Analysis
-
max time kernel
118s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20/04/2024, 01:40
Static task
static1
Behavioral task
behavioral1
Sample
fba593101152df58866bf7ecbc6f3b58_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fba593101152df58866bf7ecbc6f3b58_JaffaCakes118.html
Resource
win10v2004-20240412-en
General
-
Target
fba593101152df58866bf7ecbc6f3b58_JaffaCakes118.html
-
Size
106KB
-
MD5
fba593101152df58866bf7ecbc6f3b58
-
SHA1
381d48e75691a8873c0921a82700eac7a8dafdb3
-
SHA256
19d043bcaeb41bda0ae8020988544cf6bd94191d033f403ed154397e1bc2ebed
-
SHA512
aa61af978672aca772970fd605420b98adf47144fdb0cca8943d7982f22bea9e9b15517363481512799e8c56016636fe4ee785199f879085138de57bd14852c1
-
SSDEEP
1536:IH3jwOXDTWkbE7XV/CmBIqzYgPx65/GljWc3ZXTUeo/znu:wzwOXDpE7lamBIyY8lNhou
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419739089" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EF0EEDA1-FEB6-11EE-86DB-FA8378BF1C4A} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0f17dc3c392da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000fcffbe8a60ecadb51a5e29573347cd7c631de3c9000551cd3f44c93d92fe1195000000000e800000000200002000000092a135f39fcc30586218b7614d871ef901a439f768ea4c5debdf7fcecb542ee82000000011e527333f379dbd27a26486112c4396105b6b014e12783d2449aabb31cb2c6f400000004a5d0692af0ac44cf8c0b5e4a90981cd2449eadef254391aaa1c9e59b83b80b96407d3dd78f9d0173fd69aa1b3ba87e8ab13ad5b5ba4cbf83499e3c652fcca8b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000e372e5a0facac9d7e603adce486bdb38513e710d899b5b6e91d34f4606577848000000000e8000000002000020000000d6f6a8c3832ff67027adfa222e75b9c3d2c84effb14334f4643840ea2beb7a23900000000eaf3a5117f13e67a50a671ef11f6877f06f4e124ba19247d03fce6b6d67baa3de31d1931542022ebbbc613d15f4588c954cbf5ea1337fc3ddf9edca4739735ff6611f23b6f94f2c429a52aaf5d6317f04f5c41bfa56d3b951ed2d67ab6ef633d9355699ee39afab04b7d834c16af89e180bef35d4f645a5673b41976e33fdb983c2961b05060fc8fc3713b6272d2c9540000000fc5a8cbdb98c400d886eabd0e5d513bfcbf3c7fcb55130c595ceb8f39ca7b28b097c6a54209c0a3e403424ee9d4b12cf58b1ffaf51f273f9f75141124e125fa6 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2080 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2080 iexplore.exe 2080 iexplore.exe 2348 IEXPLORE.EXE 2348 IEXPLORE.EXE 2348 IEXPLORE.EXE 2348 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2080 wrote to memory of 2348 2080 iexplore.exe 28 PID 2080 wrote to memory of 2348 2080 iexplore.exe 28 PID 2080 wrote to memory of 2348 2080 iexplore.exe 28 PID 2080 wrote to memory of 2348 2080 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fba593101152df58866bf7ecbc6f3b58_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2080 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2348
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e68b08021b11f79c1699e41de555a33c
SHA1b1b1df821253e7fea857c4f066681ef542ba2f1f
SHA256a7591f55626c3c133b07bc01e2c82d53c687daba6b923efed3460d584f43ab1e
SHA51246a0408da93c1be027a87eb2dc718bd113a4a5f911039e3f7809d6c1778393c9beb1bdeb63bb1b9e9f38d5aadd79089d4f43f7e04649ddb5f6c3b47ad29dad7b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5db21d47a17b5388996b169c18a893a58
SHA1aaa68bfe9ca3093a151fd57e5d72d7a18df9c509
SHA2563fc546f90f5b583353425cb8d8cc90f218c483428243cec39f30883f396dc2bb
SHA512c8626a7881684896f4823266d7e6b71ebacfddc008841000e03f49e64cc3b9ab057ecaa50ec69b3ef394e5c99656f5c619ef4087b0594890ccfd446ae4419662
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51ca91da1619ae7ef7bc048481d1c4a4a
SHA13e51a5ba80852c416856c7413165c98dc53c0a31
SHA256a457f83e7251622b47f459055fea6e790b97ed2070b402c97dcccf96f2d65817
SHA512a60297b8a579fd4c86b50842c9f42d81988ca2a135e7941234111fc5e0736ea05448657df0191eb75cda3031303893c6583aa2bacf4b1e65a8d4254c3f07b93c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50697c0487e8b23470a1d5548ae879091
SHA18d9495b14aa59a88fb1c8e64d2145387a373f4fa
SHA2565d954520de954c3b15d6141b98e20dd0fdc263c23afdcf00e468a4c4a2c543e2
SHA51227a35c8139dfdae64abadd69a08271d75931a490a83a1686f291007988135b0d9f8af14cd982ca7c44b247ffd15c5e16dde5dae3389bad8ef8eae6ca7f1cc123
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e4adc590cfa99977bd67873396fc8662
SHA1eef3d8428bcdfef59c3e08d2009fab2bb6b6c297
SHA25679b690d40b8c1b3097b9a7379918c545fcb8b09b7384802536c8f52744024809
SHA51256d5c69a8b5a973a10c71cec6ab9c73a01f4b46e5fc44671657d9cc4de13ab88a00ae8ebd1d4ba96aabae5f8a3b4270f44e7b0a012659d141e3c32041f48e228
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a104c00d56cb311fb4ad735bf3e4357c
SHA125c695517de8291a692ed6427a371db3f05f25c9
SHA256a9b4de59a92528d1c3670ac2be4dae8f2cde445b1ee4495e77cf4e45ad79e7b7
SHA512dd952257c415cbdc39919afe6d0112fcc2324c741d9d989cfc9af73c2765c32f0f5366dac4b1a5365685990a41c19b6a2bebcf69a055a725f07bbb0818828baa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52bc69a7f019b42bbf60a164d1d8ecc1e
SHA1c640058a8f1260b4e630f29db507a79bef0d8d8c
SHA256e01fa2dd3af12ee82aa6f3c2530e4a3ca9b9d3c4db5623550dac65d57c06c6f4
SHA512c473b5ccdfc37266635f3ba5e7d3d42363783e7b5335863dba381f5cc05506990d3c175dffc66b5b87d2662fcf0cb9ab4578cbf70a323da1f6ceca7d00beb9e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51df3b9ed03a156955101a46dc2f65fe5
SHA1b2983c11797a5f58f80257704aaf5e7d9e30d460
SHA2567c51d8f886c38eb31d680f5d9147a90e25a12dc51e0361b97224c98b770bce0e
SHA512fff72fc516580a12291efd20789cca0e74c57bfb8558a483fe7c54c4b7fbed7338acd66cfa16408b54781c4dc01330fdc681a621b1988cf4f0b06215e284c4ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD583de44cd01e8dc891f829a7336356888
SHA1fea0e1da347ef78318d05073f6fe22985b051400
SHA2568b819238ce57356c4fe30ee139591b9ce998e6dac9793af442a5448566ace7ed
SHA51227b9a944b08ff94f672f2c7570d58472432e203273ff057c21227b4201e9fb2b860cc6478801627d41e7f5a2cac6965f814e2348355d54deba0a4fa2f9ad10c0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52853bed65760c5d567111a0d2ecde9c6
SHA1130bff218c17c1107a07e5bffbb64a6c8711c41e
SHA25620360eadf3ecf995a92f3084b2cee897cf0544811b523c9ee9d0da8481cd2886
SHA512566d4b1016bcf7f68ff68e26f0fb902455adab47d7ece9824888e17c79227c6da6cfc0548ad63f40021dbcfdb1ccd6759c4921e4138f37d04a42ad5cddb104d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b1d34372d959c6b196a349176dd91d87
SHA1efa6096dd599a183dbfc0ac59b84b291714ef8d1
SHA256fe36e731120953348a78b6de40219168d1947476fec6bb4756c4eebb65578475
SHA5121165244e0b927f1d111fe4756ab8f97d41cea82f8b0ce15eca4d7d32f8f3ef46db61fb4d202a8a86801323b654180b91caf1960a9a235c560b33f3955a8acab0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD581f14a5ec3f12496d94ac2a355344e38
SHA12335cb90b9cdc77962b2e4f88822ed4548f872bf
SHA256d557cf29fef06239f55c87a04a49ba930c61e9b88d1a2437fd34a5df51b1ea19
SHA5126efbf47b3f299a9c8010d6ebd770b13cab31e9e3e490da13fd375f969cf39cee1699d6661d355743a840723b0fac6861e546cec7c88fa90f1f80cd3d1f6f5105
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a