48cefe275966e351f9344561a424cddf33aa9248d0ee721b6c3c3d01eb8483b9

Analysis

max time kernel
150s
max time network
155s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
05/06/2024, 07:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

978d15873a8174d4d257e155fed551c5_JaffaCakes118.html
Size

82KB
MD5

978d15873a8174d4d257e155fed551c5
SHA1

d7d51f17cd51afd49adb9722e166bc3ed53b0192
SHA256

48cefe275966e351f9344561a424cddf33aa9248d0ee721b6c3c3d01eb8483b9
SHA512

69e71ab7024070d2b682ce02d2da81e62f51135ef425bdb97a3cf7514b3eab1b13a1b0cc425b67b96c302e33ea8911445efd4205ebca852f0c9f42cce0014c97
SSDEEP

1536:kpPMlbN6FJbTM7Nb3xxulSWE5/ezOlSYqKyM4WvsUWZkojNqZnR0pD:kpPMlbN+bTM7NbBgE5/ezOlSs0UC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DOMStorage\stripe.network	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DOMStorage\stripe.network\Total = "14"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DOMStorage\stripe.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DOMStorage\m.stripe.network	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423736139"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "14"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DOMStorage\m.stripe.network\ = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DOMStorage\stripe.network\Total = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4F4970E1-2311-11EF-99F9-4E559C6B32B6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DOMStorage\stripe.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DOMStorage\stripe.network\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DOMStorage\m.stripe.network\ = "14"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2420	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2420	iexplore.exe
2420	iexplore.exe
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 2376	2420	iexplore.exe	28
PID 2420 wrote to memory of 2376	2420	iexplore.exe	28
PID 2420 wrote to memory of 2376	2420	iexplore.exe	28
PID 2420 wrote to memory of 2376	2420	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\978d15873a8174d4d257e155fed551c5_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2420 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
a226ea63714c54a5bd55c0960561f1eb

SHA1
ff97e81678acfe5d33f4b80cf075424892d84d46

SHA256
ac2555f6317f3029d6283fe08c0266823ece254e493987156813821a3e100bf1

SHA512
106448fb205df6a08c12d00e79ba676047faa8e370ecce26f7da36478f115c55d4107fc806b31e048e5f782fea277decac31733cba99c9cce56513376db61525

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
0877630f9d34f55da6cbc4403dca859f

SHA1
e56b270376a8d20a84e98234834523f6b79ff7ef

SHA256
14c5d29eb49644e5aca11358d9d33ed69123e751b0263a46e273a928a434a86a

SHA512
be6d6df40017607c3a8eeaa22276f57142835447c232fb6b0a58143f07665f2f064b6dd03395297f80cb37d47f4ae0a62f991c418d8ecbaf9ca48a1d3232ed5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
3d11e0a8434105c56ab37d19513b0843

SHA1
a3a943e33dc870d16c04552ccbfafbd3da8f31a8

SHA256
7a77e0f71b798c26f963cbc3a238fc3b6b94b1511731935a5444b57cf8433242

SHA512
4f8c12e7dc0bc02fe031af16ad6fa305fc42246bfd5198ea79deb429e5e9a418d4ec9cf19eddb55f86aed31f8415255afe92736cb08f508d1b92feb84673bf79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
7d1b00694b63007af95403e42aab829d

SHA1
8f0ba2cbfb7ac0e65481d6353e777ba89659ab7a

SHA256
402aae2c4e94ac4fa4673e3fa5f1d07246cbf8cd0823da59ee2e36bf0bfbb996

SHA512
5ccc16bfc0ee4799758fe646c36cbfba6a0cf3bb8244514a133ef9f8dba887f4be6b719c6c49dcaebc99abc9f5d609b5931ed4cd93449d97e929ffb7f5a6bc90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
a8f5f0392f4030b3e69ca36feaf99b86

SHA1
b8424686dca8bae51fec42803d1d08eb28f44454

SHA256
086391d1484d597bdf005a6371b8b3a4167b83dba19cec6d29e01988a0b2cc42

SHA512
afd032b95d0f45e7eb118c8041eb617a06b4381f96155dd4a624de8894ea10c5b4825621e617cc61152d4f003edfba91d9bfd365082b97f82a4264936f5e1713

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
d64126fa716842f6c4a0cb952b7966ef

SHA1
153b66faac3b23d94e8aae1d43b2d6c6797d0925

SHA256
0747c95e559d984c68f7808bc255fe31b2d1df93e289d6ed47dc684918694a70

SHA512
a98f60749dd915f2ab42ff9ffaec596c75e3ea6587d389647d744f1fcbd5229ac9c73d85d17901bf0fc8efe87a5da660c5f10e0171fb60a9b724f81400fbe741

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
1324d5a1684f4cca872519acad7f9f0d

SHA1
af8bf03e97a1844f33df002d77d2de06e61759b3

SHA256
5449f24f25fdc165caa149b46e7df80c3f83e2d03913766eb1966e1551c4b1cd

SHA512
8dc64047db6808ecd791492a3a2bd945e10cbe1d40caf28972b2662bed121a80059ef1ca581d2be3f3791211d8e454f434c14d417bd5bbfac2dfbcba8755c754

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
8bef4e1bb568f3e3c6373d79125f7c91

SHA1
d67f23edb032cb936743481748e7a3c416a69d28

SHA256
0a5450d1c06878fc3d13c62f5b7f4304a7842adc2fdbb8e61c04afc980dc924d

SHA512
860c69ce644421c7b99240f235fb27f9dd51d14b53c32dc4ce04301b7a5a0c10eb4c0565a8654cc5949d64d2ceba63eeb2277c02e62bec01891118efeff17b66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
97b64d597072a237d94af46e6bc7c53a

SHA1
fed5b61659a58656237c1e3e1947bc87e14e14fc

SHA256
f602683e2080f3d44c7d215c852742c9c4b2e27c76f500ef83774ad7fdeed148

SHA512
c1f7d37106789afceeb59601c1c8752911f4c5f3616a96b27b4bbced013ad61ac926728ada226d867e98e6633b0792b5a3c4fccea76a98f471440beb6ba46780

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
07f917cfb85ea88495518d5e8125845b

SHA1
918bd15e4ecd1f424ead7ed32439af79ddf516d5

SHA256
d2858c30e18aaa84ef20f5165f2415998b8dd24a0f425ea1399f30e60114ed28

SHA512
5b0bb1ce37ebd95e6064eefeeb62bf975ccee599074333c18d270aceca99188ef2ea874a19885a867fbd6327ee366c4bee6f27abe05f37b14fb166333fd26d1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
9e531f5c4432424e09e5d7d988ee55c3

SHA1
03936fdef8af71c10c5829ffb4af7ad33fab16ae

SHA256
25cba70bcc424f7096f8957be618c92065fb84b1567d945a21cdff60f4c995b1

SHA512
c19d67832cd2aef5a40912aff8438d3aa5eba0beebe408c821201d7a5838464286653580230ae2e5173a38856e3555a2d687d41c92466afc3a12a9464f7e9003

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
9c5187753455756d89d6abd8343610e1

SHA1
efb926d53fb8e18331fdedd4203a33f2ff53610a

SHA256
cc5662d2d97a514d18e7f8890ae7a6999d0acf77e8fe5e02d0de3dcb63d7574b

SHA512
964030f2bfb32fb01d6ddc0e8bb0171083d562d00f2f01aca7bff258ead4d46483d4ac394271f8e7b60a509ea35db47977da55d342c20459e43e0d4f2219022a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\59Q2H40L\m.stripe[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab11BE.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab123D.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar12AF.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit