55382b883ce16ba470f0628470e41478783bbb63329678eebdedc427ea1f4b31

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
15-05-2024 11:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

460d1db980302190325be4da6a8db773_JaffaCakes118.html
Size

82KB
MD5

460d1db980302190325be4da6a8db773
SHA1

e1fe195c1340942bc45f6148e882783bce6dc8e0
SHA256

55382b883ce16ba470f0628470e41478783bbb63329678eebdedc427ea1f4b31
SHA512

78123fce8267db0a4312e3b0570bf45d7d911c5990571bb0dbf22a3013c7fc59cc993d175b0cb98416253948b49287223ac79bf32a552dcb18bd56dc836627eb
SSDEEP

1536:opPMlbN6FJbTM7NbdxU5lSWE5/ezOlSYqKyM4WvsUWZkojNqZnR0pD:opPMlbN+bTM7Nbr+E5/ezOlSs0UC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DOMStorage\m.stripe.network\ = "14"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DOMStorage\stripe.network	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DOMStorage\stripe.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DOMStorage\stripe.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "14"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DOMStorage\m.stripe.network\ = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DOMStorage\m.stripe.network	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DOMStorage\stripe.network\Total = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DOMStorage\stripe.network\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DOMStorage\stripe.network\Total = "14"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5E564471-12B1-11EF-9907-E698D2733004} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421935715"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2152	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2152	iexplore.exe
2152	iexplore.exe
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 3012	2152	iexplore.exe	28
PID 2152 wrote to memory of 3012	2152	iexplore.exe	28
PID 2152 wrote to memory of 3012	2152	iexplore.exe	28
PID 2152 wrote to memory of 3012	2152	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\460d1db980302190325be4da6a8db773_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2152 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
27385a628bd7eb456fdd91b314d11472

SHA1
f6c0bc60dcc5bfd28eba5c03935ade9c7d0d5a1c

SHA256
5adaa2b20bbae74c18a6a2bcf3688cb98878ce8305ddfc228c10386bbfc24c29

SHA512
21a13f9b7fe8d4d99a95bc69b9b73894216cd837a6ac08e904e467b3bffe468731da6098bc6b4c51da69b4d93044fe66f2510502061c2b089fdadef4d2b2695e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c1eb21697196d21cbb4d95ecbb331a8

SHA1
3f465fe7bee07a929d50c0dc58694f3b4a3e717b

SHA256
03830c537902b6ad49fa5eea565abcfeddc7faccc2314962a30eb51d2ce7a46e

SHA512
dbc94e6275da9f457e912de05baf7adb00700cb111299e677ea04a991097ad379da49bf7c7da882a5fed3a5a37204ca40282886aaceb039bc6929dcf5baefd4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
afcbcb13d430ce879bd70f27341e9d1e

SHA1
652b772c1291286dad237510bc8f3bf5fbd7059f

SHA256
591934787f01b811be039c6b46a199aaed20b3e18da46ce62665dd2a55f10657

SHA512
7f212ad1203612be9ef557d7df9857894f7123aebc6f826b1f39a9bf34746e1db18dbd2b78b4af945b2e36f24a19dbcab51c67c622f84e32a3eeded90aa649da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a2201a75b41b6184517991ae8f7a37c

SHA1
05b5ac228391f1cad8baddbfa412f4c72609561f

SHA256
9666ee0cee48363bfc74e20aa64375328820d8466cc5b640ca23512418841eb4

SHA512
40687bbc28a686c20c04dd8f09cd5129afdd5781450a61575b5fb49fc69d7e60709b1f68c927e9f453913761bc8186527c401dc82b4d3cbb8bb907a071d5d463

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ea1a2ce8c5ea01cceb72c02266c1d40

SHA1
29c57f02e1632d16064665b79877b62508355c40

SHA256
3c7bdd6f4360c843c7617f073859a64f4217c1cf8d591a8e29112275318ee970

SHA512
72e1b135747285d7c01fc960b6cff4db25276bb423de5485d7518aa39cd56315e0bc678b1379214ec427ec7ef4a74aa38db0754d64f8502062c10f0ea0d17516

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3676e1390c5b98152543461a19c76c2e

SHA1
3dbb6c73b1a20b9a526d3bdc5cd5641c0209d278

SHA256
9e06ad7fd9a14106be8bd7002c44436b124bb147164ba803314d531c8c155d23

SHA512
48d358083f853a825f9e435db325d8fb466ada18eb873ff93b59172d0b688066893e819fd63dbd0206ec0b9090a7a926a4d1ce73281bceefbbc38cfd2d4d05b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b1417df29096549e891b3bbe3ad660ec

SHA1
f87caa7b0beb5bc78e63a170851ef97a120be36a

SHA256
8bbf816cc6d464871b2ffa59b69a6784679518509fdedf3867e1e7151f2b06bc

SHA512
32beba009d87acd072a9cff430d7f542c09504328af0cb2408d538f40fe61568970792b896683749576b9c9005fdb9c58ac5813e4b8f463abcf3a21dba26b866

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76db4c37c2566e2c58eb68d39a369fe5

SHA1
41ed49ec312e2e1a360d267ad09c8410d668591f

SHA256
c2b8c2f5c98e43368e3d30000be875a6a257926a64484c3237449dbd2279637f

SHA512
946b1965b1e8768b8d24b510c1fa0b6dc6f46883d686689ba17f6d1befc044e9fdbef88fc28dac1ec24ce50480ed50769c375921c7ad421e0bfcaa685501835b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0fc3828b5b949c805dd1566c8c635b0a

SHA1
4c8ef7b85c59486f4cdd4331b42dd532a7080316

SHA256
ae9fba807ac37393b01d289b00094bb48ff5361139ea106aec0f828c2c4784a6

SHA512
a2b836403ca552a2d1345e3e17ea1e1bee597d63888d782f0bc55abdfbf19640c026fb864a665015a757368482c98fc6a57dce5ad725535d5e5f88c7c8ebe45d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73079e8c9f3dc3a2c782b08e919a1e40

SHA1
a32b957e6d41ff2c35e7f358277ae5a09947234f

SHA256
4b7e0a58199326ea45503897759a172e6bf88280f8729e7fcb6e3dadcaf1576c

SHA512
22ca0d862e3604f6a8125619c080484074ec2c9237e5d684ba93a8f13d2be2b67cb799187485e1a88194e152fd690c6b90ac7b4cc17b3055ec150ffec31feb14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9ba28e3062b410dd87de1fa99cd62df

SHA1
84344af6c582d52181faed6bc68863e9b57a305f

SHA256
c49f9405ec5c65c1e093d2ef46f2eb803b5a41af406bb62f9b898e5aaf4dc3f1

SHA512
2e38980a117d70cf2fa9d618f371e88d6a8a887ab06966f7f809b40f583e03435b8240bcf7fc2ee045db317344502417ea5dc68740332e307f4c8398580d9286

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a5fec003437ee3594fddc472ef9260e

SHA1
e6a35373193cc3a2bc639451368687e1082b1606

SHA256
a3247014726c08a19619d9270761957f5f762cd8fe6040f3ea4a149d723f901c

SHA512
48a178345582d820c11b23abdc545c4b82ec819e9f0f521ad187b2eebebf91b1ae7214a798914e74d80b0278aa5882ed25156759b9fbfaf8fc3dab9605460577

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8986d9d8133f1e5983883ccd13e38465

SHA1
8e0488dcf510444a217c94ac4c434332c0c5f3e6

SHA256
762a2b800ae79851314bf81e92d5f003f8d57976c136d5746012224b52bb03ca

SHA512
aec23ffa36248769593c1ce9ce6da6134eddeddd2f10ba9d4812b9c3ccca5e13ab92729b071bd0af06d7c1f72a085e11ebf44dbb7037166a249c1031a3af952e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
2477ebad82bb45f0dfa7900743178cd4

SHA1
37f8dd8788ba677e54daa661a1ff4cb0affa571e

SHA256
c3b729f499550ed6485b7c94de0bea81c78049bd8535d26b2abb69d9764bfcf1

SHA512
637c6ead5f0a37cf26d5e2ab9c86cac7950ce0fe7e484ee3a438d8b6e7ac8fc1307c5557e60afca41f8d0f888465a97c873760697e253c9a0a134d35419d55e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\1SCCO35C\m.stripe[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1A26.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1B04.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1B28.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit