Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27/04/2024, 13:14
Static task
static1
Behavioral task
behavioral1
Sample
03528a459593eef3dfd864d23ed61897_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
03528a459593eef3dfd864d23ed61897_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
03528a459593eef3dfd864d23ed61897_JaffaCakes118.html
-
Size
254B
-
MD5
03528a459593eef3dfd864d23ed61897
-
SHA1
f2237a01e18fdaf24f950a68387108cef384a0ad
-
SHA256
8c25bf8c522d15d98f77d76141dbe0bed6b878a930a9058566f6f3872ad3eba7
-
SHA512
50b7608a694d1c072cb429a9e10c2765ccc7f59d824b3c3d81f95e90b62de1e3781e9d4d0ac14ed4334a85a59e01a15e421cbebac8597e890eaa9cb6b6b16885
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0A1C65A1-0498-11EF-A01B-4AADDC6219DF} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000c285f3c189e9b8ce7e45f35b4ef740f16e2d94113d243d87adcf1103453bd6b8000000000e800000000200002000000016735961e05365f0560de8d0be8b31ed4a4c47a7c1be9a59bf65c504ae4a091390000000e62ebba7ef46687bb22669ad5a7f676104b74393b02278b7b4cee9de86ef6ebfe68f362852ae79d81f1b0f5eea5afcddd0beba7d2039abd31e5a46236fc514d3deb9d9741e44d12d650cf030f4009674f98400ca7c11455926318d32551b5f35b06fb2e18553efefff1e49af2ebfa4f7336b31a751d5bf5b8abbd96123738cf34d626cc979c6b29b66821e5800fcf9d94000000093356d66bd6d4c56d717e0013a13f7cee94872bc334f7fd5c83f79a9f3d0e77f401cb310088f6b27f8c80dc5503bb405bf0b8570b1533dc87ffaf70f3269bf0c iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420385519" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000002a5973c19e6896fd1dace1c5a410a781e211a590af66fea14e79927837fb0d90000000000e8000000002000020000000f3ea6488463a8ea35180b5814c0b7541efb97f497b45aa7be83d3368613cbed920000000892ba76c5a120a0e99fe5ab99c145a2d96dce9099f4b5d6ed1e12ec906a04a8940000000407caee121074f1158e389b7f4da0e849c20f492f6c6ed11bcf50a0c7123066d0320eb71a1e406e28727abd813daefe3a7c462c600b4e22e3e9c265461184b57 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0cd97dea498da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1044 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1044 iexplore.exe 1044 iexplore.exe 2512 IEXPLORE.EXE 2512 IEXPLORE.EXE 2512 IEXPLORE.EXE 2512 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1044 wrote to memory of 2512 1044 iexplore.exe 28 PID 1044 wrote to memory of 2512 1044 iexplore.exe 28 PID 1044 wrote to memory of 2512 1044 iexplore.exe 28 PID 1044 wrote to memory of 2512 1044 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\03528a459593eef3dfd864d23ed61897_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1044 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2512
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55462412a5f4394164978145b32cc20ef
SHA1e8df0b472b9de5a807db148989f64eaa26186714
SHA256dd4cfb620943df6f6f5a6ebf7b30497bd8dd559bcff5121d50a32373eed95ee5
SHA512e977ca57f8338727b87382356775cbf656cb36398f5a2d62459941de71606b8e515962b44b8c3100699f27b9ec7fddbc63137d78f21b742b9a84852c956b3c6a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5057fa637955f69e51cf3211218146fe6
SHA19ca77ba723b675b6b1d87bd4c9b1dedec77681d8
SHA256fefce9864995d1cbbd5af8bd64f9eb371aeb14183a4a9b92e203924034ed1886
SHA5127ecea425e986cc7170d0445d7eaf40aa68f0246b672cf3f4d1a4482e7b9dd56d2f635fa977c96830af2655ebfd4214509e4ec8f223d2f2e3e232470637c7f3f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5134afa9c88481c9282233396e35e0ca8
SHA12448ed3cd73f4d7702cc112caebc31ee047165b5
SHA256cb2fe8024c6b73b26dda66df699c281a874267e7dd1c149797b2d251ac55df1d
SHA512dd213242a1506b0be7eb70d2f83d4c753bc2d0233b1e977c00849294e6827fe728a9a7f4b17bd7feed1bf0e54b51b20aa175bc3c0396997c31d070ea096486a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52d6b5fbdf9c37704d035a92ad64ed853
SHA100268fe770f1c06ff70e2a31061379d5fca169a0
SHA2568b149179636c0ad35c7851cb06a1011c78636e6421806c9da6dd72674936ca53
SHA51201bf6ed5395404a7771e2d3dcc98d337ad9e63e4a472f2bf59bb1cf403a6cea828a94bccf9a3a264a99597f6ae455499f9d81330e63a514086001ce31fb9d795
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56b5c47bf6ce7a4780ba2b1d46a59d054
SHA1778845245596c9e89a2875bab9a8c095689f0bca
SHA25669cc2d8baeb55c027d026fe3cc40b975e726bc85e1273331612fbed98955213e
SHA512e16af861cee76cff6491ebe80d7495a832cd06b3ccb2e288c02fad0f22a774da919b17ced56848412dc4098c702a3272d40c1bff1be06911f1c7cdf0b3115b6d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c39f1cf9a860aee7d680e7e22bf6ba2e
SHA1b908a2b14fc656b8d97fb917a5f4d1660568094e
SHA256af53960f755c99eda798a8c28dfdd96cdd215494a3de452943c1b8b422fd4458
SHA51281c5f7aa6ce77a8f5110e61eff17f3fcb5ebdde97d83bc78dc07a6e8d84c502f39460567524b88c35e4b98ee7e59a19ebab9f219dfc4ff42bf426293b61eb377
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD509617f28dc4932a024bd8d3a1c87e77f
SHA1808e1e1e9078f5f4758cf00293f02d29e59e8c1f
SHA256a8811c4c4d012d16c06681f92e9bc5ec55daeff47f7f98ed0a286cf0e20f5617
SHA51241cda0671969266d1810f596fef08fc676023a6903d0a7c532e1350bec614365d2a97912bcf449f39ec8fda6322b425b6860d0c25621093dc09eac01bee93c4a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5faa0a4df9be23829baeedb51555582b3
SHA1779ac8bedb6015f85f12b43a47dabae8fc90d8ae
SHA25663da27ec99cb7bd89bada3dd6394fc37c84678a5b292bdb03e74c7e9719fcb7f
SHA512c8f4c0077a17530261b163a732476320471d3dd1be9ce0fbc317760363a92b3cdea805ce1a3376d80df654ae9909963eb6ca66cc266cd71bb2c664fc6954f163
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e2dbd28551930717ec769c89ea3794f9
SHA1d76883be46ff6c5080e80df90259de73cd4fe52e
SHA2568d55deb278cfa09f91d5cb88b121c31cc9add64f276569c820eb77dac3832202
SHA51265fd00948f94e1052e0ef616bd1a1ade43f2fabfa3ca23f8a11f248aacd6521a5a4b32164ada2c1ab558ff07eaaa55f7484882856ad4591441343d22321aa8ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD566dbeff7328d9f64119ed5cc7d389a6d
SHA185f335176ae78413e3b1366425bc754471302f8b
SHA256e973c5181f9807c9e11d670fd0755e1f9e29b0bbb648870b520e2ee054a25d90
SHA512c3472b3a241424290476aa7e0af7ba57261c9ad1e1715660326fdbbbd60e38414a8dba16253179ff209c63b6b3fc7a82a21f49c4583ed093bbbbab0aef434781
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD539e3fd406cc2edfb37a6f56dbdcec5aa
SHA1d20a264dd5675045780418ead7113f5f3d572adc
SHA2562a48149f052107abcaefff562e7a7f9543142f9d759b5c8ebf9d034cfc7ddd90
SHA51255e3a6f4aaa4f87fd675ab32e2ba219fdcb9af511e31345c1fb1144f9c772f7a6ec00dd9ed6d06c884dfadea64e07be50335d9282c605c9688a7c6efda1b9029
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bd61de69436b0619a9b2749a1ff57270
SHA150588e7f61d331f288f3cd29341e303ad08678e1
SHA256181d4178777fa2230ac0638222cceb09b64e370f2c094d29ce8bd46d49529cc2
SHA512447a5fc0bfbca03fd503fb6433a351d851b7e9277cf77a2c0be69c935ffeab581eee774529c00cb8594668012f03786b62263ca893f8950e968f9c1c6004a722
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57c2a8bd0fbcf921ed865451e0f3fd688
SHA14005bfc7847bf2ff0a5a2e5c693cd44d3f2623c3
SHA2569e552ae0ae62aa9868a29fad717eb1103aa30894377e52fd23f6727defe07dbb
SHA512e07fc4cd9922a394662220967d4b5919b6bc51dc9886dcb6688fd664a29ec069f839c9119d6c84003d711cc491745a11bd40986acf370e21633ca58d05e51e8b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59c73c4fd628476c7bf903da440434428
SHA1c11857b273bfef026297454f43cb0b24ab754417
SHA256df61ce29c5735db24c2e88c1acb51d606eae85dd93651b5ec181c52df0ff682b
SHA512a80abe5d6b1f3e91c0c6caafc46793ab0bf64380e094031f63081fc08d2994b6494b67873347886b8bd63451a35140d397c12f0eff7c20d90ea277e8693a954b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51b8506014c086bd7fb215598edf44530
SHA15ee2aea1fae0f11caa223485cccc7a6856c4efa9
SHA25621b2e882b7b7732836e97a289500f1b0c3347d54c0f83ff2f5d79356c0e913c9
SHA512c32a8b206acac7175efc0a65ea72e664b12ef627a29a79d896aed1d57c0348d3de0f2fcd765371d718b2aed8e3edcea769ef83ce60c0e935f09531b88b4955f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD547146029765d3aac8815d84f244e8157
SHA124782b9d7d0e980cfe3f6b27eafee7f6b1256e93
SHA256539c2b0e1795627a60683dd8090d6a84d26af3fa7f99ea532b07d008fbcb2e03
SHA512dd014c76ea2fc6548e26458b3b8a2a361099dda714e926d6fd19ed8671dbe47847698545b2287b07f4495211fabef4440c15f416c5dd58d1224ee346ce27bba3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51797ab8a5915f40b8e4cdf60745e376d
SHA196afe6cd57fbcb8867a2b84807e18a80e171d44b
SHA256cb56193a711af6a8374be8468443c468d1dbb230addae4f9e216cd68c8886879
SHA51293482614e788cd847c1c15b0b6a8ffb0dd384d03133c46106c1c0a8641e9c941a5a82c0722485165090fff3eb7de75e316d9d3817273bc81f5918b8fa415e900
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51abc591748632c407ff780875b743540
SHA17944f908c72c534f673afc2a83d771abda248a36
SHA2561c55d3afaf815463037fbdcdbdb42460b6b191ead52607a075ac3167eaaae8ae
SHA5128e79f6325eee933f64712ffffeee31421b6c7d6811ad94b2adc5d79b74c6beae08df8b163472503ca651ccf563441416ba63920422e9cebdf3ac75b67057291a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52796febe964fbc64edc4ad65fa9cca0c
SHA13c3084040444206a73c63e26e37e311699361f69
SHA256bfee968e1416c668141cdccd4a6e9e6c88088c64e04aee5ea0538c2c1d8797a7
SHA512f9d4681f5cee203f927290f8c41da43ac2ad988f1a1ee588c2e921b2e72e55a7fd8e5b52227fc5c9d1933a24789f8ab7ad861f0cf03557f8bbe496e1adb229a8
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a