5206b080e503bc112280297f93b4fda99dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b9493344a69ca2e3bf16dc07f706876

SHA1
a9eb6ab309035a19d948c5fc60fc3d10cb0f9c3c

SHA256
6677a546612123b17c7ea2056eb0f2cf170a5fb1f454a32bd10b39e89bb438fc

SHA512
4c58ce3abe934cb5ce2c7bc1d8861cf661f37090be4891c3e7a669b7bbd24f49173ed9b1b17629c7ed8bbcfe9afa2e6ff20896d2da33a43809ac33b49c538197

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2EFF.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2F60.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit