13803093936176ddbad14046d1c55625745fa05112744c6b1b2b2e40a6ec70e8

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
04/06/2024, 15:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

95648607fa3d973915a067703138cd85_JaffaCakes118.html
Size

82KB
MD5

95648607fa3d973915a067703138cd85
SHA1

09d7080b15d95d19f0e889aa4db616ec404c8c75
SHA256

13803093936176ddbad14046d1c55625745fa05112744c6b1b2b2e40a6ec70e8
SHA512

68c9c49b5daa0021da6918dfd4ae0e47001448fa2c06a6a26fb128c61913a743574d481e2da27fe9f7cd487f76caa85a172731058f74bb21eaff03957f7f7c68
SSDEEP

1536:/pPMlbN6FJbTM7Nbfx1llSWE5/ezOlSYqKyM4WvsUWZkojNqZnR0pD:/pPMlbN+bTM7NbJPE5/ezOlSs0UC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DOMStorage\stripe.network\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423677653"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DOMStorage\stripe.network	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DOMStorage\m.stripe.network\ = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DOMStorage\stripe.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DOMStorage\m.stripe.network	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DOMStorage\m.stripe.network\ = "14"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{224CA901-2289-11EF-A7E9-D684AC6A5058} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DOMStorage\stripe.network\Total = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DOMStorage\stripe.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "14"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DOMStorage\stripe.network\Total = "14"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1596	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1596	iexplore.exe
1596	iexplore.exe
1268	IEXPLORE.EXE
1268	IEXPLORE.EXE
1268	IEXPLORE.EXE
1268	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1596 wrote to memory of 1268	1596	iexplore.exe	28
PID 1596 wrote to memory of 1268	1596	iexplore.exe	28
PID 1596 wrote to memory of 1268	1596	iexplore.exe	28
PID 1596 wrote to memory of 1268	1596	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\95648607fa3d973915a067703138cd85_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1596 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
113464832f748fece798c4c56fc20ed1

SHA1
fdac968eb72b8c7ef05b0a9502730915e411c51c

SHA256
63fd2a1fc46e3b7b0022162bb2e812ed2d80f8582d7e3770350228a7642396c6

SHA512
c43db16f903401c8dde684a22dc6e2ce6a7917c9cc23f897c0820a858f125bb484b54811b82eee8b4c90ca97e714f161ec3ecde1712808ef36039e5d3c2883d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e5529478d73ad880724644251f1fc18d

SHA1
f40c8c9c70f7a8689899ca8679f954acbcc1f265

SHA256
7acba2ea7576c58a76477a865adc4d70f6322722d4a824f854c37fbeb8bfdba5

SHA512
6159ff02a3adabe1c6dfd252975d8d8f8bf7437875ea8ccb0caa81a03f18a1836ddc2c27993f36823aa3c5b773a382a4ae17939f38c568c38346f46778edaec6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
98f49173a5af49669a9db4d38cd38625

SHA1
a18c4f707998f16432e3d5e089fb27ee3e706770

SHA256
e1bf73b1bcfeaec0f39da9c942354ef4f9c5bf132b157572cd6bbb094d1108bb

SHA512
99927088580380f2e64f4ee8f74f729baf192054c44b9990dbb8b85870c2d77e39008e87f646cbfdcb51ae73816465c0fbffb1a18564783445d7868529f92e5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
60157deae689a695d8d3d73bfbfb77d9

SHA1
270f547f755758897e1e2201312e1addd283d692

SHA256
6741e8517d64dd7a78a5c34afc01703194112fa5cba8e789fe28f7a7ada3705e

SHA512
5f2f5ebcb856b992850d0955e9d79bfd2feb80e1edea448b282b563751adf4cea32a1dd8be26062903df2f00abbd5c050e9096124927cea261a6dbbe08dbb69e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bdb62bf040b72a7e95e19294c062a17a

SHA1
41ab86bfe8fc45c56d63b1d244b87030bb6abdaf

SHA256
afe13c5828a1d46158e0f21bb7c131ad56c86d5628ec5432f5b29302e891bcad

SHA512
fc5b14056f7c01a63031c55a825d485e817fc70b32d43ea400dd1443c1d41568ed1e85580080d4ba409284c423669add613cf002e169336d4f5dfbd50ce7eae4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
54ce9a68e427bc1f67e58ef7180a5457

SHA1
1a4bc7c128fb8b3f02165a232ced9181840f5534

SHA256
999f539e0503f7b76a6131c10b33548e6cd72684357c2bd5936f9aef443aa5f6

SHA512
06076aa8f0c74e5e58fd46b2f9d3d90009fa8c7ca736a3d4cf21ac3733512a445463eac37781b785454cd209c29dcd732aa3e21447022e708308c64d801a86e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1671ebcb6c119570690670c51dacb54f

SHA1
a7745803c637e541975c9027e7fed5fe8d6332ab

SHA256
45b18350a58824f2faba57e0d9980295d4055e94a0ac88e32278afbad5bdb674

SHA512
09178545acdab7ca202b4cbb46494279ace4e03fbc58a75d89a1ece1e3496a85f1a51df1562dc22a40efd2924b396f48171eeb66f64254a3c104e6ce5f58f6d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7cba2e92a6dc7033b72114300f26bd89

SHA1
0aaf821d6c04ee4fedefd94458f97e92f3387f51

SHA256
04dba3bd5f45a18089b663d96571c08dd3823c995c7e55bd77d96b3f6fea3d00

SHA512
e6d70b28b100e7a3236fc64cc9396837509efe6f65d7822aa2936a048b51afa36a5be573eb8b6dfbbfcf2a7f74cee6e769ba5f55e48fccdbe420317b7fbd2d54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c76af57643f56830a710fd1b2955dd85

SHA1
73d77631be23c73c25d51374221d8cce4b3e8e0c

SHA256
e2af656deef8bc90faf4dd96d275cbb5408fccee0a1e98702b25b05f7406aec8

SHA512
ba2008043eccac84afb636343e51ea09f6fb8ad37ab7f59f1295b9e222e45ed91b75e947d95855b9e204775c1d8d6acf67d6c7ef95334776cd43973726d1b902

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
16dee4802b87e43ba931a4fa28207216

SHA1
1832d50d3d33fc83563a2d38b2dff443626d47e2

SHA256
600069b2b3b0346957b11b521c60e6bae16e564387f3f370c030f1fd2079c054

SHA512
67b17c356969917fb1adc15610aa40f5fb7a93c5d96d17ae087b3c8fde81d4f9b4443104ace4d5448c779363961bde7a69492fef86beaf25937a7b7f3d2a9c87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1eff6cf7351936d934e26f096c303edc

SHA1
1cbac923cd1831f7b64b8b19bc134e93ef0c3e1d

SHA256
8a4cee4e29c1f90800ea8d336ad97d147dd73cc1793979f47323b1678937cb6d

SHA512
df9f18db468b9e582d9b955790470626fee8a353111590390d1b31e8abb89108222beffc0f53da5f9cd553ba9a704a69aab7c185982ff213013f766eca79c9fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d2bdbb2e15454155cceee05356b71aec

SHA1
d37433124ba2974473da85a27d4d37e46e25a53e

SHA256
d33fea550d5ad3325bd642432b24e03624df9888126cb88f9708cf032b3b4690

SHA512
9ffb9a6af04b917be14401c419eff86572ebb8c33610ad8a606e0ace0d7dd22eaa28b03267d7f4b258f4fdcfa820860b530e0fc726fb3f58ea7b5a18c83f546a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\M6ZVI00D\m.stripe[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1FC0.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2065.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit