faeadcca2e4a4c8948bbed6f9da4ca4c7e45b35fdc2e4f0f729bc47f620127aa

Analysis

max time kernel
149s
max time network
154s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 11:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

34885bcb77eca09701ce817afc1c033c_JaffaCakes118.html
Size

78KB
MD5

34885bcb77eca09701ce817afc1c033c
SHA1

633b67ad74fff0c4efc0158478d2bbc3e186dea9
SHA256

faeadcca2e4a4c8948bbed6f9da4ca4c7e45b35fdc2e4f0f729bc47f620127aa
SHA512

d4d9a0edacd3f6ed8f2e6af8441cad0ee6561c0466fac870258fdfc6ceaebc0d9f3a01082b48602fc810e79065acf1c59298860e6f64360eb7f15f3a0a00cafd
SSDEEP

768:CPh7ye2sH/MXgyjCKoBfuS/7h7uIuKzNyGsaMWxS+uGIRw:CPhxb3I+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426772829"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A6282371-3EAF-11EF-81BB-526249468C57} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2368	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2488	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2488	iexplore.exe
2488	iexplore.exe
2368	IEXPLORE.EXE
2368	IEXPLORE.EXE
2368	IEXPLORE.EXE
2368	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 2368	2488	iexplore.exe	29
PID 2488 wrote to memory of 2368	2488	iexplore.exe	29
PID 2488 wrote to memory of 2368	2488	iexplore.exe	29
PID 2488 wrote to memory of 2368	2488	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\34885bcb77eca09701ce817afc1c033c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2488 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
220c781fab36862f26914b416c775d20

SHA1
2c0831e8d0f375425a4167368d0ca9f957f3016a

SHA256
edfdc9254bdc89b9ca13cfa4aa66ca82824e02e3c2dacc6a88e5e1c309f23cd8

SHA512
316cb7dc917300a6add2cfe724efe73c82f4ce5531d7e5cfc9b40289fd80d9cd01740cb80dcd33a2e1555f769fda5fda8905fde916a824b1912b14452aadf367

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6ea51b5dc5c4d1cebf4f6d851349a92c

SHA1
b670e155aa1b3a0e0e64d482f0df434f4c176407

SHA256
acd615067c5a11e0a8dd6c7a6b21b73d31bb92f79bd36695bfb05e79eed1152e

SHA512
1228eb68fabbbc1f720b6bb3dc5b8dfb05d29193502774568038665b9054662529332e617873fed2828cdfe896cc5b8883b74b41b1b0899332e8bac4df34e2f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4bd5a06867ab63351cfe0755b5982304

SHA1
7b413fab73c3e562d704e394dd28765b2d53a5c0

SHA256
2f0b038a5aa2c6a50e343b388cf4b5a5a6e526278a85da753334bc67e3c194b8

SHA512
64e97729c2b66d69eb96e2f30c88326000b04d58498c6984b5051d4f2ed44339fad18a513a2a10d8b2f6e5bb908fc1bc3c3c388b496c966e4d1f4bd377f23800

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
40eb86c9ffe14d0ef51a93b6796a3716

SHA1
03e291d81d99bb98a0902a8292c7c80053651865

SHA256
1c65acae3987131e23938d5c7624943ddf2356d83f40dea443239ced00c10c6d

SHA512
3fbbcea71c94dbdb1a726b3125f3a119e5c1c13bf50b0a28f7a7cf8eb921f1b6d7d8e56b7be3f6307dc90adb42527fbe17969ebf0eeade86daa32bf705753511

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
32c29cf8b12a74407d6a11cc976ec092

SHA1
baea62caf3f41d65ece3918173090ab29eeb884b

SHA256
88f07f67521d52193d14f4cbe28fd373f67ce039bc05b41064321f63bd2d09e7

SHA512
c919d393607eb9cf610a6cbefba58fe56d5d42ef7d7011fae6b37c460fbf91034028e28e4e76037e5453d531ce28bf38e65c6c4a024824afb3685a4eb6913ab3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ee7b852a5fd15cf8289bbb25fd1714c6

SHA1
12aeff7058ad49017960a53b42273796f88afc13

SHA256
0e225e1c674e840be1c116ab7b6cce69f08eb676226e8eb99b139685712d8941

SHA512
c947964f58ee8eddc583b3091129c493d7206b9d3d9e24d5d6154f0a136bdb63236f9663254015e27a6c43c2568f3c8a40d92adf57f9047e8a1e535f4e4512fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
66539ad80d695707a80d7a86bf4a2c06

SHA1
3beedd98ab73f9e030fcee628d68c5ac3b60b6d5

SHA256
92f903ef9fd63154b25cbc6cf691cd60b6437f39824ed1c2099c293bf6f5dc2a

SHA512
8e7cf99146ae798b9b151c3fa2dfd96daed47c5ba3537f6fa32ac2e0d7e766293b209c6f841e47a6dc541dd7f7b8a3d9988887d8a12a5dfcd51d898e472a3b02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9c19aadeff5f465c8ecf46a4246ac21c

SHA1
355aac678077e57361722715467111507bebca47

SHA256
45a3774b738520063a3369a0cfc415c0bb66603f263f588d8c625e833076c2eb

SHA512
9fc2eb8401950d5fb47ae41e6f47cf63cd0d3ba235fddf50456157821a607ee26155e2954a5681977fff16fa3860aacd3bad7d961e58c03ceb5044eb5ea61e63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
361a1750b97b88c1c132f232c6b59f32

SHA1
9413432a0be19030f7ca8a1a8a525e50f9656146

SHA256
94808933d9e4937ff962d91a10398155b3b358813e02ba23a408ba7dd4ca962e

SHA512
5dc4a4cb86ca4d165abbdcf13e7fd2f330facbd64e3fbb5010f0cb2682ec1bb52e12f21531124753555b758c44af6cc5dffb4d95585cf29512e7ff55ddc9ede8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ce9c463859a0c5bd5a168d5fb20a119c

SHA1
a16ac0a78988fe090c818b6c854a49e0e9798c9d

SHA256
d51cc9dd3064410d37716a4b0a723b9e050452b0f53b15dab2976fa8080b1aaa

SHA512
f85604a545097ded7cdc72350653d27fe7cfba198064f756fcf7c4cee0a522c690b5a524cca66c19aa53fde693afc15970df6c2379070eceff7bacc877585552

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFBFD.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFC9C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit