e92ae26466a3d27d3c6a68f9b892908577484eead0d2530c78e3e96446e3073e

Analysis

max time kernel
150s
max time network
156s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
31-05-2024 22:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

888c9870a408774cbb9fe07559783231_JaffaCakes118.html
Size

41KB
MD5

888c9870a408774cbb9fe07559783231
SHA1

0afea93dc10c55158f04e59ccb49b925b5fb5df1
SHA256

e92ae26466a3d27d3c6a68f9b892908577484eead0d2530c78e3e96446e3073e
SHA512

d1653bd99aae820e35e9459e19bc88e003494ab1406c12b5ed60051a7a9300f8416f4f836978e86f842972eb93aecaa6a3066796d09ae84abe50b2387310b5d9
SSDEEP

384:YM4xfBdZZilw0A4JmRDspVwQ/vqFG3uhCXxBleffSeKZXB4ron4n4L34UNyahAKW:xyi38FNr

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DE66C621-1F9B-11EF-97FB-6A55B5C6A64E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423355847"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1808	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1808	iexplore.exe
1808	iexplore.exe
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 3012	1808	iexplore.exe	28
PID 1808 wrote to memory of 3012	1808	iexplore.exe	28
PID 1808 wrote to memory of 3012	1808	iexplore.exe	28
PID 1808 wrote to memory of 3012	1808	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\888c9870a408774cbb9fe07559783231_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1808 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
84f3543a2230971b99e19e471dfdc7b1

SHA1
312269f39a9ed2e6cf5ca53b99af70e5cc7f1907

SHA256
5ff4e64eb0832a6a281573a54eef6e2ad84fb9295f6547dd3a8d064f69779d63

SHA512
09ebd442ac427148b9fa8dce69f694a61ff501511893e761caf7e6435da27f8ffb762e2f53168b0586c794eb7bbbfb703938780e517bc2253f4be155bdbf9079

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
59b677aa6103edabe812de6d1bb288d1

SHA1
d01a408f11ddaf082e13191576caeed7ea773f6f

SHA256
2044fc96bd98b53405e842fcf3fb85d88df8ac631c815c2197eb49c2fa0a85d6

SHA512
d36c88122c2a851e5bcc73252bc388eeef93808947619e7eedb928f83056b2453750fb330e2d56696b8bf78c164b613108e45edb7d4fb499e622479a70465a9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
40980c55629ca41f67504ed5646d8da5

SHA1
0e4d542d2fcfb5e7cb8361dd2374e09aef3b7a6c

SHA256
3fcb9311cc25658b4ca9f646628c8a8aad871fd6cab06b22374f619f1f2b8c19

SHA512
afbe4fc1a2ffb986d0badcefb279c9d858a59560be1eff029fc2b0d874b862ea20e37b579bc24b595b6dbc16fb008e81ac83ef6995fe77d5bfddf95e3f48bd45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5b6af6a9926f1db90ca39a1209092e4e

SHA1
b70ee02da12376d5103506445886c5a6605c1be9

SHA256
36d0bdfad6290f1c1af2bdfea462bedcd16950fa7160ab6fc8b888adaa18dea6

SHA512
9e8625fe0268497dd4c4b86da8e2883aec41d11977260a27cce721b538ad834b98852986971e92b2e9fed57e74c34d3deca5f587b8d750973b1007f2f6fab815

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
514039d85f22f6538db42b3e6419568e

SHA1
26dda83fd9565c255be1ce31fcd583fc68a042fa

SHA256
1f77ee6859e58c15cc61fccb655692bc0961fb74321655e43f608ec056b61cdb

SHA512
72676d3f8572c5d790ec175ff54eb61b35f7b6c5313682afc81ea445ef02b1f0a1ac697eea3a3b054ea8b906513582c455e9cf4d548779f6964674cd064deaaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
54247ecd55ad2e8c450725b1a88bff6e

SHA1
0d2e1df9db7e6e2bfd9943243aaf9b44e74b570c

SHA256
c858d46d5eef6a027cb531630a7b2518c1c8e55bc2de625ddd9f5d1d0b2a05cd

SHA512
3c48b3dcd574a7c593775aa04e09fdeae1dbf818a3a06aed8018253f4f64048fd4e049d918836b5a690df7c76012e195afdca5ae2532881a569c2557b79f0582

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d4d278130bdd8863b6097a617e1476cb

SHA1
91f10f9ad7b06018032346c9165613cb20706c81

SHA256
c6c2943b1e7bf03081b4356f6460a01d3520361818970e5b741a96142330e9aa

SHA512
9ea6aa1a73def0e43608e9d7c50d3a62c8898144c081902b6b9b61522f1f14586a57bb4d84cd9baf40b3e4cdd5e52412fb863376ceb6113f5010cc7fec247a5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dd84feef9c21b5f178f388e01d0dd272

SHA1
5937ebb5dd30d6fc3cf38b56b4aed1cb3e57e16b

SHA256
b632b5873989f29d50134b92223084bc77ae23311fa3439d5a9405a9f7e83f51

SHA512
2e6dcc833a938f3d10e05c90a1a9bc66679c3b22d784e3673470168d65d51a02da8a80007b6fcdabc31826d5862687f76906bcea2e1955624f6455b7c60289f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA009.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA0F5.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA128.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit