Analysis
-
max time kernel
119s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28/04/2024, 21:36
Static task
static1
Behavioral task
behavioral1
Sample
061edefe4fb407431f3e8de048998c78_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
061edefe4fb407431f3e8de048998c78_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
061edefe4fb407431f3e8de048998c78_JaffaCakes118.html
-
Size
38KB
-
MD5
061edefe4fb407431f3e8de048998c78
-
SHA1
ef433c89c7c5237533693bdb3917b88350c5397d
-
SHA256
7feb699a54307d2c89980ba2e46ed8d191bc7ad2f6e608b224562d445f904f62
-
SHA512
8ce8f01839a8e1b87dd8605e2f4f03c07608d0e2ce4ea4a64e4dd2a156751f4f579a2c4f4d376f467bc2ea0ac0283d88f739ff0a2f593c4603171cfb0a6d1cc7
-
SSDEEP
768:sGUkMvDiChIkVA8eDe/ZIlNEtGu6LzSzu+KM5eLvcamPTDQAeoNleoDeEeKNTe1l:PMvDiCIoeDeBuru2wu+TWvcamLXe+eom
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30e22a4db499da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000005d3b0309df102ba85bef1afc54c5133aa58b5ff7482ca2980d22362d2f74e16c000000000e8000000002000020000000a83ac6728ebf2ac708f435b19232f53f4ee0f910789165c7dd01c2bb4e2003c92000000054ee4b14af04a82ec8c53b4b0a527cd9955171c4a6adea0159b9f8635f604c1840000000031450effa22dd6f680617d983c66ae758eee2ab0451e737007c1c630b9d1312cefecf7113b2e0b351aaf1ffe2e3f391acfdee6a74b00516f46f8fb82c94d9da iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{50146D41-05A7-11EF-92F7-4AE872E97954} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420502031" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000607b692cdad66fda9807cf5e579998c0ebbefe6a84db75f5239a42b1d7ba105b000000000e80000000020000200000007b8b6c1423eab145314de8329a252f363eb0566635b295bd063a12747cf6e85890000000d7c2bad9094b9eb73a0d7e987c7007b7ad6a23ddd50a444feef2e52966f0d041cbfd7d1384b46fbffdcda77a7ebfb876f4b98f916bc44125987fe6661cdc776b9d10fa40d0c79e40450dea228329c3307c10c4eb336804b7f00a2606100f674a906853002cabd0cc41c73f608cada597472af79ce39bfa0d525adf2aa624bc39091ea0f0de44b9145b5ecdfdf07a07f0400000008c65ba16799ac7440098d76784c539f3f5899ca7d8756dd41cc2b1d861e78e496c48a7b78955db226ba0a62244135a2a0b4c00b105988533a771dfa748be56f6 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2856 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2856 iexplore.exe 2856 iexplore.exe 2392 IEXPLORE.EXE 2392 IEXPLORE.EXE 2392 IEXPLORE.EXE 2392 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2856 wrote to memory of 2392 2856 iexplore.exe 28 PID 2856 wrote to memory of 2392 2856 iexplore.exe 28 PID 2856 wrote to memory of 2392 2856 iexplore.exe 28 PID 2856 wrote to memory of 2392 2856 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\061edefe4fb407431f3e8de048998c78_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2856 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2392
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50ce32f6ad207b1b1b5e110ef73a63e58
SHA18bf636b1c498123f7a746ae30074155555020a5b
SHA2567e64327acb4df886dfe58d261f1b734ec92abe7ef859ac45d9fff607977e1dbe
SHA51295ba2dbbc1927c5d81320fab4cbd7a0174e9ba6d4e21568003acd1c2508bd8694ad91db44e0e2d29c4129786beecfc11fd2a94025b7ca813aff1605d9bc18641
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f5bbd6a28196e4f7f95626271942ea85
SHA12a0d9c893b153e91cec463192c50f5a4c4b57dd7
SHA256a8f26761bb1edb69502503b42e37d2b7aeb595c9c4ac1ee4d932f223289106c3
SHA512ee52a87ae400e6f053f3f9e009144bd6b9969f45dfedab158dfdf01ae9323649b4e2c800ec1ef99737dffe4ac65f9bc891e5daa70fb04910236dd80ce23d3db2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c8214430e90f6da1b1690f3e4f2ce207
SHA11d00655690a57ed2cec646a78756c08c17453a97
SHA2569aefeda1d929b387a21c80231fdcdd4e3b71efac0d156548e10fe9bb7c4e56d0
SHA5124a15c45d20858d27be35b49cdf838ecc7b718b985c1bdd6063bea6c9cc945b106f65066bdd7be81417fd7b083b8640a06b7ffdba696ccde53a6095e41a3641de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD566eab58bb158a0122fe74eae2e0e9086
SHA13cd8c22471f5e0617569e8fd2355ca9541c98d88
SHA256577e847981ba47a87589a75b687ff47bdc2eb09ab167a84add6652a0c0637320
SHA5128ae88f5e9f6baed0775c2904ab8bb7f4c81565a3654402712c765dd7b44a219a4e8ff374a0f221567d6879e6c21b76549ee0b25817e7471bfe9123709104f298
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5356a9c85fd205433666a546b03494b7e
SHA1b7e04bd8d3434056356fb8619f0343f02db23442
SHA2568cccbe51504cfd89a3b942e68b7e77d9eacb6200b696b2f96283111aef904e85
SHA512737a79c4ebb3a839214b4cf07f39d48c99bbbc7686640d1b76d6388c1c7ed2165b67e1901b66c5f88ebef12f42e001940d0655216504b552e2dfb4270ba1067b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5836232f4ae18ff79bf5aefbc8a495d86
SHA1b1ec72712112bdc70433774c38be2341e3d9e13a
SHA2569bb58a41a631bd24290c81e731d69e3613f0958842caa0f7961b8a088066b51c
SHA5126b9ea5f441910670425ac565356ad35326b8d48e1600a47f943c6e1332a5d40396fbc9e005b0a5b3981f403f031763fe5c41f440f120c6f4fbac2b169a784542
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eb099ba7647a96635e9363b7fa3487af
SHA19eaeff38243a69df4ecca94f896d05030735f24f
SHA2564ddbdfe1abeb43db478e40f74841ffb7ed2546a0178e899f52150ca691be5030
SHA512ec4df9fd6d0b7e03ea77f450f8d148d56272ded23e8f7c39061d8248d17c0cdbcd4008811b4c9f6ed4f07f9e31f5307d0fad714eb07d8fffa4638e0abcc2823f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b423f3bab246bb02d56992350ced75a1
SHA173e8660ebcfd6e10e60098d1b1b34ebe85462be5
SHA256854b48ae8f4dbc9897a9da821132dc109c968b756d75f779300538c0335e1385
SHA512f42590c05ea5581ba875ecd4cecdea282e53cce9e54bdada7dfd9566f8f46b4ac9605e8d38fe39b058a0598be514d9555d80abc0bc7465d7f5004368684071f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57f70f9b4391b940f71228dde31a887ec
SHA1419b1c10a8701850fd0f853b3bc469ebd3f33360
SHA2562fb1527541f45db5cb0731839bb683fc58fb846b74c3bb2d7e84db4011152e8a
SHA512401d02e22e229033e322b5d8fe63b55dcd0f201780fe7267fca5be7c41850ab65772edf7f157d7a6673d3c174044242c0231e81257f40d447fef15131f869dde
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56cc44851f4e3f2603213af45819ab52c
SHA11bb727d94d287cc13f0437b82a5f528df7edbc97
SHA256a3caf53cd881c2e4d37cc4ff6647041655607e2e9c886e6caa1cc28801f05fa1
SHA512d666a2b89dcbca2d44d953500216ac8dc0bdad737c3c1e68336df60fa4284df298308792c19c666605513241c5515ff988746dbd521646395ecb1d0610c5c823
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bdb18eca1b01270e1c1b387ab2d466ac
SHA12cce6959d565b954a133f8293ac92083caa93ec1
SHA2565ae559dd3d52e8dc82aca7574d3c477cbc80358b7f649bfaaeccd83f8f6c23f6
SHA51260039bfaf8ec34be84c3b47a81432551b4bce45d49ba54cdf53826744d38a904d78f08dab291372004d1779acc7a3d7938a6ed0312041b70318a1a3e27b4dbc7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d4be04d6c53e7bae5d38496dc63728ca
SHA1cc50a9b0b83c9741b448b3344a970b1533160cce
SHA256b46083baa89a6320cecc133389445f9ceeb42515496deab7bdbc6c8c9f73d266
SHA512d009f9e95a0dad0b707af422b56e4e6f91f4b6703409bb2de1ff64b06916a97f1c06e666d7c7a211c7a9b5c8fe2149aadd0295e17d826d43d9827e471ade5c11
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c4b144747aa528bb843a5a0cc4c356fa
SHA19b56aa00231f00161b06ef097609a25308d1fe0e
SHA2565999b9b842c423c32f4a61f0994b61a091a281a39c87ea614fceb596febfa0e8
SHA51212c7a098f097d658c5bd126498f92dfd195707e8563012f5d6748846818584783d2c856292f2512305e7616af01c834fd3196e359e9e84fd10ceb39767621410
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a1f9d0cebbb8a2f9dbb87f7e86cb173e
SHA11f3ff29a2eaa3808297b0f274d5f5fa70588678a
SHA256d4293fe48ff6c487adb0b65b3fdf70bd003242ee5ca21c9c7d624ad688afd474
SHA512c423c4d7db8682d60efcea81b454faaf50956e9a39d0f8919fa57e1dfa42ed8d9296c52407976e8e4c09a4c5dec52191e9418df5899f11d4330c35ff2b09f54a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e53bf2e2c2013fc9d204295cdc8ac038
SHA1ef833b13ab392ab7e1b58ea26bfaf920bc806784
SHA2562dd834c1cc9c129bf692bd9fffb7a40707e05788f90ec23e231bbd8e9a9ff9d1
SHA512162176c89ce1245e363f6110836d1e04a394636e35b16d639152151ab21078ba5cd1c9434ee38300473b50808c7d4a222a90653b7cf3bfcdd8698740bdb010a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5af01fdfa16c1abc9c7742182e02d83b4
SHA16a8df77e380a52a5511b6b208686a658f6d69b52
SHA2565d79566291e5e7d914d3073642c2c56d58d42f20b27d66a6ae3fbdf8bca4822d
SHA51229263da7f835da5f43a1e0727ce234f77267dec4190cdc5afbf4820cf3f374ca71885d0f0b230b63272cc0fa4a27eb84233dd855e563389796d7fd449543b0a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5877ca341ed844553cc8519e2e8c12011
SHA1ca306dbd9b43398a9c755a5b4e1d26aa842652c3
SHA25679f7662305769595a41844073b3f9f7f5504d33f49822f70ac9ab589b89b06f8
SHA512bebd4ab569914efb269c736ff2c7a0c8794532ad6757673391b717de1b8316f356ec1fdc1e510d68eb5e9da4f93535b840c347681b12e07948ab333d4af9663b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD504cd9168ba1ab1e2c78feff209c47943
SHA100461049ac70698638029ec9a413ec0302717b05
SHA256b3e45eeb2146bf68fb2e62fd54f821a483a41e93e4f5908a793b73066e0d0785
SHA5121f3cbacaf7b9c82738227a2ab396b92a1463aff428d6bd31965daf53df98e7ffb92cfbb375a73f84252abeb5091556a32abef350c0aab700fcec6d1a152a51b3
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a