Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
29-04-2024 00:54
Static task
static1
Behavioral task
behavioral1
Sample
0675848bdfe20039494706327d892b07_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
0675848bdfe20039494706327d892b07_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
0675848bdfe20039494706327d892b07_JaffaCakes118.html
-
Size
461KB
-
MD5
0675848bdfe20039494706327d892b07
-
SHA1
20b0c258e3db736f148a93a6178fd8de476ec054
-
SHA256
66e6fb9a02b41539ebe19215b91f45d4c245d57b9afa48ff216469ed445817e3
-
SHA512
4aa7d945a84220faa739fbf5ce0eaa367a0b24c54b6de4e3607c0143edf171b2c3b44b351da111b786164ce8d0f5bdd4f077a61520a4954f200e74ea728218a3
-
SSDEEP
6144:SVsMYod+X3oI+YEsMYod+X3oI+YWsMYod+X3oI+YLsMYod+X3oI+YQ:W5d+X3k5d+X3y5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420513944" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a00defe5cf99da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0D6679E1-05C3-11EF-9DE9-520ACD40185F} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000b6ef4bf700e4a5fd57bf3c691d9ca55f59effaf3d39117da8872c9fae6c018cd000000000e800000000200002000000002510d4b1323684e99a8e48b62767beddcd5c8e2dd8a6f5c0e5b5f0b8951cead200000003b88ad90985afad6d2ade71c9a1655ea3e1fdbb67e32b8599721d5a817405d5240000000530c0d6d4e6943131176a65a874ff4c7fa7c1c03af961c758c2fc66868af30fad9b8a5f57c29f70302effb630146ff062efa1c36204ca75d6843e5987e164c7e iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000f6b636843ed9ed1eeba37d2119f651d16ddd1c41f83c43bb8414e36de3eec353000000000e80000000020000200000009a04d963f90cc7435d3b378fc4f162062059a03bae75a2e0334023550c5c5ac190000000d7d5529138058423fe67a9d8b7383d8e353ce4557dfa3735cd0a53ec085e905325318bb3710e4d33e960a6151fbe872fdd40f5eadeed7bd8a66a94f98c37f3cc81d53755845b42e0308c47441a05fa05a1c5470aec5eb009d4e524234c058f7b580c4b4bba4426c6f3a2040c5e2b4dfb365864fb9eedcd3449bfa96bb48ab493b5b5104d8b180e635e3cf8c46642bcca40000000f3373f096b5f26fcb43cb740693d9bd4600afc0d8a3cd2e5df455e65790076244feb3905c9027f571c95bc36b49046168bf6bacd0360001366f2fd8abac1a5b4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2944 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2944 iexplore.exe 2944 iexplore.exe 2616 IEXPLORE.EXE 2616 IEXPLORE.EXE 2616 IEXPLORE.EXE 2616 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2944 wrote to memory of 2616 2944 iexplore.exe 28 PID 2944 wrote to memory of 2616 2944 iexplore.exe 28 PID 2944 wrote to memory of 2616 2944 iexplore.exe 28 PID 2944 wrote to memory of 2616 2944 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0675848bdfe20039494706327d892b07_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2944 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2616
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e9fb86cb65bebab7840d3eaa6a7eea24
SHA11e93293ef0e9c6cdf3274e4018d914bc0f28b54b
SHA256c89679b58f33116a1723e3cba296dc544fdb2e6423ca126f16377a25268eed91
SHA512ac4684f5675bbb34418f0838d5e5c5209e6e77256af2826f2a5110ce71dbc595c08c557ae8517ff33a2620fa88dbbe0f6775e601c40abce50838120b62ea8899
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD504b64b57a03b8b257053885cce505ab9
SHA1933678ad93223f929a5eb570cb0183a09a70a5d6
SHA256255071802d539f982447f5eb6774ff42f1e5a7a55efa0c129e3899492618cba1
SHA512092cb56e12b80121e137110d8e213d9aaa33fe69bcfb4f28b57afa4fb9b99a5882b5d652d4e1405276397c3edb7836d1f72d2effb6dcb7dc6c53653a204e1f09
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56ee35ea05ff5d4ecf4f173bff35b2df2
SHA1d726baffe28ab5e94b1a4d2e3313423682522949
SHA256e5d4487afc48a2bb0883c45c95a469253c4b3f9f68437f4ed75340b92a964fbb
SHA512c746f32e7e9bed83a2ff3bcf4a337a2953ff070ad4c7a5475386580f35da724d3a03cc4a52a67beac77fd6fc08685adba42b612daf9c369da7e5fed9f51fbf91
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54bea78047ee7958891501531ec0d9e49
SHA178201a520af407816120b5034468f95d47df1a8d
SHA2560cfc3cf498cb586a463d85e4f114a7b364a40911c0d872365fd70cbfb5a948ff
SHA5124439cedc0eca3458aa940f01d5f7d392d53e9bd07fb497d24638cef181d75bab74cfeb536ec0c8f32bd815e3a239339d190037fb647b2d10cdf8d417e5602072
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d47b8f1856d2e182a375a8e3d2e1c74f
SHA12082f8d43cbd0504a47b2be15aa164ab9099ab5c
SHA256572be7a4ec65e7aaef1053308934e454fc93109dddc1e09ce168da984bd0bbc1
SHA512981bcfc435ff3acec4aa68bb8c6e1923b2cc2dd2f07c4ea493f9f2eaeabb44bad87f0f5d259ceba1c4cc948bd57f863d1e1444303f7cef351326c8410299e5f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f3a0935657152be425497fdd90c0dd07
SHA1bb5cdab25677f2706a98c9d403d6ac35d34a8510
SHA2560f2622497b2827b08c9219e9b2c82ba65f6f59d911182fc6353136fa7b9cc881
SHA51297b23a6b6ffd2512fc6f0c588e82bbe87dae9ead5a8db3bf892571754cc381bc42e0b3cd0b3011c7cdf946100b724798a1915064897b843eba07a9cac496bd1a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53bf5cc502e36a71033b125bc7e2ef81a
SHA1c6c43c6972bf93d47928b49a7d0d332c88e76509
SHA256b00fca89359416c485cd0b3036a8727f06e0ee2b4633306c36bd2434f9593c32
SHA512ba01479dd3151ecd5c823e0243a7de14c7c9438fe8d462ded36b8dff3b06c9b45d3aa855ec0c77d0207d2e75808683cac6a9a22fdfc33434e439bd85e5012524
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5de08669b7c1d16bae0a10f355eaa2eaa
SHA1bddbb35854b91060d6a680778df5e4fc4492ffca
SHA256adfd4d2149ea61e63b2719c7947637560280075f83128d1d9bfbadc065732f4d
SHA512fb3c7c6102ab009b23529acf894558c1c6a18c24a82d6804145bcd9c0ec1fb9a6718d1c3f23c09881d9437e24a2e67fcf007141a8ae14b3085d470bc17220b2c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56ae32179c1d0afd9c46f24f907e83a03
SHA17d70d0c0441d9edd7c0cba75e775b8e7eb80bcd8
SHA256d0eff135d3101160d70e604ac27dc438f47300efb7bb011b522e3a650e8b4b67
SHA5123074c2ba9222c91bb440145ecf3096b0e26a56ca977dde87687196c7d447cbd52d01560272c43740870d229c1cec6aeb3dbb765b5584f5c20290ec1c629d1783
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50e2df1dc2795232b563d21321c93936f
SHA1dfb625fdf88a1657d054843d76f2c593ac29e078
SHA2568e67c93d0157ecbe4fe7cc35b12cf408256d939dcc838048edb0ed121c5e8dbf
SHA512301eed752b37117f2ff786881a19425c297decf69ad80174bf455cb9f81a3533604becd273c82b59720b17124e5bc20a1258e4322a3e89f8807240bbb0a66bfb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD552ff73dfb95bafa62c7af2efc8646216
SHA1bd550f100784572cecc38b24a25cba463c59483b
SHA2569692b1ad8c3d8e9992c7f6f60ddb19cdcc83ecfe3cce56e042cbca7df646e209
SHA512145cf1501d3dc060112ce1bbcd3ab601cc49e8e2a393a7565036a735bc2506fbfac6e639c8d23c4a67fd62f30275a3d750eff9416f74a2a4a8e63c09a5c0288b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52bbe4dc3f65173f66cf455e1ab9a54ec
SHA18594a1217f5330d8c3a5ebf45d280045b31dd746
SHA256752465c0056204fe6246718bf266d2025e64632922ba5eac5746fa8d1e92564e
SHA512225402275e825eb4840c1b78d833d82263a2156904ee6f3ca746bf17079c81558796fc1f6616e7212e7d36d065bd1ae50700fab73d38c0a5c4e649f856abe71a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53d9eba9ae20157b96b7f3d42189303d9
SHA1d2d0a0690ac5bb0981083e27eba23203b5540c68
SHA256983b4ac0dbd74647f2854ca0f4c8104bd850652c915b69cd9f67cfbef75d16fa
SHA5123e8a3a8a7e372a896797704c79479945101bdb4eb18ff57365852594b5755aed21bc5e7051700f7edf4604306691fb8297f0e71789b1348980bf8a5cb291f263
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5829470a34df99161a36c0d6b17bc52cf
SHA153ca7529a072581f6b26bdf95b4b87273bed21fd
SHA256fb9d810523ae72dc38c2e62d3e4b1a0b347601f1b621edec5cc576ad57185f2a
SHA512b4eea21c617353d0e06e850e3611c3362671d5fb0b95700764cc01eb23c6c52466eb732aad98aab51f7f424c7732dbc5a4746194fd06d902f8b67da0806ff572
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD531c45c87305946a235c363414dc76c31
SHA140aefc04de1e65b0ea23a7f2f63d03223be200d5
SHA256f5ef2281ff075bed6cebc812364b07333d7dd0cfcdfab37eccee6bd0f931a8f9
SHA5128f97a18f238e02f771109ccaf706682a3a08eedfae22069b799bdde237df211d91ab4682d31d5855d7d306c5eac57f78d3e8b7198d1e295e51e749ed553e0e2b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD545e0269b3d252b3f236db016f4df2204
SHA163d9ad6992e0d8ce7cc78e93af26b3e3c38ed2de
SHA256fd7ca231b64117ed9c6d72d73a1447b79b31caafcb39311bce129ac8f7a57888
SHA5125ae3c3a15c511df8ac319c3e3f57c71faff514b20c1db623599b2d90797170d7ede06a40aef8709159f6d5247e8596082f99806bc58c99bd7f8dd5c462739c8d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dee4e0dc544b7a8b871e3cfc9eb8de78
SHA1cf9d4b816bfdd406135a067e66210d10e5e6a5c0
SHA25634ec9edcf46f8b0317d28bcd1564001eebb0a63b7023b497910767599ea6282f
SHA512fb527ff351365b6140c1c6729cb1941dde276a4462bc8eb004424d18daa0dc0a58dfbfa14f2c3df9c0bc9ae88b25a7df862a3b6609a4a0abf11ba130a8458cd7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a8c400fb727458ad6e9dcab3c66a2b7b
SHA19eda72c3678b70b995d68106d2a30c46dbac47ff
SHA256279e3f43005a3a2a2ecc9bd1de30e39f330bb00625dd3fe7062ab947fc3eb213
SHA5128dc3f9220f1fd525f46b65868481f1c824155024e91828e335081783990f5c608f3c3e8e1b47721ccee59c6b95d1c9dda98e682d11536bbbd19be590c717d0ea
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a