0cdd4e4592e786c6e516ad2f768db6afcec685c7dfae497db4af65f08a63172a

Analysis

max time kernel
131s
max time network
141s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 03:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

33348799da072dfb99cb10b48f02659d_JaffaCakes118.html
Size

78KB
MD5

33348799da072dfb99cb10b48f02659d
SHA1

22c0ad00e324e55d829a2face97b3f3911eb3672
SHA256

0cdd4e4592e786c6e516ad2f768db6afcec685c7dfae497db4af65f08a63172a
SHA512

0366b91650c56aa7eddc74062bf2eef083c9d8d1853966f69996ad5251e2c177eb81a6c1f9600a7613e82cfd4e27f01fb7c1816a1dd36e71dea260f66d200aab
SSDEEP

768:Cjh7ye2sH/MXgyjCKoBfuS/7h7uIuKzNyGsaMWxS+uGIRw:Cjhxb3I+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0CCB3D01-3E70-11EF-9CB8-C278C12D1CB0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426745512"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2988	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2384	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2384	iexplore.exe
2384	iexplore.exe
2988	IEXPLORE.EXE
2988	IEXPLORE.EXE
2988	IEXPLORE.EXE
2988	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 2988	2384	iexplore.exe	30
PID 2384 wrote to memory of 2988	2384	iexplore.exe	30
PID 2384 wrote to memory of 2988	2384	iexplore.exe	30
PID 2384 wrote to memory of 2988	2384	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\33348799da072dfb99cb10b48f02659d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2384 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
a66d14bda217c08e11daadc101ede6d4

SHA1
d11848042fac1ee10e3fd735ede9f4ddfa2ec7c2

SHA256
bf9726108fd30ee88e3cde1682394c5a3e12433c062d39b75c85d3c2ad3920d9

SHA512
a905dc6be4d2c93b98226dfabb73b660fcd59d3917b85677fc61bc0753e31330fb7f0ef76f5b7a318717b3301415602998b93da643b8d31f092639f7106273ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
6426ff6e3d1e660ae6d507a4cc199e8e

SHA1
e834c1d25b7919b4d36e77bda8c3bf04535cf398

SHA256
ce8ded3ec871adb0a1d50a4286c43d01944be8f16ad4f9876265dd11951f55e8

SHA512
d93309ff8a6992fc9154f9f3b164d1f98c6000fa4e25ea7205cd05e48d47f420d3fac8bf7af19eae795e451cbd2ae72dd6b4b62ced2674dd1ab8cd94e83b73c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
3e70bdbea5ed48b5843cb67ebe7dd678

SHA1
40373a830fa36acd40e5d9702299f9ddec8b2ff2

SHA256
b31b594af859fcad775bc5564fbbf3e3ee6fffb351d6851e720a5ddd2fce4147

SHA512
c2479721cf6fcdd3332a8891e2a9f2497b760b729b94ff0bf3d9b6015fd79189614e10b86a266c350d8bffbb4a86adff9932b59acb5fade54f07d4cf4185c19f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
dc5620e730c2e12715cd8bc8d7a9d4d8

SHA1
446e98169ac782ce90d161e8ac8aaebed03a0379

SHA256
1cb788e4ed0bf0c558032d2389ec8d24cb4b5903c543932eb4c9b3f365a68f4c

SHA512
f3d7d996c2ff36db08bebacdeef84dece4b38a6725400530082a780be90c73e151ba383e5dd04af468f94f8b0e66c71e60a90375e66dbae99dc75d031bfdebbe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b7faa5747d928654bab55122e6cb8c41

SHA1
0e1b2851513a1a1950afb6a5afb6d1c7cb25338a

SHA256
7cb0c3d44506a16db7cc5d588bdc7482a3ba9ada805477da02dd8c564aa3a24a

SHA512
a8fb2b4538551d45b875283f48237edd79af3bedadf42c48991d2118234247f41f633ce262b7f3f1527159dadd235b500aa0b91ed1dadb55be69233e5a46c076

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
bec514c364a53ad7e6ee677123f42aad

SHA1
69bb963561e107cdab4add3be177eaa573bd1d4a

SHA256
8bbccd345645bfa9ad929765d67be05a625af8c0dcfcff20bb2e324616b1c94e

SHA512
ab5b28f515856a33488c3f45803a0876451f5f4894a8bc64e9db5383dcc877273e0d235df11f747531f586efda76ae5f02ba78bda774755e856e317c7f8aba98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
88f0c5ab98bc12f6a37c351c9aa8596f

SHA1
e08256ba0759d0b47fcda77521107e5024bd5c7f

SHA256
83208aa39003cbc5fe111217e9d6092d8e7ba54de28486ca25fb36ad10a40ccd

SHA512
254f2592c26d8899fe15c332982e1dc14c1170cb2536d8556837d26f8b4dcf48e59dcc0f00b57572b0816acf4d59c694ce1f45dfe76e6109d3153044cfa902fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
ee237741884eb0c4e67e0ca70d4a0bbc

SHA1
b577216942247bfd3ca1da310f190bb4d6d05f40

SHA256
d3c763bf09eb26cf669161b9682afe9467bbe16f9c4e409f196a01c23472868f

SHA512
2af7425279f89ce0bc210412cd73dfdb64a014b0ebe70ff5b8c6e176d421662b139d51bd83e23415288568ceac7512c6797654aad91e9ceec94549e2785f2e8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
e4ad2b3fed1f182ce8568171f762ecb3

SHA1
7e622767347140b1cd7ee5114ac02ea9e1f6a3fc

SHA256
7dfa346adb72a8c95113bcd228aedcf56cfbd6908878b17711ced3778dd42a96

SHA512
909797db1cdcd3d67965e82cc65fba1e8d4ce3a11e68cf4b446c489719e08c131123fa7d06fc060863f9616138e8a35413d14be2f311bbdc60f089f3d311255c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
c3a95bf3b1f115dc1a66704a6eee04e2

SHA1
e389a984965b8ff3ddc877117375a67b6d018249

SHA256
1fd3ae177b2fa8f47740b11842fbfe14f14b0d20db275bd1fc3aea0dff118833

SHA512
080ebbce01bad67bb46c70edae9ef8ee7604de83372cb0ef6336379f5cefb99ac1e329e82161ec62c41268bbe994bf9485ec95ec6fc49feb22d2a6f2dd214158

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBAB9.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBADC.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit