a307426baaf78544b4d009474ea610523d66b3964cef11e1f140b0b5e8f82bc5

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 04:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

32b9e7aed050ef0ac7c26271ac11fa79_JaffaCakes118.html
Size

82KB
MD5

32b9e7aed050ef0ac7c26271ac11fa79
SHA1

f9d013b7f9d8dcc33b2285879459eec9545af01d
SHA256

a307426baaf78544b4d009474ea610523d66b3964cef11e1f140b0b5e8f82bc5
SHA512

202658a8edcc30b7ebe18494bf402a81a641fe966700d6109e4344b4f78ed806a42ea7583381ba09f5e618fc04a5d7055f26642fa47d3961980727b8107329e7
SSDEEP

1536:npPMlbN6FJbTM7NbLxS1lSWE5/ezOlSYqKyM4WvsUWZkojNqZnR0pD:npPMlbN+bTM7NbdgE5/ezOlSs0UC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "14"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DOMStorage\stripe.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DOMStorage\m.stripe.network\ = "14"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DOMStorage\stripe.network\Total = "14"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DOMStorage\stripe.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DOMStorage\m.stripe.network	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3ED96BA1-0F4F-11EF-9BF1-5630532AF2EE} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421563717"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DOMStorage\stripe.network	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DOMStorage\stripe.network\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DOMStorage\m.stripe.network\ = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DOMStorage\stripe.network\Total = "0"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
956	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
956	iexplore.exe
956	iexplore.exe
2140	IEXPLORE.EXE
2140	IEXPLORE.EXE
2140	IEXPLORE.EXE
2140	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 2140	956	iexplore.exe	29
PID 956 wrote to memory of 2140	956	iexplore.exe	29
PID 956 wrote to memory of 2140	956	iexplore.exe	29
PID 956 wrote to memory of 2140	956	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\32b9e7aed050ef0ac7c26271ac11fa79_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:956
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:956 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d9798eef48923c3802797ecde64d9d7

SHA1
db167584299a0fecb67292a0a84a39b3ff70c5cb

SHA256
8fc0335ebd0661f7902b50e23e5a157aeb120687516c856209a000434140be7a

SHA512
15ad8b543140cd1892401f0f8c28563a9f1daeb7c6e256c454f6565e0294fc92487c754ea74f01110bdcef9316dc3cfe26fb3c86782332695f45d3c076690539

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e7f61e83c3517ac791d5e8c9b045f3f

SHA1
54fa58f9eb6178712a89da78eae9a068bbbae6af

SHA256
faaeed3e54a20e4be3b95ff0b9add0fb3aaff6c7992654706b572c510c8ef7a1

SHA512
9d9d2e6135d9dca99672d9674b828205f7bbd80b42d1eb1702c3eb680a024d2fe8de865779c7c0ccb5170ff8015fc7a2148b025ff335262c151508af45c3e3e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56cd097a311c8de5950f70508d5fcd9a

SHA1
6576218d7c6f4812940b2cb48a0cffaec82430e7

SHA256
f3054f797283256bd343851b858aabac548747e926437ec993e617e009c4da9f

SHA512
27c4f6596660097006414e3548309c32bae8d99e020228eeddf17143aa1e1e5112b218cdfd306b8f3604e28d50d3cafb4002593e2e53501476b1d7113194c2df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c952cda348edcac18b286e325d3e0f56

SHA1
059d160858a61383abc07a7d66d8221f6a928641

SHA256
649d805fe82f4b5680613214cefbc0dc6d4d959ffd3fbd330cff62d4ffc9c7fe

SHA512
18994f196b1249d6da3242d554eef338ab71eba8e1fa98138760a23476d2296553935fa9e139007087cb11cb7115647349582bc1f455f18a79066d693d90ae37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0279d48198c79d86cdff93826a7fe5c3

SHA1
f4041a54e0aa34941b1828c3abf7d703bd44e9f5

SHA256
23f808a675fc6db415429e95a0a5dee3ae3b8dcb42501a59fa115d75df5a611b

SHA512
836e3881dbf2c8976c309970cf897f73cbabaee104628a0aa7aba9495b37120c2b4fb734eeef06c1b37b20919dd8ad7352e7135ce49fa19fd4daee224bd5da1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8e88b247e417f0a80775a2b3308ea20

SHA1
837cdb4a31af6013d4a7ed9ad8739d2bbd35f229

SHA256
c0fd59011e92664d5db7492966644b655084b0b7d10ba8be97aa44e2218a0c06

SHA512
17c9f33b565a7b9f060246aaf87c7a1d8a01af675da9d0d52ece66f07de4a42629e26c0f129301f6e139686c2fd31902b1a6212d5a0b8e212cf284db1116d6da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4ddcea9a4cb0f28c6398683dc19642e

SHA1
377b5445cdfda101c748cc998144a04c0259d488

SHA256
7a14e1a15f44665def7833df38955ed4938eaf6fd0c40114c91c17e7c86fe39d

SHA512
e2b8db68f4863c1cedd74b71c00871d56de83e1e8c9524286c1b760406bc463022019f9952fa35eae109ef439a8b2a9cbbf4298789a5db728c9c452604217822

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c36469c7f9df0f09bb06c238f90ad26d

SHA1
7951ab117c6c5e51561c0f6bcd24e94b1cb88d7e

SHA256
43c8f4df62ccc3820e7dd0e2aa58159b90fb405c57d243f34d52d9f38586ace3

SHA512
00b41f899a034a81f52f190e7749b35ddb5ccf50a570bb16ce9cd7cde3b793f7d794bad32de25d1acba8eb3bdedf055d7491fcff9daaff472b1d148abb149f9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d86c65afa8a66fa679f427f902d572ed

SHA1
cf3bd3904a23fd5337760475dc1bcc017b9d379c

SHA256
2e4671b7ae022077d6007cfbe35fce037a1268cbc708eba0ea6b0bb058563580

SHA512
a771dbf59e4a40743569aeab07925ef6137e462e895493be28f6784e67f7ecb3c96d178d4438b09dade56e68c7b59ea874bb16478b771123bb674812c42909b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a5caa1c29e75902350fa9dee40c6715

SHA1
35c9e3475931a7bc261285a743508e8fb477ee41

SHA256
bb9d6a7cd6898499c3417d0f3c9baadc242c308f66b3f386102a34120114f5a8

SHA512
d43e0d3e4b896351b66691e0b58653cb0ff4217590b8349ae98be66ff89c449cb5dfa0785e90f91f6afa8e8e3c66fa7d793927406979521af2fb41d8c60e9aa0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5290ce38307c4dbed8b4f2da88ca9beb

SHA1
b4670dd9e26090a90039d807bb276bbd5708a43b

SHA256
f4cfc346071bcdc6055e4fcafad693da08c6b4908ced80c5bf38a113000a8ead

SHA512
31b653ae83d40fcd9ef81146211803914b1d1017c2975a4d40b4a6a183f57a3a0fea72c5efcc6c779cf01f0327b3182ca3545c7d491f826ae0762617471c0273

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5725856a88313ab3fefabf615d150706

SHA1
2673751cc6298c6a87f905f24b45e5b73674fcf9

SHA256
659a78558781be194db08f5c8071083b49c1cc30428b12801f480e7bd8d9d82e

SHA512
5f6e4bdec674f8a2964fa83b2182be05d62c0ea3dd482f015c1215d8eb64a361184746412380fd4bc968a735d98dcbdb8dd8ab9615e211251c7adda3f999cac1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\VYDA1MQL\m.stripe[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1758.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar17BA.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit