Analysis
-
max time kernel
118s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
29/04/2024, 18:30
Static task
static1
Behavioral task
behavioral1
Sample
0855e4bfccef566717ca04d88b43ada2_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
0855e4bfccef566717ca04d88b43ada2_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
0855e4bfccef566717ca04d88b43ada2_JaffaCakes118.html
-
Size
460KB
-
MD5
0855e4bfccef566717ca04d88b43ada2
-
SHA1
c33daabe707b55cc7199467a5b7d2fe8544b0e67
-
SHA256
758eda6f6a62d93110359bd2503b700c121deab68a8fc1fa5082016344daf4d1
-
SHA512
c4842895e521c6f3933ed1acda1b2d306051a09efd0fd6eb0ec48342e98d192dc79c63cbf2ed1848a4f1b40b5af30d2a6d948dc36b7e473405b46a52188f6070
-
SSDEEP
6144:S2sMYod+X3oI+Y4QCsMYod+X3oI+YisMYod+X3oI+YLsMYod+X3oI+YQ:B5d+X325d+X3C5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000001e4ab8f995a55ecd3a8e6c5f4157fd75ef9f09c04cfa3a6bb22a636a6d3f4618000000000e80000000020000200000008e3a57400295825d7b90d4b195331502f2b6c150508ec5d4c5c3d7e083cc696620000000a37be19ae9892c7b3bc9843eab6ccd8668b3b5ebb750b056e7f5de09d20855e2400000007612aa1b4bf3dfe48e1b86c9544b880b613091fba26115e254a452f052835cf3a233a523113a243a2ad16645539a1f3ef250ac5baf029476eef82ad84eda3bc6 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40ca4661639ada01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000003e0f432586a96fb06fffd0050b517d3ca279a8f543a5a597a10a0ae0426b343d000000000e8000000002000020000000eeca7e1dfc9561443dbae0d208050b6012d61eed72f4950811dd5426f08eb9ce90000000eb8c10b7043ac82772f971d9e11c1bbacdbcfa21c6813581b360acbad2a159a7ab68d06e4e855f8d94371c8d2ec9bf176b4334226fa327f5b182b8a6edacf8cf7addccfcc6e9e17b5259dd96c137c5b6d95e2df3bf893d1a7a8160018fad4f3816446fbd8a3e946926b186084fcc9ff4a7f82bbc8d9ae9c4bfc63fd0b2457b176e4c722a1b8d46691d10f03c4c6de1d3400000003f790c163b9e08dfc86f250347c6f5ab6ba9c3db4f1df9ca7cf0e91d0f963e83d49f07030a6d631c4a77cc35ab7f6687b6cec0c72090a44f66637cc34709a527 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{88C34761-0656-11EF-AB95-422D877631E1} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420577287" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2072 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2072 iexplore.exe 2072 iexplore.exe 3012 IEXPLORE.EXE 3012 IEXPLORE.EXE 3012 IEXPLORE.EXE 3012 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2072 wrote to memory of 3012 2072 iexplore.exe 28 PID 2072 wrote to memory of 3012 2072 iexplore.exe 28 PID 2072 wrote to memory of 3012 2072 iexplore.exe 28 PID 2072 wrote to memory of 3012 2072 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0855e4bfccef566717ca04d88b43ada2_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2072 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3012
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d78f4b4661d7f8d4911a25f20936b5dd
SHA1bed99f4ea19db4311e3b5c521d944f1c048381b4
SHA2561542cfa828e4c243fd0edde978a8fb7f77266e2bf7e39057836db5706cef9383
SHA5129ae447bfeb44cfbd12640259f0245bc07590f4eb2e485242cebf3c4807aab15a9a7a506220a05bb643cec0052e52fd1a5793964292727f035b3507ea326a113f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59391cf8392dbfdfced832292b3a34c08
SHA1f9ec956b32404d053075a3f133c85c8467c8dde7
SHA256f441ad79663621f4dbce8e7b933643f1cb982b215c5acbec0a1279806b876c4c
SHA51215d4984f8253a4c1bc8313749fa69e7f8f59f1fc72a98b6e7d526c405d12d3f2f54dd11721dfc13c5898e734d831e97ee794c7f0d759a0d4d25e6b7b16439edd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fed80fd775b1be1b9e3d25bd2a6913a2
SHA184c188b1bab2adb51dd64d86de7c984dd8d0929f
SHA256b7562f597a39940e567f61f6ca11ad6b56502ee21213f0dbebe5be9763e86c2a
SHA51253f4bd1e7882a3ae293b4bf5ebbcc42c63cd26023563198a98f087795a34dd7243d8a8f1e1b44f4c631fb1c14aa2d52128d5c0847c054ea0ef0b840ba3602af1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51708ae7853b8714f02e620c9d83e8a39
SHA1d89790178c255054b814378d3052698a8d71717c
SHA256f3f9f4ba5bb9e4429d84f72893d7f275bbc423fc4b6158b09e3f13ebddad6149
SHA512a431e61a2f646da32c5ec71567cb39c0320b59e26a8f9472237c2ceb3ace9943b389f87951c3c0cfb91c13cbe0d65102916580be3382a43d35ddbfb1728a2906
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58c84d48a971cc0be0bb3563ff021ce4d
SHA15c9324d77e624262e4c03078d943f6b927a0e573
SHA256010166cb4545aa18810075cb5d4d4dbc8e34429b1a0619ac5846d1ab2e76cebc
SHA512a41112df72cda35e1963a9053eb7c4eabdad6943a7398f48a3d29c3f16fbd713e68af94f28438ac4ea2ca20599d602c9d57c0519e1d078320bbdcc3577d7caec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD520e2f1ffcf87e010d9f52683e9562a19
SHA1433dc533c399a17aebf70ab8caefb3152421e273
SHA256e04daf7704750c42fd998cdd3d5325404a396ffb17a45356ab2dd9d24c2a69fd
SHA512370ea289035ad05af61744ed8e26f56142febe49aefc65c7d9d115b0faa311ee2afdc41e73c1ee2eff68d8adce8ab7a61766105823e9bf9e3b202e74f50b967b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59437d3320a6745b4ea8315e50016529e
SHA14e90a16be6c1719b6ad913df54fcd3212422cec3
SHA256fe343d503fc468b00ed5085519cf5c0f713735db5914ce3a95ef20e015493cda
SHA512e23ea01a04d1214587230083f6c018f8cc1dfb0a73b6f7d202dfb73960fe09ad0592012e4829ef71082d9ea0c8b829308c3a94577e1c334199830f38e9f4944f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cde0bd555055648293244676e832ce73
SHA1f1401ad53b4448ee4b368db49f55de81bb13241d
SHA256b63eff21fb883dc87d31ad87dd4ea526a5be3d7b1f824a625ce40f24a5638f5c
SHA512489454d40f190bfd0f812aa01ad53d0224675ed1d5ef38babab61e5d0b5165dc5b741d7f66210401a876309ef3bec503deb626d9a5a51ee89d38b054d2276805
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e1dd6c303d35f03ad38f6bf5bef73d53
SHA112b1dbb7b49fd4c0f76104d18e32a525a0727b7c
SHA25619c655cf1e23224c11d0be4a0c3e02b072a15b6164036291fc1bdb6e82b05bf8
SHA512d95553932be9a4b66d5d05db0f168eb9111b7e93926a4daabaf0f817b56923491172c56b60f4750c02d9ffce51d9ebebf84e287877e69e842cade47d1a827340
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53df210ac089f439659877d6b78f40376
SHA1f7b0cb3d9e68ff178892b30aa19dcdf7cce9080e
SHA2561778947102400950211059b05ef47c54e63cd3c0269a91e47f02da39bcc62f47
SHA5122c0f81b3bb9ce7b008a0394d87399ddc2784107a8912b75582e3b35ad7cf3dd0f297ef56462dc5bffbe82b53d3ac4f2d1bb2dbc00c88b5f953cdec7b8940fb8c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57a3c9140f982621b4b34921e77ad8e4b
SHA1b1cb1d062e5a34a4ab2aa0cd223454a178f9c6be
SHA25690744169e30db54acc67d757844aa402314e520ba73db1297b522b038080e5f6
SHA5123f2e1a6f1f18668c80687c98a28a45f466dabdd838452e53c7ffb8bc74d10edd6d7ebf1ce9342dd93fec986fd72e57a8d58a16e205f273b495a39db0a8a4953c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD504917a1cb4c46a87a2402aca2271f475
SHA1f5d8c2129985564d7f041b56e49498f40a08bfa4
SHA256a4c2376e6f0923b2a3094df23b87593f00ab9d0063277c929386ccbb1d75a5bc
SHA5126984b27cc4e3878a908c1a1d766ac7b505e578eeabbe675d5d2e52bb9c5d266c0ad0afb6d5ee2531c6812335af683eb057f4a3c13026b2bf2242a66fb34b6c5c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD585f6a408a4e7e236b66c7aceb06ab6c6
SHA10613da8dddd702546bb10198ab3c1cbddd49a643
SHA2564906e6fec9c1d010aebfbdaad752dcb3b8f0b480d1a11104811513c19bf67405
SHA512a701d48dc239a999384ba466c9d42d7ec1c18075ceed35a9631ca72030481ef1eb49e519af427a731aaa93270ca160fd60dec2b67b8a19a59d3b0642148de359
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e32b03b10ae938d56904a5b61534f49b
SHA15d890d9e4d872734b1622c017848a0b287374ad1
SHA256a91dde8ec261ab58f77530010d84daf5bbf1b4050e5f787a072330a0c003dcd4
SHA5120a6e3bcbbbb83275fea02b10cbffe38da5c99bc4851d6c6880e43dc8c01e3b5144a4c97640b60a0f55b5daeab9b0d67aee9cabe59eedc2fa54b71b25591c46bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5795856508b2e4b8e4198683c78aae98d
SHA1e9fe360e34b0a7afdc67d7e81648be46a4acdb9c
SHA2565441ba3a00b06fa5ca305d0dc7362024a91a2040f063a86405c2cffeca33c56f
SHA51252193fbc01aaa288fa36c6ce18b24620ffd6a659260591b9dd348193f1ade9e294b68c91ba76c64ffef34f374efc1a0b9875a4b527d630ab648fcce01634f5de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a1d1194565343b06bdf5a0c63059d7fa
SHA142ad48a901b8954434bee57167d563fa2a5da4ba
SHA2563918903df52ef2999673471d8df842254742a85ee8a56e5b25e5d791d80bb1c8
SHA512f271caecb4da50dd9c4a89c9ddefefa54e7ef40057c6c04fde7b68f7a07a35f3b44291ef77871a343cf5dc2f7ea1ac7620ffe4c35952610cedea4f4037a3a83b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57722bbd4e6d4d861afc645b306fbfbca
SHA115b7ceff5812134c1cf387fbcff7f353f25b56a3
SHA25610bb7503f58d5f31369c137352b0d7419d8648ac1a63c1a688a122a0c4edacc4
SHA5120fe3fb57e97279b49b8574598eaae556f42ec862f5247b8b6caf244a66d9e530aa69a9d34d69e3f462847a8cca55c718ad53f852e3fd82bae4366761ea4e289d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51fe1699d82c2d875f39990c664cbe5aa
SHA1952dc62b37ada97b5863d0ece3bdf17a2a4de73a
SHA256043dbc9b3018dc2d7e8852838e17699c9edc4688355e41348b9167acae7b9ee3
SHA5124de1edb7c3456e5867ef34e39671614c654dbde4802185953374c25c537971b8b68dbf9a48f24cfed6d4eac1108be209f31cd99891403bc9a0d44dd410a92af7
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a