Analysis
-
max time kernel
138s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
16-04-2024 13:49
Static task
static1
Behavioral task
behavioral1
Sample
f39fe995244579041ff6e401a5bccce3_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
f39fe995244579041ff6e401a5bccce3_JaffaCakes118.html
Resource
win10v2004-20240412-en
General
-
Target
f39fe995244579041ff6e401a5bccce3_JaffaCakes118.html
-
Size
159KB
-
MD5
f39fe995244579041ff6e401a5bccce3
-
SHA1
5c388f73c5070ff32be1aea3afe66a9b09bc8ed5
-
SHA256
5123892bda5b92c5fbe087c62a6a69f41c70e51793640053f72cfa215a91492b
-
SHA512
d80d5335e16d590582b34f3cf6909396c2acb76daf78a1d270d40d095cc3ff2f60d881a20afd3abde53f23393ad9cc383e8bd09a85e58b83aae00be5f9391ebb
-
SSDEEP
1536:zqbdKvfGT+B3rBG6xXYrwY5JMEUHwXM2enctYfxa6d9V74JfXdLYnqLlLVkX47kt:zq5n6GJX564a7rwwr
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2EEF9351-FBF8-11EE-B33C-C2439ED6A8FF} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419437253" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3028 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3028 iexplore.exe 3028 iexplore.exe 2368 IEXPLORE.EXE 2368 IEXPLORE.EXE 2368 IEXPLORE.EXE 2368 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3028 wrote to memory of 2368 3028 iexplore.exe 28 PID 3028 wrote to memory of 2368 3028 iexplore.exe 28 PID 3028 wrote to memory of 2368 3028 iexplore.exe 28 PID 3028 wrote to memory of 2368 3028 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f39fe995244579041ff6e401a5bccce3_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3028 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2368
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
717B
MD5822467b728b7a66b081c91795373789a
SHA1d8f2f02e1eef62485a9feffd59ce837511749865
SHA256af2343382b88335eea72251ad84949e244ff54b6995063e24459a7216e9576b9
SHA512bacea07d92c32078ca6a0161549b4e18edab745dd44947e5f181d28cc24468e07769d6835816cdfb944fd3d0099bde5e21b48f4966824c5c16c1801712303eb6
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Filesize192B
MD5832fe0582d23bbc7d49be143c268e164
SHA18cdc847fcbf345fae36e4e81c6b2f51e5ab08159
SHA2566b5e4428b67a235aeafc650416ce9818ed9642bcc0e7099a82fef5470cf2299f
SHA512cc92c1e7002882038ad1ed373341472912f42c60f9212ae2b1f2e950c2686504860fd1690c94b8047f84cbbed62c231c099c4471e9b0ad7cf851db10b0c72644
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD581062caee5be5a171a214c75090c9dd6
SHA18f52035402821650877580f5238c97fe342c19cc
SHA256a0942dda51474a1c063ed428b492cdbc739ac26173f023c83481f2d2a4fda474
SHA5123c14a30a2244e377783e1e8b79329f5dbd9a9085311ca9fcbb47ae2c0070605469947dd945930a7c5975c2e90d575a95565ca42e589c0867a63defa53e195fc0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b5c999300dabecb702cdd1d770c88ae6
SHA1665f6fda6b43aea130cb80eef488174c3a15a3aa
SHA2563c9bfed4ec9d91a736d8dae11f91f5c01aeb7f74a339080be87e68a6351e65cc
SHA512bb7640adfc7e87d059ec3322e3e19f9db9297bd70d290463b28c2051195066fb3f2eb235aeb77af4021240e790667829b37fda35957ba1205d9bafc7f79f3d8e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5144b7e311ef68dc12515ee28324fc3d5
SHA1eb570c5cba170aacf6905df32c87af4093499b9b
SHA256cbeda6a3e6dbe1ec0618b52711af44e1c8a5fc00a1cdb2ec3eb54438b0d1154f
SHA512b00e7ce9c030d0652350a6e5adbbb1d5b2df53a77395991a6ef27ad423afb9043d35b6473a4f0b9c488beff74290bfcdfe7713d4dfc8861f8f48268739664ace
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a8ac961a1e680071b2a365fa86afa04c
SHA1b1a414d882c9b69748f86f8bb5c7a42e0594b010
SHA256edcaf4eca119f48bdc5204942bd3a7b2f236461ff2c02fdebbee5406e1e486af
SHA5120d2b12b930595dc789ec2ec26d5ec11ce636ec7f8af14f2ae1e50840e608f16d2865e8030b92d4e9d2c20aeac35050ea1571ee46135b7b61519983ac529e3180
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57fff45829ea103ff625c535075efaf00
SHA171a4bc75b8e5e0783c02a0070b97eb799bad7c2e
SHA2564bcdf27728115bfb606f2b8300c3a39ebbc5ec693e4d2a923c4cabbd1c5daa8b
SHA51281e1b794c9478073d0b4790169adff4ce154d2785dfadf0db13507946e2f6f555261b2217735c9d046bf6d9e326bd6e11c3d6e979f20c501f22217cfc880687e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD544e840d81e02607326b6a24699da69db
SHA105ee1ab3b8666d56bdfbd9dd52410e347c8e9caf
SHA2566b1579580edc56d710c4ac6e4212ae6fc1f03f8b4e61789c4dca62dc4281245e
SHA51270135549dbe33847473224ffc5f7eac4c7b239f1c66d1ac9ea87a76d683528262c944c259f59e82666c2e5c53fdf85607113c5f8f2236806f7421e0573b4e3f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5533412ebebc5757d0b1e5c0b03283a70
SHA1e43b3fb6cec183408e3ae0ae8ea1153400f87cfd
SHA256ce022587daa08908419f3f3b5b243536a7139e4f28b41b0edb5e6e20aafbcc31
SHA5129375c7879335ec230914d19866262f30713115743e4cf3efc18d14554454bd3c080e16449b08c84cd1e922096ceb42e4eff43537955287edbf6b7d9fdbf98084
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e365360c4370be3e12ab898b952e6663
SHA1faa5e0acab80a2a9680bf6d3c7197abc2ab24492
SHA2567f40db405e8475d8b76bcbd6c79343d3ac076e92f0c2582044e2c69e0cd1c99e
SHA5127ab17828f3f2c2a725170025a51f0162e08dc528095a27a1f1f51b412c9efe33aef0959f80662937199679028d9f15dfd752594192c8d5e25a283645e265d7e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD538197de04acd9908b632c79f569a0388
SHA1befeaddb67293c19afe6352488ad686983cb33f2
SHA25617ba82eda76066503ee1de3fb61d087b60bf91eb45bcd2306fec0c494692e27b
SHA512753e0375d2d622dce79628dedc34bcaf5bbecdca7ed2fc818150085547b35c41ad42423aada2fae9f467d98e457bb9a4e551fabe123cf2a09018a35a6073d504
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a9a4080283b9f7eb9a792671666076fa
SHA15186270363561a44e6fdea1c414506b36dea3de7
SHA25678bff7aaf02eed73a488dbf4bde2132b2a4bda8a91626e1e82b1566ed2a6301f
SHA51251d822a0ff7ec54587af6cfcc143ab8ba1a90b633609071740843a629521e44434c637dfdc0ac17cbf2917a6d570cd175941cb43a4448b21e6750e91b7623f4e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59f7e4bdedd7f802ac6448bd6c619cc5f
SHA168a344c106aecde8801f81a3e751c1802e4899cc
SHA25641cfe6ddc22ba24bbae7890150d5b7256b69b190de558a10d682241a7254b60e
SHA5124ee5a9bd05d0b4ba7d0e7e711e0f92e19a3e72a9123cf2164ab634ebf8ae7bd53e28445bdbe1f26f72ee522a2aa9183a7de8f9c9f58ceae87ce19c7b30010931
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50c3df52b0ba47f39e6a7c09a64ee63b7
SHA100487aa9d5eac2bfea63edaac7be17d65df1f33d
SHA2560671a0fc0772df919af4d5342b50be18c8c9249e4fa00c09afffdcdd7ed96df0
SHA512905f6e910310efba04f63dcf7abfedec2e7317954bee83cb50b4ec581597aaecb0598cd4018eef0c5f0942f1116e245702192837a1a2f63345174536db476fb0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d4d3b898da70e1f92187c46ed99a8cf3
SHA15fecd66fedf3ae7eed8173267506f7c7a46afc79
SHA2565ffc3e71ab1222fafc4da1ef52e5757bf39c80e1910960d4d7288e8e5627b84e
SHA512b44e1791bbdef29e25f0755dfe4b16dd59bb994c52800d403dde2891c4430d4e6c61bc524df7ed9fc3a8900256485138e49696a00db37f8757806acd7af7d2b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b72dd8869d0d075376afd50cfcb4dd9b
SHA1d4d75403d898b04ee50bb64cce015be6171cbb9d
SHA256da95e15959b995c69657d7895bd78c4c12df9f2784609eacf9896bb259205e9f
SHA512cb0c13183c6ff0c34bd2b833cf6af8f13a0b0808012a6916fc4b0f3c3feae9152d528e4428a6d859716442f6e2880e1aeaa9c62720ae935745d45b3c22f89576
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD559f67d23bdd4a16e77ef44b0dac15c90
SHA1fefa133f2a74dc91a336b4832d14bcd8e31134b9
SHA25609a4467f7e09914b6c1bc2652e3cb29552379a6d0032840a39ee75cebe947522
SHA5120071b451ccc67ba9a036f26086656eb2129689b878fbe0c5fbd8b7f574b8aa766223d4cf0af3546a32484b7cd2b91b328cec38f824dc2058af7a3026124986bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5226cc96a34524d53e954a1d50583ce04
SHA1ec0656f2be98ea2e5d22c0f4b09d3e03a1efcb18
SHA256673d3ad6d92647e3954cd7cd46149560a72475c0eba6a11a3ef9340372c572a9
SHA512a40d5bad1335f7d91a883cd31111b207ab63a319f5e17e76e18bfac7577c0b86921a9597175a804b5e7699eaef7b0ed73e53b7858ef0403ac51044e4cc3eadef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25
Filesize482B
MD5f944a920ed3ba7166415718ceab32625
SHA13abb7d63ecd2bdc4ba08165d4fa60a76402de073
SHA2567478645b17430cf14fb719bd86262ecfbdd06e49685d0a4eb75a37fe118bd46f
SHA51261f73a90f0377c410842071b4b0d45b9d6c5a63b6d56bec9501d13dd40c11147c11675c762005fd095dc7a264d777b4d4c711f102a98a7fd2fd9d649ad045f37
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD59fe59bb7c68307b0ff683e0a3738b6c5
SHA1060e3509222874a82865a8ea6446e7bfc77adaf0
SHA256136abf21e8e8b351bf54618965d72a64fbdd7acdbdee21dc1f610575c302fa09
SHA512d1d0f4a9d16532dde53cf1eb7ea0563e58e3bcef16404ac34be51a7df630228910da51ef9f04c3d528c2781bc61d78657de85d1b1b3c99b193bd4343058f2dda
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a