6424adbc92f2394594046bf3237b4e311a72b1cefaa533b8c9103cc68540f57d

Analysis

max time kernel
150s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/05/2024, 18:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6085f47709c28fc37cb083a0d9d4dce6_JaffaCakes118.html
Size

83KB
MD5

6085f47709c28fc37cb083a0d9d4dce6
SHA1

261f23a99eb10e46dd927d7282a470f4e1ab7a9e
SHA256

6424adbc92f2394594046bf3237b4e311a72b1cefaa533b8c9103cc68540f57d
SHA512

5ba2a78a3f2dc68a2105a4a81f9caacdb3bd07d729389ba03b540c4d58a08d53832b109cdd97a45bb425dbb03677b875b14e9e439fc7532699cd5280c3f43908
SSDEEP

1536:9pPMlbN6FJbTM7NbdaYxl9lSWE5/ezOlSYqKyM4WvsUWZkojNqZnR0pD:9pPMlbN+bTM7NbF/E5/ezOlSs0UC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "14"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422391129"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DOMStorage\stripe.network	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DOMStorage\m.stripe.network	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DOMStorage\stripe.network\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DOMStorage\stripe.network\Total = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DOMStorage\m.stripe.network\ = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B6372881-16D5-11EF-92E0-EA483E0BCDAF} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DOMStorage\stripe.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DOMStorage\stripe.network\Total = "14"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DOMStorage\stripe.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DOMStorage\m.stripe.network\ = "14"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1740	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1740	iexplore.exe
1740	iexplore.exe
1584	IEXPLORE.EXE
1584	IEXPLORE.EXE
1584	IEXPLORE.EXE
1584	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 1584	1740	iexplore.exe	28
PID 1740 wrote to memory of 1584	1740	iexplore.exe	28
PID 1740 wrote to memory of 1584	1740	iexplore.exe	28
PID 1740 wrote to memory of 1584	1740	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6085f47709c28fc37cb083a0d9d4dce6_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1740 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
029bed6d13835c4b90bc2fa4c638fc15

SHA1
5c0693069cc807af4c42e65f820ba23f100a5b94

SHA256
d7fd561cbd3d9e754d0de9f623d255f77a3fa298806c0c0bc91c16fed601e64a

SHA512
327133e5503fa7dee13fe60e3131ef076aadea6a2871bb130b7eb99d308ea5497eba63e0364425abeb5259e4dcfa094b5954badc813b90d30dbae121c31d1664

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a6033cdc63cc654e18381092476331c

SHA1
ad9519fc54982187ec3f9a2233c68dba35b5d11a

SHA256
87c3d00850af4b724db51770524a45b205c8a8f0fb3016b201d56c89f5573546

SHA512
bf6b8dc814e0bf943eb3880fdfa538a2fc9d5a9698b54efea2d8983e5a1ada92de9f48c3a63339c0f2b0c1cc9a64ce7ddf17744140d6f7ad18764ded8180845c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e38d858b81ef797e2d96132fc3a5509a

SHA1
2cddf995f342ce9592124e4c86cd9cf16f9627e7

SHA256
c35cde5101cc93c6bc8088011ab313ea85ec75d58dd9a829eb1e34109ae81e29

SHA512
84a88a29efae644a60bc901188b9f1c9ce32ecd3c797d3f3a87999d582281ee435af021c8d5b1f37b7509a64ec78fc4b1e0335c6906ae679b9fd4ac934ea8265

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dadc11902078faa2112dd7bab843ca9e

SHA1
0e05f78aa296c0a5b3a334fce8e8c8b4fdff2b3e

SHA256
033702987a573697d2e4795ab77e6c01066380505c8c66e9dcb260c4d2f3744d

SHA512
b74c59ba28fb6f03fbc03f4cc6d42ae9f4fff4c15d626a8c3b075cf2c72826930f29044343ed386af933ca21ceebac42f0f57bbcdc55b5b2c4476544c8643fd6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa54d28036c011e621f03416da3c72a5

SHA1
16fb7a09abfda63883827cddcba19fa944432821

SHA256
2f5a8990d85fcd4d20bdbfdfa8bff6808fff4fc83e2891ba85ff9d3f8cb0b197

SHA512
c5fdf55bcc71bb4e383166f82a031147ba8cc995d94cce4371829693dacec9b2524ef87b4c38ed61a2ec6bbac09b9ecc6974cc48e59be5f9b42a5de1edafee93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
33db57eeff84416f83a13121ca88019f

SHA1
50bc28fbc8c2fce5c06643f7b4a3733e4bbcf91e

SHA256
ddb62f488ceb2cf2a968a293c71c777f0a82e625ff73d33a1c153a431cc42950

SHA512
e8952dc10747bda36a54173a335790fc308f74790c47543d2bb247d1df9121e75d86f9c716397463ae6ef2507932339cfcb4284ecf524de11e42ef7d02f3269d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb8b72ecbc692ab7f7e99623e771cf4a

SHA1
f48e9a4006052e79e5215228dd014f4414978eac

SHA256
dd3936257292722736d23f15192f31de8634cccec4fe1786babe4609d2f4a5f7

SHA512
bc6ab8611a43babb58f415105fddc34ad4ae7f78f2df6983487e2fbc80bb79dd94acf44c60fa75a773a1b5bf23fdb7ad60746b285bd85bab7aa11b113fd73a1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38d2726e7eaa6324811675bcfb43be87

SHA1
ef18786c591e9b054ce786fdb175925e3c5e7ca7

SHA256
411bc5bfa80f043415c413174719192ebf0b1b31de3a7eeed45ff0754830b74c

SHA512
f77dab17c4abc2dfc5d504714da3db6ece6db38efdb5c909bba303095bfa4df91eecfa78607ebe7c7c96a7529782e9192d218b9bc4a54f597d4ba54c4896f407

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
69212788f2076157a71b9d578bb4a7ee

SHA1
885d18a8bd6b7456bcb809743c443958276396d0

SHA256
d8ac78039ad8ce84ce4348ceef662edeba843ae4e1f569afc00677d1f6b1e0c4

SHA512
92a5cbe089e7a465306ff9e9ea7af2680001b10876bee59088ebaca45f19db2bbd50268bcd83949f50e12b54c4ef750368f2ce78b0171d04f3ec262195db0f43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cbcbe27abc67a0d6122049c93286caab

SHA1
7e1bbf1975fae4193875d73a6409b2955111a625

SHA256
34c571dbf6b3ea9dbaf2aacbd7cb49a80fff1c9dfbf03cf2eba3f754700dc428

SHA512
84b18462aa20a9714d5d2e522a3e054b429d00e8abf3bd0067d994f398b9fc4090d30004c03587d4d86ad98e15e5c5d78e1cadfbdf83f819b9306adb6964f54b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78102ff15e56efec441bda084487a39d

SHA1
2a6dab4bb898889cf578cd0ea0d2490ebdc09c2e

SHA256
e129ee673e574cb504ba90dfce6d73f401d11e21a97045836db21bfe2ff248ca

SHA512
043c2f34ddd5b7d41d5cd8a8beab7443fd1421dca17bd7f85ddabc8eaa9edc06865f8122f08673804c328d43c5a7606653b788d69bc1575583ea7ed172c15af3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e1cd7fea3b10801c2972448efd2dc5f6

SHA1
bab5a75e2d351c46586406f7fd579aa90fae9abe

SHA256
7842a9b17a47423c35d3de0522ea0addefda937275cc629f2c601bb41d9c5142

SHA512
b580b625169adf33a4adf6cae0045b3e42c181413c5ad7bea157d1c3f57e08d0e66b45081080e0f5d5f2425068538187febd3424b8907df62d3d444ed32ae632

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ddca5e62f32f86ca2ab7f9e97e2c1718

SHA1
a63384051438288ec6a608bd953b19f1007f82e6

SHA256
cd955ca61d15ad4e52bdd693be99612cae82d191096a588a88ebeace6a348b02

SHA512
21cceccd4c95f4849bc95235732fe1e8f166b400b4f32be3b94c1e63f91a558c1c6c19175ac055ec68f97226193f6dba70123916287c2b74133f16379a484419

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
9f505a38e2b41247d6049e294dcd52e4

SHA1
2abef8f8e3aeaa8203524818d65150b78939905f

SHA256
af190bf285cd72ea61c9874bc02718c329f8c7c3ac51cdd29a6e347a00a4cd31

SHA512
0977fc7f150f0d394af7e41ceedb08f13f7af575d20d73fcc9c74baca9dcb94454e25dc894f90f573771c6a3233ec744eec58595e5c09a29d1ea5b214963bdd7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\LRHHLXE6\m.stripe[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab143E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar152F.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit