Analysis
-
max time kernel
118s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29/04/2024, 15:54
Static task
static1
Behavioral task
behavioral1
Sample
080b077b2f89add9e90cc10e8a38f656_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
080b077b2f89add9e90cc10e8a38f656_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
080b077b2f89add9e90cc10e8a38f656_JaffaCakes118.html
-
Size
460KB
-
MD5
080b077b2f89add9e90cc10e8a38f656
-
SHA1
c54ee8b098f4ffc1280f034599eda6a7b3e1d1d7
-
SHA256
e78e95e7283b0d5a43adfd7b02be3adc5b12db700f12b2310d6c99150642f55d
-
SHA512
303e6bd2b188c617c53ea1fcd2f0b033aafcc1e40e560dce973bd50cb28012fb8272d07cf012616ad63b2d42f5fe1d4f2b1bb08bf93b27be3d9d1d574980e7fa
-
SSDEEP
6144:SFsMYod+X3oI+YDQbsMYod+X3oI+YasMYod+X3oI+YLsMYod+X3oI+YQ:I5d+X3G5d+X3C5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C912AA61-0640-11EF-93E2-EEF45767FDFF} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e000000000200000000001066000000010000200000000068259cc376a53603edddb6bb549167ea696d5cd222840a13a41b24d3d68e68000000000e8000000002000020000000bc11d355ad9cb046011da02d80026b48089a40efb55c3a810f3793c6a24fe33e2000000039ec770921b6db78987a8db05c589b5a5e7e647e29dc0d301ca25fc87dd72c0a40000000c0adfe22ba1c9789bef5c36f3a6e54f8cf604d8fbca56e8c713c1d4356ae78c563a92f84282b6ed0e0656659dad08685c6b8986b39107044dce7452004d45340 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e000000000200000000001066000000010000200000001ab325e2d3fc98d1bf193d3f8541a060717c9871da229b3718d13e0088967931000000000e80000000020000200000009db49c1e97cb6d8fbd843b6555ad84af1ec51b8a791807073b41285535368bcb90000000c13b8a5cfe121bfe3998bae144a119bb8b1bd13c189dd123da28ef80ff31eaa9fdde765294a26b5045e7167f566f7386a01f3e5181a63a7b7f86324503b22c71d37ca90c127cda930daa78b3528014ff5dab50c382d87d44d2f1b25b0a02a7de1d8c0054f12786cf66b2171011e9d76a19efedbeb8fffe7ebdd502c036586c0f62b7f861e42b915e4b8937cc01c2784b400000007ef00dcb50f2aa4dbceefd46272453e1c4105da6cbdaaa71d18d8e503dcfb888247aa93994d9c3cd1b19f11e54c81ce809d578eaaf0dc5e1d70cf6f681c279b0 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420567947" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0a2bda14d9ada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2780 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2780 iexplore.exe 2780 iexplore.exe 2832 IEXPLORE.EXE 2832 IEXPLORE.EXE 2832 IEXPLORE.EXE 2832 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2780 wrote to memory of 2832 2780 iexplore.exe 28 PID 2780 wrote to memory of 2832 2780 iexplore.exe 28 PID 2780 wrote to memory of 2832 2780 iexplore.exe 28 PID 2780 wrote to memory of 2832 2780 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\080b077b2f89add9e90cc10e8a38f656_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2780 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2832
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5047e08307105fe5672caadd70e8a80d1
SHA18134ed72e58101173f82a29aa320c5cfc151ec1c
SHA256562a5c767d79060388093f9a84b58ba3088b33884bf396cb3fe9d4919fa54d73
SHA51253a285059e07d1a8cf92e14f1b7c635bc7d59ea13ec6e97b547b634d3a54d67461328dec93baacc1d88fa470100aa9846c7abe490a4f0e0b79e34c9c0a634a25
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56db0d87bba6a60db1cd0db37386bf548
SHA12127114be60a384af45c22d1256cf5014523b8bc
SHA2569bb0d388339f0ef633fc7174be2be5067b46544d9402510ff919448e8272d031
SHA512ceafe430a2b201511e13f72711b004f6573d71baf22c9e86e7b10c8a3fe7eb678e1a9b3b8767e8f7a4da289387b42e874fe1242c4582ec183b81e80724f42f33
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50c37531d169ff413f8c3e154da198220
SHA1ecd2a763236c337d36f388f0a32c14fce9f61b73
SHA256ff0bfbb918a2d6054af7d0d7c050904a80aee3130ad5b5c1ec5d0add0f07af05
SHA5122c372a8490a963ffec6e115af86118ad07f4d3ac97d603f02f5b1242abd1ceab48407937a065fb2530cc2c698c8affb2b9d6434d01d9df3f4fb90f7fb8627485
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD555f669310267ed5f77dc4f3b7b00964b
SHA199286cadc8e95c1e2b3d111f461b32ad9e99676a
SHA25605e017b31ec7cb40bbbbab9768a6b7a834a8b5e4f7e3f2a39b718990196331d9
SHA5121c2d59fb03e41eada70994abd16216dad21e10aebc061a32ff68875109708ac6620fc2ffb71540dde0ee49dc7e83d47768c7198dcebd92edd46819a6208c545a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD594ad9fa4a090356c6604bf441b2480fc
SHA146e9a0b19caf3853b5d23b315166208e83f3eead
SHA2561a30682620f81e185bac9f2eaf8cb6ade7c3357f5a94072b188e0074a891d598
SHA51286a989ae1ba109de17eab1ca0f421e677a6830943a2d8a7e3db72920d72dd2cf30205486f45f2e032b7e767278bc94d095d20302c5ac3ad4fb2f401b4559e117
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f512481ebd9c90f8903393767b916e76
SHA1f7a91675a3982f4c05548794814383b28b5277fc
SHA2566a9e8153fe95b7028d259aa2255edea9f48eb54585d0552b41a15eff8b116034
SHA5125535915794efe37e3eb051f364ec94e08bb1f23d267b3e9a9fad16320038e384753999660f8daef48f05ea66257e58e685e5783b361f0797e50e1864bd2a8a83
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ba284c3a7f641cd3537295d69d43778f
SHA1c3c07f95b16f98f230f7897a11ba574d83f58be1
SHA256dbade10b0dbb2dbd16fed25afc3e392b3fbe327e68246dcab523358a75ca8c0c
SHA5128a54b267389771775c056c0e6601fd82194b5e00b2aed1f1e3225c4da043103f7505939146da7d2de7ad382b193a14f6290887364551624d8824880bc9332b8d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57745e02993ec61179b4dd1f4b018a633
SHA1d04c2cf0dee0007915f2c36becd1f5543b723836
SHA256923fca8213821a77272787d5bad2dc13e99304d326b6dcdddc9395081097ef52
SHA5129201d0c8d51e844a8d8498b735e0885758c799332aeffeff31727b25d2f83c981d878108acecfa678bef85d877976c097bc9ab22d862483ef9bae5f388d0d8fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ebebcecacbed52d426887dc064377406
SHA1b3a8865fe274832c14a305d35cc7e91a6bff4648
SHA2565d99b6139a790afd615ed6244ba3a2bc9508f42e9fa7ef14ba6b6ae620f66bab
SHA512593230697b999cfe46cbfe0109360243b379d197dcce385ad3fabd7a2eb5ea5a821a539f64112965744a152bdb412f26e83c475cc638d2777020bf68805ac5b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58f8c9d449db37cf116d1b6f3f18158ab
SHA16465b4711cb88b40a6fd374b6d457cc7e2071157
SHA256204904797fabb4a9e2d6c44dce6800d3c4d1cae5f2fe4b46f44b42dbab0b5e2e
SHA5120e601ffca0b2ca9437967752102de477eb04c8b860220ab2c68a971301775d6cf82acff9972099408330e832e2d93f14666d5cf0c958fbd398a1f47450ccfdf8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5654bb88a4a1555bf412d1a7589bdbe7a
SHA196b18496bee703dd9015c3d1d116a100282fcb8f
SHA25635c271d5231857a84c09ea62009c52d310bc78f1ff2fb90a363cef9d6d1287a3
SHA51239b99fefd10e502139005d444a3e6b7f486bab87242bbd3e8419501831181f49d90c048b8f691eff8c80fae16ac8c76cc3e948c06e9f1411579f39a2f7b58139
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD596be2ce94be9b549c9b95c228fcd352f
SHA1f1dc44fa355bb57726643ca315c3eeb5c4a6cae7
SHA256559110b928b92f9b14dc72daa1b38d4c6bf6636023c529b0188de55897a1df71
SHA512c8c8802b457b2c9f058af58319114e005bcea270f99d113f219e9b3cea65ead853c73d0c3dc1f086916b298d62bdd10289a8a84af7e82d03bd23bfe85e3a4334
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50057db55ce8bfc913365316be6f3ae69
SHA10cc2035c9b0905f82bb3d6457a13ec2edc4b76ec
SHA256d9b1d00ea862ddec65dbc4fc02d4309eaa3ff3338b983d24809c69d5ab8b9251
SHA5125652ce73b5f36cbc7d97739e4e912ba4cf0d3555ed12a96e50cb729da3effacea66aa881f6e2e0a4687d6e07dde494b86e5c9c27e5e5377f7f2f7212f65321d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5972e523cf898f97d9e21cbb3ef6e8629
SHA1f587eec38ef01671aa3922e66f36ab2ba61bf0aa
SHA256706f09a4a496ee0093b94e4984605b958eb6c5172d2b08fcb97d999eeaea8a43
SHA512ec8470ce666985dda1b9279b88e087900d6cda1efde1c5228a9af6e5045690577117f8cba1c1f9589bdb51d614f1eae1dbcdfed2ef48f267f1cc0d91df3e567c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dcf0cdc85e637c4ee992f9aeabf0af3d
SHA14dccf990f1ab23a7e2847ab28e80aa41cd661b75
SHA256762cf900dae27055514685d416014dce12479b5539934d21f0e5bc334dfa8b8b
SHA512862d536c1880b553c7c9179491b21668b589f79d26a1058a8fabb62872972adabb96f76fcbfd33cad713404c8777ca34399ce191799a3eeb5d09b2d30f4ef296
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e3b90c1b6a70aa7758dd62a783bcf99c
SHA14040c0d8f95d4000b5405aab78b49ccb53a01aa3
SHA25643c74b68cf9ef243768688cb38c161305550878bd18335d394adc42fbee21a42
SHA512ba53a86a875b27804c8a5b3ce4227dc0887c6854348c3e3fae3e3a1c237cb1e3447aa89964aa14029797b6136085bd6444bff65a0f09e28695b7e36c509cdec7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5de936a94ab9291d187398f77c243668a
SHA13da3b943a5c0856e4eb7ced74c39d38f146625df
SHA256c427772c0fc7a58f2751d9193c68f4bd17e2bae099014e24dbc16c96776b6a0f
SHA5122d9a13e69c778965be8b8a30b2abfdb3a1457f32fc5b6d79b22b632e0212e0c3b19aa82f2344bae3feeb2f728273804e43dddb41ee3a6af6ad967342bc3aae7d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c0bfb712b1185bab030aa4117a29d452
SHA15d68b9792a56f2a81f3f488e1a4768898e47041a
SHA2568113d199558e1ac2576fd81f8f9958d5838a10bab55dc165d0e894c678eb5802
SHA512ee0851e82742b5fa3b863627cf6d951a93cbc37cc43ee8cb8333dd42b38b17fd466e594c18cce28541ec0d77c5009490cda9774d206b8a1ab3c5ddc71b50ec6e
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a