b72c985ba397244b3500d59dd9a9f9f4cb8176520e585f741d6cb20d93d4c540

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
17/05/2024, 00:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4dac180c20914cd3908a03fae0999322_JaffaCakes118.html
Size

82KB
MD5

4dac180c20914cd3908a03fae0999322
SHA1

0899d7c76bafbf8d2cd40a022c44264308b94598
SHA256

b72c985ba397244b3500d59dd9a9f9f4cb8176520e585f741d6cb20d93d4c540
SHA512

02df42e38644af999003cc5101e9e276144a8b5d84100d1cfbd4c040b5b0351a57aa87ce65ec68b58f2edf049ac36ac75174d03104dc49fd247cea0788ab92f8
SSDEEP

1536:hpPMlbN6FJbTM7NbPxa4lSWE5/ezOlSYqKyM4WvsUWZkojNqZnR0pD:hpPMlbN+bTM7Nb5PE5/ezOlSs0UC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DOMStorage\stripe.network\Total = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DOMStorage\stripe.network\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DOMStorage\m.stripe.network	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DOMStorage\m.stripe.network\ = "14"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{30724051-13E1-11EF-8C93-DEECE6B0C1A4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422066204"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DOMStorage\stripe.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DOMStorage\stripe.network	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DOMStorage\stripe.network\Total = "14"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DOMStorage\m.stripe.network\ = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DOMStorage\stripe.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "14"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2972	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2972	iexplore.exe
2972	iexplore.exe
2752	IEXPLORE.EXE
2752	IEXPLORE.EXE
2752	IEXPLORE.EXE
2752	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 2752	2972	iexplore.exe	28
PID 2972 wrote to memory of 2752	2972	iexplore.exe	28
PID 2972 wrote to memory of 2752	2972	iexplore.exe	28
PID 2972 wrote to memory of 2752	2972	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4dac180c20914cd3908a03fae0999322_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2972 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
adb3f0463ba4e04a36716ee0a1d49e9a

SHA1
3555941ac1b4471249e03267e48e810faba7c493

SHA256
0c3a3a918776e6397b5be857b030d7e43791cabb977c87312278cf0726830957

SHA512
10d6e8a4d64d1286719e885a4c9e6ae73c0736847dcb0e4fa8bd64471caf889c0bead835db4a810b29e9abd6ea3ac8e6d6a52cdfd6098995408e610842a1e424

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b8492be341f389da81208566adde48a

SHA1
b6cd70eb5f7f135baa02b8a88b78fe03c45a75d5

SHA256
79047d474ab31126c8482653ba13d5402da539f66a2b2e898b9d5cff26be3245

SHA512
e88dd418954f00647a4785070faf63c393d46c1f0817b209601e20edbd5f603eb5cd24143c14cd8d883f2db5cc06ec3e4e2ca811ce1fba52ac92966b93988e9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b21e16d588a843d1b3bf4f558c00d711

SHA1
d785b1a1ebffcfaaf9518ae35880a24bb8ca2342

SHA256
92dbd800406e4cbebffd6f684fd31937a123deaa0449beeb6946016586253bfb

SHA512
6e7e2f5b80715f6e91114e2279d45c58c05d78c5c9a2cd31c37d231cf9dbfdb2ebd32833a1298830eeb796d6898be751f2facedbd6f63be61a4c8c40c7a4481b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e1e069cad85a61e6ef2c5068c67d21c7

SHA1
a1be59b79ed27c2bba2f631c58eca6ce86933d25

SHA256
ab78de3197301fdb2713e2813b06cee8f1dbaa765efa2fd40a70f63b2bec3e23

SHA512
084abe047418972c2649373835454117030fb281a93e17205ed8683f7e7a835a35e925850639962ec7ec24ac9c94b9a1d1bb6ace615bc8c5e517515a84b662d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6b6206b04abd2377a03e90a5401fd43

SHA1
2bf8d2251c3cde44f997d6f1620feba22ddb77c2

SHA256
72b4da41bc2226076e38fc44167a13182b828933223a383824c5ec3c820a2198

SHA512
8d513be15a99598ff57f0b5f185186cdc76d2b5bffcf7d42a36d83d8ca2459a570701d0dc0e6f197f2050cd392dfeb6d3b47a4ef30dd84d9adf77d9010809380

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
454d5a05a8785ea93ffdce5108417b40

SHA1
424501bb9fd596337dc2e03b12e5757a27f5eddc

SHA256
6c21df240a3b5bb6bd291389ff74eaef1401cc835663b258911444bbd1a61626

SHA512
a7fd227d0d9bf1e7f855a924a8630d58664cb1e677c919951a4b39d332fda200c9c704597db7a1ee4d1e877f6e701366ff53170e0ad63dcb570ebab065306634

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
516da629b8efecd93c272cf7b5e7adc7

SHA1
233284d25d080f204f8c3fcd0a2824d9f3cc68ea

SHA256
dd4a6ad76399a33b444c3dad222ba86e6458a199ae56127b3238f58fa88e69ab

SHA512
e61c4b86fcd8f0e54dc2fdc18d9dd16eef6171dd1665fdabae6624177d6a1629547d60c59635de7d3d262988ea0d7be04ebef7dc21bfdb076782a6772f768181

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63b2d0ab1a25f0fea120e35543baecd5

SHA1
3f8211c8df2dc3c6ff336908ffa3d1d869fe300c

SHA256
d569afd53c38e1bdf8b5ceaefe34b43772dff30ac3b3a93c8ffcd028bedb707a

SHA512
e5c0e76de7d7d1c3ac95cf1566be0259cab25b98c4fd544d1563b66ed15532c227117018209217bc68a220260b5f360598aa5cb3b2329b66f4993bfb26ee00f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
975c33d9241b888e9dbb5042d33bd4f5

SHA1
780513d49e233f2baaed019b162fbc20e094add6

SHA256
560be375a0102dc95633d9826f8162fb37a67b68885ca445f5e68445bc88f255

SHA512
48dde7074a8e5d693780eb1717a59d6ab42ab5e49d83c573e8a879275ba2ebb0f02c07ec0b2873605e0178dec305acceb5272901ad03d3baf6a17c1601781432

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77d31f16fd003259cce624e14a693fc0

SHA1
3c05758a2a30f68c8600beff253655154941d870

SHA256
fd0aba45eee4838252989afe7db1ea05ceb8a245ee78459978ec5f81fd3e3c7b

SHA512
c7b67d029cf8aab5d986d1baac362fdda777831d1cc1ce991c23fd947bb237250201ac67bf09d7ecad92ceadb03028086915b2e3d7a84f2ec4c1feb278b668c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f385d585a4543a8d7bf88bfd1718b7da

SHA1
83e7b0e0932ac6dbdc8437c457c7164768a0b1fd

SHA256
efd3674f9076db4cc7e643ea56b55864d84f129dea63882d95608c251f63758c

SHA512
972250b8e56cd7916bfb1a6a1cdbb13c399ba4d615aed858a598090b2fddaa79f654951ba507d4154644b7fd3ad45d0d4eef816b9c183eedfb2257cea0a3d998

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
668efff8851588f5c069fbb792a54f2a

SHA1
9a1f5198ace2716de8b249b50fc51baaee5fce06

SHA256
00b6811bb3e43cd1870c9e66b23add254e2e719f125e15b265b30bcf78880b8a

SHA512
8e6d1c35753c9bfa49508357629ad0f986b61787515aa1e2946ad77900db5ce76604c53e6ff87e497a4c8455477e4d7da57da004153501da39251b95d29d1d38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\2SBVNUEB\m.stripe[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab27CD.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar284D.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit