4272abcb4e9112fe6a51ff31952d54b504c6f73e08e62221ccdc082a64eb8d12

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 03:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7b7fc2835fc8edbc80067f3103e40a61_JaffaCakes118.html
Size

82KB
MD5

7b7fc2835fc8edbc80067f3103e40a61
SHA1

cc31bdfbc0c02831a0c0cfba6a228d1bf9a5ce80
SHA256

4272abcb4e9112fe6a51ff31952d54b504c6f73e08e62221ccdc082a64eb8d12
SHA512

4fb97d210c66e30f41d62a3d7dd72860ce4dbccc391329b5da6e16d4587b65fd7caf40250cecbf90528fe99f548d6fbd8b728993f50db000da93d21c03641ba9
SSDEEP

1536:mpPMlbN6FJbTM7Nbwx/LlSWE5/ezOlSYqKyM4WvsUWZkojNqZnR0pD:mpPMlbN+bTM7Nbw/E5/ezOlSs0UC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6600D391-1CA0-11EF-9BF3-52E878ACFAD8} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423027938"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DOMStorage\m.stripe.network\ = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "14"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DOMStorage\m.stripe.network\ = "14"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DOMStorage\stripe.network\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DOMStorage\stripe.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DOMStorage\stripe.network\Total = "14"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DOMStorage\stripe.network\Total = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DOMStorage\m.stripe.network	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DOMStorage\stripe.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DOMStorage\stripe.network	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2320	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2320	iexplore.exe
2320	iexplore.exe
2296	IEXPLORE.EXE
2296	IEXPLORE.EXE
2296	IEXPLORE.EXE
2296	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2296	2320	iexplore.exe	28
PID 2320 wrote to memory of 2296	2320	iexplore.exe	28
PID 2320 wrote to memory of 2296	2320	iexplore.exe	28
PID 2320 wrote to memory of 2296	2320	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7b7fc2835fc8edbc80067f3103e40a61_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2320 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
f85309241237b96645fb7fb5851ed34a

SHA1
56eb4093b988f97817e09eb361b239b3397cd218

SHA256
c0973664cbba869e259871db8b0a5890de0a0e051eb2266d20fe21ff32472a91

SHA512
53dff21fc1a2125acc5b407d78ac751b5afcbb442bbbd548409e392bef9b92bc9ff68b7ed8da30660a3d32c43a55d18f3758d3b1d767d1ae9da57098bd973553

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb86222e60d19f4ebf9a7bc2966073d3

SHA1
67bdba08f4f0c9093c7c57b58ef0f4749eb63f35

SHA256
bdb299812c67186ab64bd3a07d7c792085c1efa8888d7650f433d9de786a8f47

SHA512
6b4864092a37f50fe16bd4902c4cf4658975c8d97940ab4a9cd2bc0546500686c84236066f1f63155a36a9ca6bfa6d0ded45754dcee5c4a8953348692c5162f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f4d2e0266ea120a43cf6705162984a8

SHA1
2a6279bf7edb0e404daa67c22696eb4bc76c15f4

SHA256
63db96d15df18c0e751500493ffa7119d295b9dd535d5e6b5ce066c94482bb40

SHA512
1a537c6648bfadcc79da5b4249c6a4ed3dc9fa3be36b9d804e30c44a90f7892208dc2bad681606d29c4debe4f9c65335bbca8c53c5aa85e373a717e2745af7e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa9bb7409e890a28fa43a0534870462a

SHA1
1a8aae1fb9f5cd71383170435f1b515ab63596d1

SHA256
f85b23940020962b22a021b61816030d96961f05d84fd73fe20f45a9f03d5039

SHA512
fc4dc7935f6f681d726e1dda48da8104500869bc1905ed46fb2833d515430a282a231a11805d133a17f0ccaa910dedf0a59c33967658d12a0d17fc3afedec597

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eef343e795ec65f2e4317dfd6bb3e268

SHA1
07c60e9e85b827634690179c3e72dfb9edcf1448

SHA256
54441e2924d7716c3bd36006a36612c33cc93cc5e43e9d70222886d99a0ad7ab

SHA512
7e55eca2519e8a7e99074b4405ac1555a7c63ef34463e825460db8ffc04408731dc5a776fe53056bbbaf899cc0009e508e89ae07c8312c904315795c4e3f3554

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f0f6fccd706d54cdd0566dfc44860322

SHA1
21ddf2a089f2dd79122eb07c91c13bb380869f4a

SHA256
e2fad9d3ef65912c86576b82937cc985d014d859d650734088a1749f54b98fd8

SHA512
5f9f0cb1abcf6806f6c194aca73604d46c329256975bd5577bc001e0fa038021be63d71e07921e3e8ff2b04a5c5101bbb5e01dfeda991e77ff3284dfea001db3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e1687eb2e592950d3b038371ae78fe51

SHA1
98fb1e9d8c7e6934f6c1e27a232de282178539bf

SHA256
bb9f3df7a53a3c6d8dd669f0f8e884cd37b4edbf3afc550789b6bf1f29b13c1f

SHA512
bd49eeb24ed97d996a052769025411e59e6256771ebba1d86b9c722361323e68d619aeaf89298ca4ddc9832503039d94374984029d9fdee189295f78d5a17c0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b470a0839ccd5ffee53689fa41997dbe

SHA1
e995eeb70584f8033c910821e33c41665506be2f

SHA256
90416c6a9f42004ee09029a2c071509192ce23afb368610dbc4ba3ffcb77ea9f

SHA512
33cac7ea2b48c70ef5b33cf4b043c3a25198efcff3b1e94e12744de52c9179fdaee9c264fa5e2f75b791cb793bce83692f3a98bf8140d15687d18e41742d96c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d4232dc0f8d832100f1afedde31d532

SHA1
a8f23ac314ae945ca67e678a888f8a03ea3bd08c

SHA256
c9f34b342ba2bb8da0164cfca9c4ed26ac2a660bf18bec3d47054b063c5699f2

SHA512
fec32aa99e46db808a7e7c58c2694115995e84d799aeaf5f47a427ba3fab398bbee8b85bad6106b4ec6e01bcfc45d0c4e2b7b52567a9be6728944ec8bfc0da9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c87a7c62667fb332c1097023f5fd8a71

SHA1
63b6623ef503659d3d7a540259f20ac9db4d7a03

SHA256
a9f0fd571006efb56264a9dbfcb5f98c5a61d9ea2f858479078a8ae80d0d82a1

SHA512
886256c3c2b8ef789d00e7d7a9d2aa0f39f7bb143f845c18096191ab5fc80277f3caacc1aa3159b53a3f21c730684efc31b846dfbaca6d367d1b37edbda8d76e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c56cb560c6f1c56f9f6f45d5faa88d92

SHA1
bae55e03391bc8f666d2ab741edb604bc9cd5820

SHA256
27a2467a76ceb7bee535aaf14b40b7a28ec1f870edc9c94863722c3ad20817d1

SHA512
278b828ed5fd8aecc0323ae2824194a3f2e1a12047633575beec9a37bc663b8ca0068f8463149e1b3baab4f49dbd5b0638a9bd466478297c40b5329f905e10a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6b651248dedcbe4e955e2adad9f0dcd

SHA1
a1eeb254940eeee9f85f824a522bfb9b4d8000e0

SHA256
265824412f09b6248114a73112b9939b2f3bab41a6f40a1a984e643eb6ec167d

SHA512
cfa202399cc7308ebda296519925d8249228d92ab2154ab4bf5d82e0f92ad7686caf59e19a370ce4f04c259169e67564aaa622dd266f240774070e849fa8fe6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
eea6109450ad1c39b54150c2ce3fc95d

SHA1
10e9eea7035dad84ade2236ed70df59e3bbc3562

SHA256
0a9a7e894c423dcf2cd85d0c6bb552127cf81bb37f27c411a16e2af1b0088ef2

SHA512
025a28917cc12fa90372889506e5fa4c7fea63f77f9b326ac2f130627e0485837c595b783b5d46b2c3ca6f7c96b1074b66ba037ce65e12e603ed4c23a26f25b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\0RU2KF22\m.stripe[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab741.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7B3.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit