44016fd639008df77a84a3eb3aea798b8776c6b1dcf419d2e273da2fef16bc15

Analysis

max time kernel
149s
max time network
154s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 19:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

81b83b45dbb700c86e642573e5145bc9_JaffaCakes118.html
Size

82KB
MD5

81b83b45dbb700c86e642573e5145bc9
SHA1

d213bfa66a626e2e0c0daa8bc53ae275e5191894
SHA256

44016fd639008df77a84a3eb3aea798b8776c6b1dcf419d2e273da2fef16bc15
SHA512

4a6d2c75f2ce406d4e455007bdf43875ec151f1a0c2d787f05120287fea8f005f138660a94964787d028933cf5537e41fd135d5ee94aa6b7ee9723d2d7ab6e67
SSDEEP

1536:vpPMlbN6FJbTM7NbsxUulSWE5/ezOlSYqKyM4WvsUWZkojNqZnR0pD:vpPMlbN+bTM7NbkHE5/ezOlSs0UC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DOMStorage\stripe.network\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DOMStorage\m.stripe.network	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DOMStorage\m.stripe.network\ = "14"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DOMStorage\m.stripe.network\ = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{20A63821-1DF5-11EF-A4C2-6AD47596CE83} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "14"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DOMStorage\stripe.network\Total = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DOMStorage\stripe.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DOMStorage\stripe.network	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423174280"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DOMStorage\stripe.network\Total = "14"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DOMStorage\stripe.com\NumberOfSubdomains = "1"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1704	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1704	iexplore.exe
1704	iexplore.exe
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 2168	1704	iexplore.exe	28
PID 1704 wrote to memory of 2168	1704	iexplore.exe	28
PID 1704 wrote to memory of 2168	1704	iexplore.exe	28
PID 1704 wrote to memory of 2168	1704	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\81b83b45dbb700c86e642573e5145bc9_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1704 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
30323d65a7f593550c4f053436f67e9c

SHA1
a0e4c9f8a34671f1038db10a96115a044e568735

SHA256
3963aa013d8a93191ce4ee6a96b28de68159280532cb802c23f75d3677f15472

SHA512
a548c48a9c74d86412f6823648f461cd347d0439fc868dab7807e48acb21927690f8bfc4816a4e217609106ddf34a310e300c93d609d1a3292d0eb9a48846b12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2225b1f342d69c87d74c5e0155c2ce29

SHA1
1ba611aeda3e47d9f5a6bd87ee3166b323027ce6

SHA256
c336507bfe0455190f1f73d5dda23bce9d0bc7cdc0cfe8a46df75b45fdb15dac

SHA512
4987026e950b78192d0f14d505982413a6c6cc5bdc88e5bf485a9a85cecf966d4914e9a65b72cbbb97ecd822280e745880c66d8888a514b09acf619af6f6470b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8f986830e7946cfece2d2648c4699509

SHA1
fe6d36cd069af1baa1f82f1b9fef69898c6e37cf

SHA256
0d0ac0d78318b147accda7fbb2d0e5dcc117164636f204601e838dee81247647

SHA512
0789dca46ebe3f0bdf8370d8e0b353139fd90fe6da9fb3301f84e8e92f6dee345b5c85859dfe4596ccf1cb2ed82227804b6d2f02087e19afe7895e313a6139a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d5ef58b48ad0715552b2614ea1fedfb0

SHA1
4892ded89a24cd9738dc303344c6cd53e3f9513a

SHA256
184373a4cea55a2b9ee655817538003c0951ef4d9edac6ff375340b5de57cf88

SHA512
6936b3a52f60509397a5a147f7013125f84fe4889d3605a6cb9d408d513f92621c4a8248b405ad732c65bf6f0a945c5dcdcaba7ac39be7228b432be7c83c83c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aea7ce32ac1f5b033d9096f80ccc262d

SHA1
87f5759b3b44f5be5e1a2e3e7098b4983468294a

SHA256
9345a594819fb115969be0cc46d568dc19a12fee7c8a372ff35d5d8b92cac933

SHA512
678d159a21aa78ac7c3c0822605b7b062283803ce6fb60b6c4b641f59e1c2ac54f6929523e82574c99ed10c3c8e3ccd7b29d89540d36c7c1b65d915e0775ebed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
015677cfdbb017cf1dc8365ce4e95572

SHA1
94de727a77d0b41e35bf4cde4adb772c416dd421

SHA256
a21604f71330d811106c194218fa96482ce604b246b6d85945feee8385e1c0f6

SHA512
765dffa9ba85c71c07ba33e5a2783188ba685ce98ff27c4b69d00e92518cd68343c64d600349f3a35ed92618f54c80be382b0bbc0b9b378a0572421fcd755eba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ee87f81db56c88aec6837db052f4d215

SHA1
d332db1608cafeebcfd61a1a0d5688d9eecd9105

SHA256
6db8132595bdc1b52349f307df9cfbe527e989ae54c40021b69972b1c373f2ec

SHA512
f14f416c2df82d651cb82e8ae200b9b8f9366ef8c57ded3b20bb105aee64980808ed848bd7985c14007bc9d0393b6e39a0e16415ac05b163344c06a5cb8e3f68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c5d76795309c234f001fc158a06903f

SHA1
80a896ad2ae8baa1800689b308dda4520d75976e

SHA256
eeccf3ffab38125b7a81e24c84ae8bb75c8a55f51ad32004d88003e17b035490

SHA512
329e19e9e5bc5a9388b8daf3099bb558568caf8a6163d60ab05a79a3e7078f3a41bea03736c695668f6d94668b31cf772bb7fbd56a3f2875e2b1d197afc417c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
511cbb03001ff657cd0f7ceea2a54fb1

SHA1
b5926491a9a14f08b9fdb373694dadb29416463d

SHA256
ad2635162a2e094addacdb4dd13385e1dd768b4675a296b8eb2d114c98e5c101

SHA512
916c54f247cffb0b201bc351ffc8c19425f98693f0856766745b9aedddda4ca5b12db2696e2909b26e1154871b4a4a4233dd8b875c2143ac49a238bfb1348356

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0c3eb9fc8d2d9dbe6abc49bd7b1b8540

SHA1
86faa1a3b2fbe46e100ac67392789dd8b9fcb83e

SHA256
e33e36fe48408a7f71c5c0d09988504a586bca2c8b90919b019ba28c72b2eb2e

SHA512
f6877d402af401c91b476b0199bfe58ebf4f7b6d929419b7e4a65dc0a69a442e03c5ca08b75a1b1a4864eaec85bb0258733fb37f8ad52f55be3b73277b9debfb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a7a1f7e61e79f9e9f0260dad9dba74dc

SHA1
32f475845103c5228787f6424916f2a1bcb91863

SHA256
1af4f8a76ea2a3862941f9857faedad4f84d962bf3ab04931c85ef5028fbf132

SHA512
4b1fc4e646ff051059bd3faae0a157ca5af9ca652633b064d1e611d2e97bf8eb5f9fdd756cb94a239042a5a93821ea1a3fc2fb799145414e44f7119e3aad8731

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6b9613eb2d1f65d283de2bc1883829b4

SHA1
92b638b58ad0fe48ff875a359ff824008f8de5e9

SHA256
74cbaf30c61ebf4f02b51015bc7f7c35a791d3c316a2ff136ddbd9cb78bf1c3c

SHA512
87a009e180a0af2fcaec69ee56ac81dc133109c10e6e1ee5863de6f46af4c840b0a95883b796494bcd1cbd60136dc5dab36c80c1366d639e177dfe4db5d9f07b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\JJTHEN5R\m.stripe[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1DEE.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1EBB.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1EE0.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit