Analysis
-
max time kernel
118s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26/04/2024, 17:52
Static task
static1
Behavioral task
behavioral1
Sample
0154d3301794a3d81fb5241e6f21390f_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0154d3301794a3d81fb5241e6f21390f_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
0154d3301794a3d81fb5241e6f21390f_JaffaCakes118.html
-
Size
795B
-
MD5
0154d3301794a3d81fb5241e6f21390f
-
SHA1
7f2cf7736a2aea1951b89e49a374db9924858700
-
SHA256
c92b538025bda48ece68de4c4ee8c45e01cc39eeaa0f5944d728654d17dcc6f5
-
SHA512
65172d8d031ae48f4d78e3a938bdcc38dcca54261dc939fc6a07e6208d1315b3d877b8e1d7a792146dc08f2c77b7070004970120ab97edb4b5fa9a0140ea61d2
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D1321571-03F5-11EF-8178-52C7B7C5B073} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000dfbddb85df09925c72b8318c509ac33c0ab3cfad4cc4c71fb02bf0aafe6443e4000000000e8000000002000020000000d613b575eb95d30d447b37fcd9aeae3fb390d5c328f4e245860f142196a0c45a20000000c33a439b2946b55c37f7b2173e230ca5eb6aeba08a4464e04f8e073801af3ce640000000423137370bfec6303e6eaaccad15db22a52f3e85704bf6d4dc443b39314493bbad5002eb5a202ea4ca372f3c4f5cb1712d86324ba1b17e43e45a5f982ef615f0 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000003ea92c8f17cb9395aec8f90ed4188ff11cf5f3d110bf2629c253213a5a7b3808000000000e8000000002000020000000227dce7f608bb2b035cdce5435ca1de2e2e899f842a83e8b92dcd4679eee2dc490000000aa69e89b22881ada753fe66924d1a55582bd36725add8e2f65f940cf9f0a1afd4581287899c156928dc7a5e16890322ef65250013347d6eb1af7e4c23c799668684a1c3ed99b4f2d82c2e85eb8b70169ae36a8383013d0577a6807813ac86ff3f303547dd7e09be5183eb206e294c350d72478121da25c30028cee265cd43cd7c93e9a1c6da5a60dbeb8bfa5aa2aee8a40000000bc02983e0fda15a4990c277e272c1e6667254d23383c9c0b4c0252ecd1fedf6cdbfc5ee9267f537e1e38bcdf58287722e2439cc6adc14e97d64cfc515e0daa11 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420315846" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 104ac0a50298da01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2904 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2904 iexplore.exe 2904 iexplore.exe 2920 IEXPLORE.EXE 2920 IEXPLORE.EXE 2920 IEXPLORE.EXE 2920 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2904 wrote to memory of 2920 2904 iexplore.exe 28 PID 2904 wrote to memory of 2920 2904 iexplore.exe 28 PID 2904 wrote to memory of 2920 2904 iexplore.exe 28 PID 2904 wrote to memory of 2920 2904 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0154d3301794a3d81fb5241e6f21390f_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2904 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2920
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55a6dcd1ad22a3f254b3283cb880347f5
SHA16e3eb629e2fd02be912ddc2ddea1eb6918f2939a
SHA256a8ba0d01e96b50848a92dab7e3b1971481fe621c3d4fd44504306a79ed258274
SHA51273fe84e06f9289bce998abbc188ff69baba9013593f1b76040d0bdf66aa8f245d66d9a30fedefa16f713dd16137075a8bebaf5d8a70c68f0f212ad2930a6af81
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56edd89b9987a832c2d19ff2ab6bea621
SHA14387c84a810c8414284e9cd9e11481bd0a6b1514
SHA256af79107cc830697e06ea00adbd4f62e8ff25a3781c770e20bf193bebdbf38bbc
SHA512b2be73830a24b5f0ace23b690170ac5736ba45ed75d38b994f3fb78592be7bcbf3016f5788321889780c34d8c455dded0f71633e2d72c4046528b87bc3130d09
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5066fe3b823596ca9243ba3867c92d561
SHA1dfa8e8c862a8684e35565e90deb481929db1efe1
SHA256e6753fc4c4b79dc2ad90d9b33a660f01eb50df6ffca17d11db5310cdd259cf1d
SHA512d709d4c72f538a62e0ac5f49f04ce214bbefecc6d10ba09ff64cd96fcc4923e943ddbc82b586a3cd09584709386bf0f0a6eebc1469c35368a112404188366a49
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fbeb9b5f647f5c4f0d994450829710e4
SHA11401f0b7252d67e6c3be0ad74f1f971e3a657655
SHA2560a8f2cc0a1287b082be459fefeac7fc5f6d897c59f6f79358d0900b075c000ed
SHA51255282ca9dd3a4cc8480bea11094475dc06df91ffd560e5a1aa68400f4c6090b4d745afcaddae6169292415d50a4ee6202395bc0d08934d9c0cffd05862942e88
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55507b4fa568c64bbb210fdb6385f035f
SHA14331fe778eac52566db5f3b3e7867648d390bacb
SHA2565841e17e53d8b53b276894b1820fb8f9f466b05fec344f82ce879c38b162e019
SHA512e16d9f7c924bd60ef4de5b0b3728e38b5f4d1c542a4be95b9dddf2018c126954db9805be3d6d678fdc732e1ade4a655d55a48ff7422813288e99fb091cfc1a3d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD522f4b158302ef96dd4d4e4456eebae7b
SHA15a994d4430de204a4f53c9a023cc0dec36dba9af
SHA256f67a9ad596b83991c8372786c5efb5ff8d2bbf3d9f81130974be70e0271f2345
SHA5129af10c99c878dd053dc2ad30b43cf57569237ad29a1a0898d2cabc493d4ecf7d4fc6373b2f8a860116133eb22d368cb99562a257584daa14ad3d5222c8120e91
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fc63cedb2f51914476a63ec0ee8c457b
SHA1e271a9eca994a1b734e5c260f9bb4f465976a7ae
SHA25664ae3e003f60b040a8a82fd46da9a88bf9f92ac86f512abd2695dc9d6f1957e2
SHA512a085405709da3f630953b1171668f0d365a68323e55a2a65fbbda706271127924aab585743a301437acfdfc125ee1faea9de7291027da6002805b7d7eba092f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53115cdc6c02bbf295cc1f4ed60fcbec4
SHA1df999324505313b3b4a3cf12a088429e197ed1bf
SHA256471c35e8f630638aecbb48081913d844f5f23f4681a757e6acb451c46e09973e
SHA512c965ecd091a0bd6b734e8e481f3cb45b116c51ed56587ed6536130bca1f8c53ca7a33a3c5710da960425cf82f000688a01c4117c2781fc285ea1916b8cbf2433
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a8e592291013721718a4122220515318
SHA1c03926df2150c88121a3db88d443e64ec979b055
SHA256a00bbb9b7e1d44cc2af7b4fb25b08ca80f2c7e5dad727786f1e223dc35c54375
SHA51246f3f688fe93b26666434c767692ceb4223a795390ee907ceebabc269c381e4cd06c582d61bed8972e4b06e15cbc1b1f23f251e5f3f71df6ae315b3fa0445136
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD526d941f8c4004bc240410bbde2514b4c
SHA1c29d021f45019b122f02fa8d2858777862af5b59
SHA256c1d4d369fea5a153145427f0d847555c011c0b951e27c82e2cf838dd3e2216ce
SHA51257ad98a55cc7788883ffb4a4fee6375b2a7493c3008685d6890608c565dce0ff5f76c62a66e277cac831e083444f58c83e7409a9a3bacfdb3bbfa961fa018aae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD559f1195e8234a4cd60f709ec050d59e0
SHA1c3a70d1ee9f6057adb08a26c25a570d84807e905
SHA25640103cd3606e7f7841a751042aa862cbfeaee6585e926a55c50157707bae0d03
SHA51218f603282816c9bea70484c6a6d5b6c85df9a733e9803db34e821d700a92c4b498f9caccdcf685e770c2b1ea9d67336ff476aa07621b79347c554a438e5ea86a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54b7e2fff21ef4d9cf38a5a5daefb771f
SHA1bee30e62f74b5fdd151d8a781a861b369e2c1ad5
SHA2567c404b17f03d7c4467eb335a013cadbac02252b7c0e5f88d85f937bf712c3683
SHA5125762226643d778f9e60a42fab9f3d9e27354401c8fa2556c1969fff4dba9d1f191e102285fe738f30016a438ba47edd1c0294f66f91136f716bd0a347177a2d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57eeea2195ee80d136dcac8756f12932d
SHA104d1ad308a3344cc1402ef562aa9b60731271aa2
SHA256003f4b30fbaa6accb4a2c32adc60b1e041a2704edb0202289087b912e3fc4958
SHA512cf00861e0a954398032b2e752425823577bb5279edc86a1a96ac7c6a8374ef625ae954fa49b8b5458edca1044249623ad0d0e832a3e7d3fdaa89728e37aec4b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5948f5de45f26c52a9ce3c284fad5850d
SHA1bd5e56302187cc3c9d892040ea0977c4203c15bf
SHA256fc82c659a767bfe4361d470e55bf95e4dc9baba710da1222df79130b87b6b8ee
SHA51223cc298463c785272c64ceddd80c0d4fbfcbf8ec78a59980cb0b14532d31a13878f849d2e14edb38c7ac2c5c9f5187666335162fa4ce44647511a69d35dc8886
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e70e5e0e7c2e812671f09c0afffcefc2
SHA1ed155a1b5d1fdc6a66a1aaf71357dd99d807f10f
SHA25686089eabcfed4e636c46147593da12b936ebff12b0783a95328509eab2ef011b
SHA5128b1a200169ebb71b48dcea21aac01e4a381d220154354c07d6c0b0101658c227764942eae4ea360b966899f87aeb0b46a733634ca074e5e96c2dd83d6abb552a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD550096610fc9c87b426220eba4c84c15c
SHA114d1995f457356abfe777eb4d0ba3d16b3829f62
SHA25602b6a79e9d9644a8f37db172ffe8c3b073dae5a6c3c41f883c0e1e33e44174ae
SHA512b685926ceee555f4ea84ee6735a43dbb4a3df9d21a835672fb280dd22c43a42113c48c1c1d90aed59547d8f4205553214e89399428918b26ec773579fa28e06b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57cb7f4ece3af161028456b1f00fa4522
SHA11b8bfe678e7cc4954bacdff0cd95284121799a1c
SHA2563a0be5836b1bc62997c5ad76dd503bab6bf5ece96c6856686dcdbed271ae11b3
SHA51231c54b484b625cb7fed7c672b57aea529d6a060f5b9e29fe236a71694493d2860bba5bc05b1b06c299db8f31c71ff5bea5feb5f5a978af59b580707e9280dd77
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a6e266340202d95914c47532dc127c0c
SHA1e54c18d9a52538e659e24d5f117aa50b5843e0f6
SHA256b63e755c06015cc816652093c6a532f997d66f2ae6f69b9b67e82b0a02125de2
SHA51203d7fe25a1ad41da5dbd3f55c77fd2647b29655a4aeb3ae74002d96fdf0964184eae746ae747f6ef319b942ff5f05166923e4ff18c4652918a945f2058442514
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ca2c9bc25991462bc79dbcdbdea17b1e
SHA1dcbd63cf2cce2dac93936e14024a61c8039d3e6a
SHA2566eb745f8d1c9a1c2e6dd232fcba4aa5471af420b45839a38f48e5ca8e6636201
SHA512c55b89df269329f88429b78d7a36af74149d912a05dbeede85cd7b9561dbc4cc60d96686c109851de784ccd58d4eb7f05b3a1175ee95520e877a4545ea83d4b4
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a