Analysis
-
max time kernel
134s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26-04-2024 20:56
Static task
static1
Behavioral task
behavioral1
Sample
01a5a32fa9914f0e85e57fe8e1764d82_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
01a5a32fa9914f0e85e57fe8e1764d82_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
01a5a32fa9914f0e85e57fe8e1764d82_JaffaCakes118.html
-
Size
8KB
-
MD5
01a5a32fa9914f0e85e57fe8e1764d82
-
SHA1
6b88833c13ccebf267a91b92a97da1ae7a5772ef
-
SHA256
9d0eeb0ae73d7abf040c365016bdc184a4950e44e42582e2355e6419010cd63c
-
SHA512
7df44ff09dd41b9a98261fa4b8e688444b546c2f381c05478d57bdcd82ec895d2799958df58cdc0778adae1f3774488d9ba9e27cce3b8fb439325725e1f9a7d8
-
SSDEEP
96:RxSDdCRn990H1uNaqU4yDIT4mhB46vGC9XcohpH1uPTHRot:a69k4/E/C9sop
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90da8c401c98da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000f46573644ed977d187c56e5e8c3ba1f5cfaba7856c67a7feab6da859c50317bb000000000e800000000200002000000092d8a64be0abc48b5f4e7b2d839d572646be83a906e3a85bab92a276d24d590c900000005f11d91058111e631113dd683e4a84b2e8344521c4dac7ed344dbe69902ae5875e1e8f848250e61699bce56e3e6903077ec79a9735660a82a0ffbe63ff3e093ddfd48c7423f1bd2f9beed67d57ea8bc87d23e97e34ce3e4300ac7e79bfd3180315186775d5e1f7f6a926f2beb64a9d6b3a68e26f89bc12ff67880bf51c5b7ffac59f16cc244158766ce477570e221a9e400000005e66e56d331ab445d6091acbf02bfe03481df47f359dfbe14753bfc02117bc3b60c755ac74e52572508526be8f4eb3b282b9bbd89fe95a8c28e8c89e90e5623a iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420326843" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6BB7A241-040F-11EF-9201-6EAD7206CC74} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000003739a5446feef8b40d4592dc23c19a2c89d25510cd1bec541ffbf0bca411cb44000000000e80000000020000200000009acc65de07365ca98b3c35d4731b0b4e2b6bf1bf5f75e3c1aa34a2067ebce6d2200000002624029883cb3993e498371b12a877c921a51bb54ee08470496f17ec4a172b3a400000000747f11fc09fc51261999fab1d3e5cbe8ae05ffae05a8463c3bf28c38d7d85536f6230e36dd3a7cf0e8601578233704744b6120c44fec385245230f5866a84c1 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2484 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2484 iexplore.exe 2484 iexplore.exe 3064 IEXPLORE.EXE 3064 IEXPLORE.EXE 3064 IEXPLORE.EXE 3064 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2484 wrote to memory of 3064 2484 iexplore.exe 28 PID 2484 wrote to memory of 3064 2484 iexplore.exe 28 PID 2484 wrote to memory of 3064 2484 iexplore.exe 28 PID 2484 wrote to memory of 3064 2484 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\01a5a32fa9914f0e85e57fe8e1764d82_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2484 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3064
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD59ac8586ddd7ad01eaf4628a1a57ac67a
SHA1ee51b86755fe7226340258dcecde0f027cf1cf97
SHA2561f4a045d8ae83d6d0b0d8353c0896a1564f6af901e545ee09cbce751a4444d3f
SHA5120cb9c50965eef24acd0286ac299a3918b513b93991f98eca0a30bc6c7e11bdf4f312dff1e864e9b00ca8d2e5d389919cde28dd820195ce9e293554b59e1c0b1a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5f4ba17c5a1a07b11f3d5c4111a2a238a
SHA1afa07b74de789e778a7c582133337b5d79853aec
SHA2562f7985d0e7f662b508ceea5fccc0f0941e66b0c96472b480a78042b14a397a69
SHA512d7eae3324b3d3ed2cbf83823aae3041e49d4b7f8eaaeb861a07acc8c8f50dcca799942989a96d862721eb3ad2e264aae5c2b8e6664e27331188a7fce4b8c89c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD517eab8ed89212f55964bc84258848808
SHA12ee4867def99f134f0b25eab00870a9238aa00fb
SHA25608e6f9b07101c94f3fb16da2b9c3e0c9ed5aae2577d65abb16d8513f5a7e88c3
SHA512f5f500f909543d0f7897d38db52aa9f73fefa49a2937bc338c24d273654c2981fb142239c662b285d46f0e669dfe6884c454e25d8209c67e4e590671a907d320
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5bbd11139a95d79bff5f44fdb1b86916d
SHA173f3a9d2e893a2a4c71223d9ad3d095f796dcd89
SHA25642eae3fb0fc7c0b0c83288fe76f320724414cc421d8c42148cb2840e77e64d17
SHA51266ab75ebaa23d957756ada46d2f198448acc7e154a327372d70982f54bf5483997e97162c9cfa3809a5e5dc0820ed5489e4200ea6a5420e925ad3d60746678eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD522fb254555268281ea5e73a542b375ae
SHA10cbeff25bae6dd76fbd9e49422ba0612e61ef58d
SHA2569ed055a2925e2ec0132503cd5d95006fa26bf9419c2ab0d08971c6e9a2f1a3bd
SHA51285dd0d4f9e76d1827639bdc4dec2926c1986d3f2a9cdba137be1f0e58bb9b886bea50b3cc0e6779bb47593f75982198678f757fa3b5e28622f928ce40ce661f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5baf2863cdecf2de2189840cef252b2a5
SHA17f911ec516886a1d77c57afe67b2bbb9b5109c9e
SHA256ee2808928323b112c4fe435820c4cc68342fdf18ac61b28f4bce219a0aa7c98a
SHA5124cd222246b3c5c7e575caa7055d23ed90c4ebaf5d7b15281e641617858e78afe2b14eae37ec83a0fc1d190a508616760167d1bc6daec5aaf1db15325211fd511
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD52561e2159b807c57e60e6cbbab7d7250
SHA121b7c40e8494f3ba87f4605ce3ba88d4172b4639
SHA2569d4211a3a590d133b8eba055ed06400b3fb07cc6ee2ef56717ba3d7b4df8af7e
SHA512ccfaf9d52bccefbb057d55f6f5801748001593ee14f5b6d6aa8ae17a1e9d5876a947709585b917c54742b2e3b6a9fbf4522f7ae38bc8973984644650de495fdf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5d9b8a3ac44e1302c9d0c889467320571
SHA1fdb64e3439e6885933908cce8ba055874aa5a6f0
SHA256195283706498f415d991456c06d63b1eba670e83b776b6f16b0c1e37f8040c51
SHA51216686dc5b088cafeaa42ac9efb860d15a1a3308e7d88ffa0ae40034beddcf2c9552fe2048ac1c2627e4da99bcad5742ae80668678ccdd102fc2dbf8ee9f1538e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD55cd2a70cd9788a401625a28ccb07c34f
SHA121450b741cd04f191b467389be80b7129c60f14f
SHA2560a160b850c0c1e2b8e2705260a6db433533a07c39d77d7d8ef74b989787f33fd
SHA51202132625c549335cc0c8ec01802872db913196d877301c794087a424c4d7480e3d022a819d63d09af0fd78b4d497244ba8b3dff663e2b5f052e4408b5bfdb775
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5b9d4622c7891378839ba5996b15f2e8b
SHA19ab0fe0cdd4e4f60019cce1350ffb325ec7c740b
SHA2566af3cf1e39bb9ea4de6e2bc2734c470226bedfa0c0737dc12dfbb85374f2d119
SHA512e266cd2a32772bb86d691d1a575bd1d3cb91d8300fb10a1e24df141e5a3373c9489e725a61ecce787b1c282cea041926372c22ff05779897f4f7f0308e057667
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5b31febbb50acfcadb258250fafca3a2a
SHA192ddd109255e29a000fc2850a3171c06121cea50
SHA256fcc5408ca4e269cfbac786758e629c614a297032c93df7c0f1cb90aded964a6d
SHA512bb4af4ac9bd2150cccefaa30d2fd49a3851e351cd8ca3ceee13039ced843d70cfb7255b5e9d7834530c67ee558832f4d62e7310453638882f8ff88aad87aed65
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5743eedb5969ab1a9c89814fe5ab809e4
SHA13fd4cc535de7500b24d53f05269fb9399ce41bb9
SHA2562287496cb0ec155443482cd6600a73957eceba2685fa731cd3803bccf034ff63
SHA51252b9a23f7e94d068f307e50042dffc613db274b38b8e15fc9cbc410c62cc12a1d2e35e7a236b400cdaeacf0fabaf78a32fbc5f5a77539eae442ab3abbcceed29
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5a5a703914d0b7a84354e0a8cdb049773
SHA127304096287ebc2c859af31caa7d4001d1e3cbc1
SHA256287eb04b722f8e2e708b7cd395a630fe0ffa4804b0a050ce7c21c35ae9224fbd
SHA51235a622094a8e600b9d7f22117dda75c84db6b15263a737f657b9b7903c003abcf9d1425f2add9ed34c930828a15afb014ddb9d3bd769c9c638448f3f5bf110e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD555211ee50bbaa1a3131904ccf72768c1
SHA1df38f87f10f88b95daf95545b32cf94b7ef12a7c
SHA256354ebe7083cf521bb714686c766b75518c12a2843a60ec12f563799c483617e5
SHA512ae61734fd4c54e170514defe925465d9ab75db7b1b6689c339fa676a97dda232b4baa3b8149972486dd26cc6f354e591f5afed485a29cdce5f854cf91e74df16
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD55441b7dfe99ab76c13ec775e25afe7e4
SHA1c77dc33209911e6369544e9648210ae42d7336c8
SHA256dace7fa9f12005bbc8bb1419bcf35089e9f59a93dad5bcc4866f2eb335a43f33
SHA512026c280f0caf80e94838abc23b20bc748ed4682aeb96fdd73a6457a74612171633b60c90190c0751d7278e2b05e0c6a21a467044429d23043fd1fd1529bb0e7c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5ede9a8a5e6222bdae31ebfa083b96d40
SHA1cb10d514c99953aedc0506a16c90ff7287cfa8e8
SHA256c4a3b43c3b0a7e2468c958201152ea3d340158551dd4d2bb31255d9310c2202f
SHA512a9698420e37e3057cea3e387b1977c8fdd9a839bf9e8a127adb27f74419cb497736352ad92fb78113a5a5b5c24f768cdba5350cb3b6ce1d7019500f4d95c8fc0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD566b739b6caab856cbb95f4e79e62f3f9
SHA1f131c8fa24cc560ea5912a8965a66b91a5caf313
SHA25669c1b769b87dc2d259ef1caa2374f3e03bff992e9a477c102f1f1582713b8f16
SHA512287d9c33754ed4414f67a42aaf5742477ecf08d8467108e5b56aec070c5fa48409fe080dcaee26219ec5f6072cc069678cefb4ff4ee54acd19fb01057c57cc5a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD55ce461a64be9948b5c65e64f766b757a
SHA125c6b68cd7f992dbbadb2c59ee5a88b34f86c13e
SHA2567b309eb7b016c54a81dc16fde3b7a1a105905994bf265750e4ff5b85ab011429
SHA512d71de74110709e77249fab89b1e7d1df65d8c2ba5a31b293297a6378cb11bd490c044b1be572b2e7d163976037725ac0448edb2414715f123383c183ac6a26e9
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a