84f450b8a5cf1609f8d4c7e9845a6976dbb6ee546fc99f8f7affd5c5c75d9d88

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
04/07/2024, 06:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

24f5f3f44ecdb02fe988c07db05f8d14_JaffaCakes118.html
Size

3KB
MD5

24f5f3f44ecdb02fe988c07db05f8d14
SHA1

0c569a044dc67f2053bfd50ceb3a25003d9d7f7b
SHA256

84f450b8a5cf1609f8d4c7e9845a6976dbb6ee546fc99f8f7affd5c5c75d9d88
SHA512

d526aed87df7919085c811100eb890c31d2b273a15f615444e47e77d1cb51cd6d06b59d2f7d5497b70fc0b8490393c0de4855a12941bed807e75f99d7e6dbcee

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40cac238dccdda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{760E9F51-39CF-11EF-AB95-422D877631E1} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000097bb9cdc1ac9e94d200c324a78b24cf696ce492ea8c1bfaf44f1f7bcf5516961000000000e80000000020000200000005745479f28b32aad03fdd455b9e6c3fdfb20dc4a2fc48651386df09eba34bed820000000fc89519f5dcb7d91556351a9ae7d38d4840c4128d925aa7d26b3ac6d47ebc118400000004b6168c2e37c89c2ae0680ae496345222509ed0fdeccfeb0df135529ad76f4ab5794f66a873f2a8c40e9e7e1bfebac8a1ced3f377a78b98cc7e18a1bcb29bcf7	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000001cb334554bd29ae504f2b99ea5c425c034fea05fcf3393ffe76938ee25c35bf2000000000e8000000002000020000000d0e5ddc0be921fab9f0f1501070f76bbe99512596d18a7bf36fe98b7cff8fc569000000006570320e7c83f41978539a15183d7ed38b4ec51d1ff7cf3fc033d80aba5ef8d292febf0d1cc013f4ef1520317da2bddb8cc9adeae73671e56a3848c21fe2abeaf3586e3e792b772befca6e1ac738e8dbc9f4883e8ced21282a832f3b97293717b8b4a7d5cd822842b91079c087cd61a9a1f265f338b686338d2f25fa88d23a0da58bf390bbed63c0596550608822bf040000000ccda7d78b8a38a76f6c3baa19ff8666f2f232426bbaa667bbd728f38b06a830f9d3329736c024e355eb712c750dc013d29b893e4d80001d1d6975bb2a6c06dc3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426236735"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1100	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1100	iexplore.exe
1100	iexplore.exe
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 3012	1100	iexplore.exe	28
PID 1100 wrote to memory of 3012	1100	iexplore.exe	28
PID 1100 wrote to memory of 3012	1100	iexplore.exe	28
PID 1100 wrote to memory of 3012	1100	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\24f5f3f44ecdb02fe988c07db05f8d14_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1100 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b5c4839b7ce3c83bb536527fcbaa1496

SHA1
8cfd69501ca1ffd4a535576a5fc38dcde13eccbb

SHA256
6732db99e657a5b460e5c8058317b523080eb21882cf6d0f5ed52e2ef9058440

SHA512
b38ad7cf123da5d26a27fb177b8b0bb3584d1857ef0c5829616e3f15efa6915421cd9a92ad8eddd82c5d07a9ce9a8801501aefbf23df411a713fe56482cc80fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dfcaa1cb9709b69fcb41885990f224fe

SHA1
fca7cef180bb7f954b0c98a976554045dd5bf61e

SHA256
357106b0a28c91c546e76f24e4cc20a29b12dc6cbde852fd5548bfdc7e93d01f

SHA512
d6b3f79370cd2680097f95008bdedfda9eb65608852baa48dd883daa8d40ed3b0b1213c15eb89e05652734ee1bfcbe8f5816170d5c151325fb3551da929c60a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a3c8d73de8421dcdb3b87997e25db917

SHA1
cb10b8808a96fbd04d38629ecdac831b879788fb

SHA256
1c62ff3256db9712fb2533942bf5e755884508b411b1999a9206b93ac79b8e4a

SHA512
e788d88d62673da73aab10859428ec5b4569e6a6464a4ac2cb6bd64a76e8e1213702ae7d6436f81176c8c2fb8c281337b773044274c698bbf5d18020bf83fe54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2871bc3fc199f6b29bc299156e2e67ab

SHA1
440abcb286d4762a6b7dff8d8e1082be73583b94

SHA256
a444831258ff2de475c1c75ebe693834e316cb21070a1e645da00309551f3585

SHA512
10c3feb343173e20cc5f29330e07c3cc60a8e709691ee7d50017ba7d6ff59c9bc3b659d5fe35d28296d6698a91c7d26434e9d1c4aa3d6c3fc035f42c0457562f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d5d83a3409a581864f721deb0b26969

SHA1
c54a979bc20fea249d28d1f33bba3b2dcb5e18ba

SHA256
71a0eca7c480b42abcf9db28b8b4acd177572b56f2aada71d3e6120e9fe59ba8

SHA512
63f67f472de1561d911a1e7df0d615f31f831dc891c76fa7db1677cea5c1c94017403f389ee08fd11a03d8d06bdb9befa39addfacbd70234cd4dfc78c3db38c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0cd350ecc6bf0233edeb585b88c2c220

SHA1
747fcb68c1d5e49fbb594808eef743c36f616aeb

SHA256
3c787f5c64b314b85303d9435a57b7736af432b1b8b2228ef64d45442fc32160

SHA512
fbb76e02738200d772120afcbcd96d0f4b737d663ac14bfca20b86d8dda41804a38dc3d69329392ed27ef76f6758a55a17c8ebc40dd7243f3e1c5234b096535d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9baee19ee3fec46c45b149353d75d777

SHA1
0787383b0da0b394256fb1e3f6fd0c1d445654d3

SHA256
65db78fff4e5ace0b9071452da7f0ae310cb6d1fb8ecb057ce757195dc10a1eb

SHA512
1e4fc07ea9b8c4d1a4a23c69c2442e29e657c0402fb45d0ee236afa3d3994030f6a72b58058724150f51e9b9f3ddf86eba2b18b5dfc9c0b254a57eead2001184

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4f1b00ae6d48ca5857bce03b4340aa98

SHA1
43018c2fc8f99d0f4bcf6db86c3c943661463f14

SHA256
18d59dbea737f6a0f39761fdbc7cbc9233976bcf6df281bb37ce9a78f41b215d

SHA512
815ae67e80305963c1119d74c36022bb3e591094f1e39a2dc116db9b5f51c905914c87de938829886c2587fc54cfd756d8a133a7e0ca6b9fafd0e8f9e15480fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fd7b02d2eb9ce80c8fbb388826530260

SHA1
18a065548f0c676fbb370b916c5fff8802743f95

SHA256
6e8b863a9dc1f480032fdd2f5c74bb09242b31623d45d2322ac259b6d544a514

SHA512
e895594749146d288bcdeaf9084fc670b9728ed6a44b7a30ab552d540a9b9091c68c54f084c8a1fa416f6638a93b4fd9a0c1626e4460b4be7a4161b063557521

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
66ca8f4e8d4322bbf21bd82af2e7365a

SHA1
674fc8a2c0a53b91c09ae0931edd169d565e5bda

SHA256
780c80aa52d2f6759ecf50b581276e1ae322af7114a70babe2b38d369312d17d

SHA512
31f5e25c87d7124e14776926716928f86d9b59269a84669cfa263bb9e41115c9eafa83ccf7b15ae05cf1909e7e0d4c7a2de016a440d63da760fa5c9e410f2cd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
30669b0a5464f797cccea14a5c2486d9

SHA1
037bcef386f746d970d2396203839e816d36e26e

SHA256
67d740e376efa5a52b2f614e95bb43e1e017e4a6adece06fc12c78d0224fd6bd

SHA512
f6db75971e9a6bb15a41ad1b657208390c6811c1afba8f0f56026893950576c8aa7ac758ccc48472e4486b7dbdcfade93909a70332984153f3d39d4da72e51a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ea252b932ea14241de6280bea755ca28

SHA1
38bebf560de0e348550e2a97e69920a874956b91

SHA256
f30d16aa82ce14ebeddd9b877b0b47ce9a6122b5e8d21944b651d0cf620627ec

SHA512
88ae2846ab3d36b4f497159cc4c40288392abce500e70b99e67b23837045724f89719f7b24cccf2d331c602c0015ac373c5a857b5fbdc18c36b0d3b9656e8a58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
973594e6749e4a35952a8ac0ff999779

SHA1
9ac68d9d69c735fecfba5a32e2c0787683608040

SHA256
45986ec5bea2c9a019f0250abf7107ec36632fce35648b79c06ec84987f3bedf

SHA512
e5204f65fa28137c451895d7fa6ca1caec931a759fc497174075c5669da0961877b55c78e976b8fd45707c40ee98436d3240a4cba1c189d8f4f3f6915f191180

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1bef6e489c87e56ef3ed0d7d68ebe299

SHA1
10a8af7a44119a9a8e693c86eaa036d9f8b69e23

SHA256
91aab13ceb859e9614dbac9e39cc7ad7ee7d11e28a4c256255b3a53d56d7e761

SHA512
a66c4c4afcd039fc7a7121a001a885a0b8bb1fd2e76e1fa6d443b3e07be0ce0de629e1a371f039beb883474fada958a45f01afd7857eb19fcf81b238cc16f978

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
da9554ba3d242aea00cad60a25f55e9e

SHA1
d839096e95f0eab0c3d0ac6f5790dbad7309b46f

SHA256
b6f04c20f46c0f4b57bef6ad1d086a98d3a4168be6c409ff9c604dc817ea6591

SHA512
49f0fd95581965211d43236b1140bf7c1cb21d873e01c91824bcdde822b412758aeab07ed53ed96c796abbce863b419278a8efe194c4ca42987a31c3e766111c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1D25.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1DA8.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit