Analysis
-
max time kernel
141s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28/04/2024, 07:11
Static task
static1
Behavioral task
behavioral1
Sample
04a5d5026859648c950613f8422767bf_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
04a5d5026859648c950613f8422767bf_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
04a5d5026859648c950613f8422767bf_JaffaCakes118.html
-
Size
26KB
-
MD5
04a5d5026859648c950613f8422767bf
-
SHA1
d414558edcd465d30d9a965cdaef825b2ac9d875
-
SHA256
0ce2801fd7041ca8b788100f2b01e30f011f280646c47db7890ceae006f6a1c6
-
SHA512
e4ee6c8789a2ffcc0a04c5714cb438c1a12511ddc4e73f4e8063dbb155799686c2357246f13bc4ee9a2998477833b59cd93aa169140096278f416ed246f1e6b1
-
SSDEEP
192:R4zoNmEb5nXnQjLntQ/wnQieGnanQOkrntORnQTbngnQT+Fkm6CreKtPQl7MenFQ:izosrQ/P0A8aptO8
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000faa09aee33a87c2eeb9be4506dd615d3e10074739a9d54d09529f37ad32341f9000000000e8000000002000020000000ebe348c57057304412725d6ef418839663b2d35d42b4e28757c9a6018233f7dd20000000a84bd6e934a715a094ba5d7d582d80f67e27c3a4ebb8b861c9f9836cfb9244a940000000bf5a9ef6cec4de56e091c9a941b13922e3b5062aa3d96c6dfd2d11a18324eef2f7ebf4abd460ad47707fa40a49ed8a89de2af1009b73f49e0369d8c3152630d0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420450144" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d06860563b99da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{81A5D4D1-052E-11EF-BECC-D2EFD46A7D0E} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000b70e77464357a226ded06450a6dedac532228de02e590ada4492635b33fd81dc000000000e8000000002000020000000d7270a8263aaaa081529c277a22b511544c1f025640f06bd4fef4db61bf69fca900000000bca9ec56843607df18708deb03de9e16054fbf25dc4ee2f7f914abdabae7c1477d03b794ba08c9ec5dde5edefd9be16dd34d9dd459723e33cad6a96247020404e05691ae8e04ee0cbfa78ad58dd3ff56b54848fcd48f4d6023011e6ae425b015aa2f05bc6751d28486263de89f8596b33c74d3e02e0b502812b5c4235c2d7f77d4610b94b6cdf1cff43ad13f5a918e0400000005e7441730b0d8646dc58df677ac7adad2d3523e502ec28b1cbe70b7a3b222e976cf0cd119b824e203f29b3289e3e0988cd360d9461319531620a65673c6bcac1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2976 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2976 iexplore.exe 2976 iexplore.exe 2148 IEXPLORE.EXE 2148 IEXPLORE.EXE 2148 IEXPLORE.EXE 2148 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2976 wrote to memory of 2148 2976 iexplore.exe 28 PID 2976 wrote to memory of 2148 2976 iexplore.exe 28 PID 2976 wrote to memory of 2148 2976 iexplore.exe 28 PID 2976 wrote to memory of 2148 2976 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\04a5d5026859648c950613f8422767bf_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2976 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2148
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5069682110f02176be468a99601c98afc
SHA1e19d3d3956ac9f437a6281062450647f3e696930
SHA2564b32a5fb69794c95752b81a25574e0c049d4fa0c7989d012b6cea0fa7ef73677
SHA512df9368bb99e51ce9042d3b325de5a2a26d73b449bf388ce68b74d39a1c41ffa6752a108d3a1bfbbd89d11154fe1ef4c1ceb7efd8849af5244f8432c66297f8da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58a2a8a9c648f05c82743810caf2c067f
SHA13b5b9ba08abcb1331612359c5f095e95ce41fc49
SHA2566a9a1d9c82525dfd45122d71962d65c69040ae50bb35a2a70371a335e930aa63
SHA51217bcf9c92120ad04faaa36de1a77666423f1421c2f6e1d359be39b486047c4dac82a82116b18b96ee738641da69fac0bd5b6e0dd373b027bb5c284e0775b78b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD597c4ddf228169c1fc9d31fd30bb9b766
SHA1d41da1b73f3471c5a5ec8760d92bc3f126837967
SHA256ef5501a9bd0a024bf9092eedcdda92c07a45b39eac26b253dd6973748323051e
SHA5125e6a3ecf3cd88bab6f77acbc37a70341cac18d6f22747d356f4cb3ea0f51737d2a0c32a527b3d5cd715a821645742da3940b01cf98cf5ce3049272b463c5f716
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b485809c7ae89bac4d5226e83978740f
SHA1e6d3ad41f5218ad617f06bfda192eb00430ebc1f
SHA256d891da0ec580daacb5211a8a51cfb01577043748cbcfb46652230c4648255190
SHA512705b16534ee309710112e895350c89c39553814ff39fb4097ee6ce2e100a8d53f731b1c64d149d11b0eec8af4ae50c218562e0b58cf6029a32231f08487955b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5138937d04e18af26f557e8be34be8092
SHA178c0c81923d96a42aa6a360327cbf756f4628e4d
SHA256bb51d71044ecf5d21802de9b15c22cbf9917c2e7a23b2204e3f48708a5b23876
SHA51251fd61b95ce03713e6ee0e0ecdb809a4cccfc8773806902adc6f84d87b5128517d47b01b8a17376acaadef6c3db441517f9641355daa7812aca703c273b5fb02
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54e2741ff2b332477dc3a5417af7135b6
SHA14f1697604aca5eda00f5428462ab0506de21e922
SHA2565d926f64fad99331023f1a4e48aff33fee69bdc47659bcb9ddd2755a2682a4bd
SHA5122902200c9d40b3ea59c522a5232f1992d19d6b9c1bef2dd31f7ea7ddceee195eb34357221dbc59a8ea9c3a9748b8b4d651d8beb619b3faa491dbbcd2ecf431bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50b8c412237f0207571e2fc86e285092d
SHA182f4b4750a07a73e9b9e68eccd798609b024d895
SHA256d338d05eaff2090334b9de45cd329aea1981fb61bd2d661cc849918a0702d7c2
SHA5121125a918772f2a8793c1ad53978d2d8dd2341bf66e1ee686f9d84f28eb6463a9c62d9f4d84cf960f5153fe518f6d9fa99fbbc78df2f34260960e024a5d37bea6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b4d1ffef799544cb5477e58e4c967e19
SHA1303fc75e3f301d914ae0f023abfa9f50cd703417
SHA2569fa31e3cf7ae42a264301c4b7c9cf49e69f72201d9c0c3a0ababecee8e5bb87f
SHA512ba780030d9b5faf6bab086d2fe8f62ae4d730f1520a3a1ce143cd4f7f58f611864a9b140c0b71f82728e87a800162bbbb88aba0968a3fd022ecf3d6e61dfc627
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f79355dfde9f57265de137727024076a
SHA16fcdc3feac8fb38659420f44d51f93ed7d85348b
SHA256af2fc19b7d7c631ba37eb1662051ed70ba82a1a2b561004129ed7f0db0b0dbd0
SHA512815758517f0c5bdf8447a4585c7dec25197c8423da8556273112e8c4e7ec97ba332ffc1ea8fb99006d7569dd228f4c1068c6d85978ec7297eb738c4adad676fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56b6f644080414db20b0678c6f35ac6ae
SHA11d4ffc193db1d52189b0e400d290440643cc319b
SHA256a0718cd234ef846a75e0c6b9ffa14088e92d781159198d2e57fbade5204437d8
SHA5126381249aa8ad24a98785e6e754f85d24d235a45c8c1eb1d853e98e73c7792add53727f1f007b41eaf07ec9c473a47fe3ceaf8e34a97cfd05bf49608bd01ee3e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d72c6a74f1365795eada2f7406a3a25f
SHA1e67a4a8c3a7398fb92b9a61b415938f2741ccefb
SHA25610b6d55602710b1934c1a93ddf355bd8c63810ad3d1ee23b8387e60f75990463
SHA51223c86b1af9b0c06b612b8a52f22495a1cc0c2361166d07a9e6c203eb0c8defe9753f6d8d8612cb5962706fc8c9050a90a977dc2849f9ca024a9fcb95890dfa7e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f3dde69e44bb34c2f93f1463f4716cc1
SHA1cd3a7c467d63934203762e34bda408498e6fd52f
SHA25692b2bad97cd0f31ac5744b91a097f73218ea4a5c6d61e42c4a0c2ee1d433efc1
SHA5121ccaf6c8cab200eb4e873b8b92359e34920ed710518bf2804fe513e656076aac2cbe5f48dc342d42b4a78e599f3674731ba0b03c99b8d14082231564b9996099
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD514cc1b231728299a32cc0a65260eea16
SHA1f6ddf741cd0b291c057054988eb42255ecede16a
SHA2565f5bb22295663cb6b55c5eb1d3a1ef08d0d3068d62651d76ee9e90f8a78c9f6e
SHA512e99f774d964f4a2e57b2fd91a0304103b848baf4eae1cd27ecdbef29c6e203a96662a635b93425fedbec1e8774596566090e47e0c68561d4c72ba5bd56447f59
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5047e06dd446a0407547e5f682d11dbfd
SHA1244c11486d32b5c2965f10b81aec275b24a3c551
SHA256a731441fafcc85cf5c4287544bf8ea11a3f80bf521439fc377df13336c7df341
SHA512e2493a34668135031375582519e46b40aa433e3c9263d09cc9c755b38261a334fc7c77b6776404b258a4422a85bb2d74040b371ff66da47d8de8fa47527ec7a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD531373ab95a1d0178ee2b162cd8288762
SHA1d7ca3ff15481a68a4f2c1299055dec20c8c98af9
SHA2562f383846d01e47cc7e7740e64669370cf55faaea9084f9d1c3dd8c33afa9aaf5
SHA512a4de52730498cd772484b94acde2ce08f1de8cdfc98d16bbe7f1760fd94626af5d46c7493a7b300b1a2953d991babafc3ef561a4e92f44f4277523a7d6e61f84
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD571f0d054b52511856d393723358b034b
SHA1c4f196293a08d15e9bea131625fffcb29711b576
SHA2560d1935eb461451950156dfc1a07fae2ae00328828f436156b70d6af178d56123
SHA512ff6512d54f4d65b39b98d0550c308ae801c9f553079bb040c4402a43ca057a0607f3bec5248def43e734278ff5ee8a6103c8ddf10a405d2c17bb05e1e51aea00
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b946bbc6d94ba7cfdd8fd57a20964cfd
SHA15f4006d65daaa62ca0a29612ff209a605d6dcee9
SHA2563488217d55d4adb2794122370d14a6a03375cb51a717d326d9458346c19c2868
SHA512fb8c90ae5db6aa6663a55610b2bc6a953553a3afb65029cfa1e2d986c382befa696d35aa9a0d056a6f6a3da31540af776937dfe9c285820b662848e07badc20f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53f400cd43168fda29d2af75f7b496f9c
SHA19cbbfa3d3b52e0fa7653d47c6de6a9b99933e533
SHA2569e1eca767ae7639b1c6d2513609717f4579a1364173a3ad544276e191160de76
SHA512d6fa9786baf1739ede8d299bb42ab464b6566e721347bcde9d63ea44dcf8f4619f1127b6aef0ba41bc900910b44ebc281c2f7311ec69fef4fbb39ac3860b7ffe
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a