Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28/04/2024, 08:01
Static task
static1
Behavioral task
behavioral1
Sample
04bb55679bd51f3e44b08549b6482964_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
04bb55679bd51f3e44b08549b6482964_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
04bb55679bd51f3e44b08549b6482964_JaffaCakes118.html
-
Size
855B
-
MD5
04bb55679bd51f3e44b08549b6482964
-
SHA1
4d11f92cc75c6364bb13131551e2b0f225a1b19b
-
SHA256
030ca5f524ed0ca589f07d4e91b46f684ba5ea326fe2046426213a6bb5d74927
-
SHA512
6eb04fb871d2d6238a9ca31ec6925cd90475ba96b9fc48f295056ef32a9963a29aa1ef514fff3cd5856844e825071dba7d1aa6685019496061ded1cb7c1c5465
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000002f9c45e3825486cc464eeab5856a3986dd2a1e4ad9b9bc1a2cbcb62298ea9ad3000000000e80000000020000200000006555c0cc4f5da0c5757dc854081947bfb348b42a6839dcbf61c420b441646812200000004abeaba403c94777bd5abd72497101283849134dc800c2b66fa31960d6180a67400000001e124ff3b1309b811a411f11857789a3d9d6158b4fec6e7478a63aede2d8e134a54a1eed6e3fcfcad75f0c76b20a0caf63fa715e4233cec71dda437bb8f39178 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000000e37fe5ace6ef54429f3d8d492d178ce90d9027b920f61813db532ff34044754000000000e80000000020000200000009935d263eddab1379e2367ce8006d3cf04262ef1eb9ed46be6e0becd9d67665490000000cb8081e443b936a5858ba11ad4b99b9bdaeb6ce789ed7b210f44852a6f07c08b1e08b4a2771f0658ca5605afeef231385c659aa37bbc5f20a0b7eb5c0ef02a40448bb48c39ea1468f515bf504c7dd844157a3f8b6adf2387e368928c1a91e6d17ac8e23851782ee3cbe23ace3da4dedcfb44b87a941ecdc38e84d2f18db3b382c05e2620bbabfd2baed57925f11fe9ca4000000068eee87719a020fbe1091c376bea73f0c64038f91c8dfe05891e895e8b9d8d38a173a089a4c990e5706545ec1593bb308f2becf791b00154c75f51f8d6e3ff93 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50c469424299da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420453146" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7EF56E11-0535-11EF-A5A1-E299A69EE862} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2008 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2008 iexplore.exe 2008 iexplore.exe 1712 IEXPLORE.EXE 1712 IEXPLORE.EXE 1712 IEXPLORE.EXE 1712 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2008 wrote to memory of 1712 2008 iexplore.exe 28 PID 2008 wrote to memory of 1712 2008 iexplore.exe 28 PID 2008 wrote to memory of 1712 2008 iexplore.exe 28 PID 2008 wrote to memory of 1712 2008 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\04bb55679bd51f3e44b08549b6482964_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2008 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1712
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5541f3fabddac69d101a8ebd9fb4856c2
SHA1a4f546bcb7479ec93ff52d8486b8873ffaf65ead
SHA25636de2cc7177719e8432db808881002198a4be0de801f2eefba595939768be198
SHA512bc49c74d9a8b080da7f170a8ef260bead669c196a4931e05f20212fbf7b512ca4cc867b7f5ff2139a9cf85fa9baebb1bf5facc902e14f35e97c0ea7d59f15f1e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD585cd06d8eed57b2a7ab01a56fde059e8
SHA1a1d07b5e93e20fb2a270555b990151e6a4552bdb
SHA25680836a6d4e5b143e128b974e6b438f0690abe6c411e4fb49f3ddd945f7779c56
SHA51287d450714ae2d2d128e9b174eeb1490feea9e0d9730d84991d02177ee1362eb94abe53753163d7fb55d4b82c66889854436349d056b4405e077c3fa265e49fc9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57f97827267032f63690b02b7febd0245
SHA1dc05a6eccd237d6784c151bc0d94e589f7113b78
SHA256527d7b4b963e0bfc7f1c5802e85ab9e2100e78de98ef585c8b9854778e3b4e0b
SHA512e55d66d0e90a88c3dd265173df7c54e4a3549d7a4cacfb35bd644f41e6420ee299408aca13b9247e17f33e4f1e180eee75380895d60f53a7e66eb174057dd271
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD569cf5cbe3ad781b636311e0ed03626e2
SHA1b8fdc0774dc8c7b92c5f4d1597ec528b247f9f46
SHA2561e325a5572263f7ff9f17e692cb79e9c80fa2c3906e8b65673625810e8b60429
SHA51288876362f58b8995284d4a11d1b3192b246cdf936c606728f58b0415fa2b310ae6a540f334032e6b047fe4ee5546898f6c04cc3bcc344fb64e254cd2eb29fc81
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5201e579b5d0ec5a202fb655a732e595b
SHA17c17464112fec53238467e753b8b1d5bd9096756
SHA25604afe79744094da9a7d905d5c3ad0bd308911a6b572008edad0e1a1097e68319
SHA512bbb7c0b405284773c503d4b819357b15b162db4dd50f33be264edfd789d9f21dd6c44898ecb403a47e36d28b034f3483ad204def6c5d65a6fe11b72b424855fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b2b1e3d9f6d84de02e2b94e60df15d76
SHA1b9ef1be379099799066f677f092a5857ee4e35ed
SHA2568fccf0b95823374c8c8f737619dd0263280e5cd4b7142568d48d6009423ed7c0
SHA512586fc53fd0b5bd62ba837916defaeba9e0421d3d35e74c8496b7edfef9e6b393681f83d4c8a456edf98a9ee8b6ed722c30073343337a3f932313e2e5a261d53a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54bdea58bff4ef2d5cb26929d47d8e1d3
SHA18faa1d2d86b020b9145106b3605a27d0c9e12e82
SHA256153a8ec252f73c0898828007a940f9189e3deea1e5ed96a52682519025ae4bcb
SHA512564445b7d369cb6255363507d89ae92c4fef57f3e3505a23b49066adbd506e1a92cb0da83a35e1a7241bf81466f5904bd39d32f58ba834bc85dd59ab80c439b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d056bf3f18fc49604f8b647a5242801d
SHA10d9a4d28e0e9ddc92fdfa64781f98939dc5f09da
SHA256af98e18e8fa6d5f0fd2b27f82f3f2d99f838fa16190a543ca003193f59824d93
SHA5124b79d51ffed9cda24db71419e4eb79cc9e97e0427896ed995d52d00145af492a11e6cfa152c38b0cb48929989bcc25e27b8e97afb7a121196b59a41ea7b8d210
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fa0ad74b661586a0a6ec039a6fe69b46
SHA11e6326dff38ee5662de9f7f97fcf5968dc4a2542
SHA25625e34705b2e0540c97733bc8344695bd4d92a9506483d32175b9b9099c437a90
SHA512a4f5dde5df955a775b7110b994a0f654d1b0c63dabb71fb3a89c74116acd66b2a8a5bfeb44b05a5508c7379df7513bd54f079a54c9f14c483a6d95633b2400df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57b6d163137a052d291d1d04a27856cce
SHA17820ddec3401ff9390c062aca789e531b4cd0e04
SHA25615862199da233510f7035c1a16ede934d4590fc408252968af8571848be19e4d
SHA512a7072068fd2689dd8700fc901f29f967b0a263554979cd196404cd012a1ff092ce0bdf2b0040a6f25eeee8f02264e1727570626c25343c30ac83f09f9d521187
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53b118951227cd5540f5ebe2f6b525942
SHA19a9fa986367579e889fc7a6478f171de50faa28e
SHA256c99b6c1d618a12de5fa8a54248521113d3ae7a0bbda3152f51cdaff71da24b97
SHA51293163ff69ed6740f3d6fabf1d530bf629f03bf415b94a4785c3b6c60a1e9967f519067c948fa75bccfc3a71b88df9d281045ed4ee80c3dfa2a528eb4c8bc7ca2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b4d9e3567e9271219525a2fda23ae07e
SHA15a7e9f039570ad60f4708179b8e99b34476bdf9d
SHA2568b1e4f3be1f28510c431979bbabccbc3088fb3c2a91daf90c993dbfad5f4c32d
SHA5128c9f32928e3ea15909c9eb448484eb8b9163537eee9b53bdc7b7fdaf4bcef73434257d86d991c5005c80eb545cbae867931e19dede2f8d2ddf71237c5bfae0bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f72e93a58140d24b716aedcfd52a5d4d
SHA1532288b5e91ca5cbc0d5c711706d0f9f2b4e21d7
SHA256fe1adff492f1e8621cd92d97419a3dd16d3acf88a9881098c0a70c6feb2f32bb
SHA5120d7e8b830cdbe90252c02394ab609b1ec942ff7b8dafa9702a367fcfe6606f1efec4563dcc72c04311d628171cab66e12b2948ded6649ee2a1a2039a93b208a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53a1fd33e58beeb4761650fc2764aac88
SHA168db2360a0031c4ca3ebe0694b99b6fc334625bb
SHA2565fc82d7d81568566664e003162a3ef41accb40be057dc3f70d51373e47e86b04
SHA512be5ce4e852d0977c5a02d48d0dd7aa12c83472393da3e637164c49118c9ecfd2584059d1b16bb8cddb49edbac250698a9be1b266f41c285d78ddd399b1e7e800
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50c86d92751cabfbd805496618129a60d
SHA11a7eb45c6da56686080c8be824ee3799411f4660
SHA256956c582cd1427fcc4464d58ee1ebfff3b8df91281443432f7821771dcdbf49cf
SHA512dee2f1a6a50975f662b1d3a88a7f3764556164fef96038d369aeebdf8259d451771d8c31ef21d3cd1620f79e077e211f8ef87d466e76aea26cfa69d79163a125
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55b4df125fbbe8d79d28d842c51c0556b
SHA155ca44ab79686aae27f14ea461c9aa0939f08e39
SHA2566d95058053a1107b767e00030718ef1518dc2f1a3e4f1fd8d380a874b1320b68
SHA512ff8044e32f747f820269c721587775f16ca196b3cd7693f0e5c7b5bb49d71bd3db40fa4480d58c114864573d31be5da7aec47fa91874928ba712fd340ae22b43
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50381f753d66959ed37ef69808ffa5a6d
SHA184ab60ecb6627e578f7a03c4ba6612bbaeb2dcb0
SHA256f4442922056f05db813b9d33d8c027a23abc321b9a74963a0f94286518c78d44
SHA512429466a501ae2febb98ebe1b7eca261c757f11522a7ea64f4411b4008e3644d2e77d15a00a1922360d17d0d6abd537d0bcdf31d152b9ff858da973416a43131f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a2bcef2328fb20d73ffda4b95219013d
SHA11b872fc7661e6a72c0c2317be6f89b7a29216b7e
SHA25641aaf2a74b471788577ec4ec854c2885438e823f8c1923c3d0c78d76eacd1061
SHA5122db5ead9c7a3fb3b18f65dfb7f14295d430546f75a57a909fdaaf87999b3796e3bf070baab37c4f68fab31d2ddbb3ec4320486420d82e9658ac7711a1a321b6c
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a