Analysis
-
max time kernel
132s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
30/04/2024, 04:30
Static task
static1
Behavioral task
behavioral1
Sample
0905d13b5f83e4b8ca773c50c79a7e0d_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
0905d13b5f83e4b8ca773c50c79a7e0d_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
0905d13b5f83e4b8ca773c50c79a7e0d_JaffaCakes118.html
-
Size
6KB
-
MD5
0905d13b5f83e4b8ca773c50c79a7e0d
-
SHA1
b9c21ae2d4428c2f8f24dfafa19d9d8fe5499b61
-
SHA256
b4f2a31a05819fcca2d5d71054c13cf85fcb9b32d10dee917cd864682a5af177
-
SHA512
d38361e294df4c577b2dcec3b2cc7c45e3d0cb6b12800228621a7f27e1ac95549dab346d7f7ec98ad36b8747737dc58cd458e378bbace758c635fbbf3ad96c9c
-
SSDEEP
96:LuYFOFkF/3cFOFkFGFYZuE4DG8Dc89baSdc7W/HnGjWhMOx:LTFOFkF/3cFOFkFGFqO9vi6/HGjWe2
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000001995822b8965ed5bea93af4bfc54ae95329fc20d377d2737d2ba35eae3a2d7f6000000000e800000000200002000000031b3877dfe51503b7e25ac84bfc42a691b3074ec49676e27fdad1b21a9fd8be720000000a31628e1fb69708607cc186e91bbe0823c22a1697eceab49bbc8999944bca1cd40000000d207b1a45fbc55601d0cae5d364b466a115ccbcfff9ebe36b88109e1052f1775dd15e534f10ca83aa4bdb04598feb030723a233c44d4c0e0392875f662f7bb2f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420613320" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6E14F181-06AA-11EF-ACEB-F6A72C301AFE} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0749f42b79ada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000006c36904c74e0202a6105ca847123b61024a855e112b483570a06e496b7e2e26c000000000e800000000200002000000061a31101e567edeeec1bb6e48453b18b00a28bb6bb8e161ceadccf8e1cc01f74900000006ac8e9101e4e465a499786ce09ad76d6f32991d55244610173138df96264d24b7cc3fbcc9228aac0f72ea8068c45dbda35fbfedcb662461b9f136de9388c61f2b57642095a97545451f8530252806db05d13039fbd97bf731f6ab81b5bfd466f324944a668b58c63987ebdbec3c6db84c5d517e9f42dad18d0e70102dc28eca778b23b3d8229c463979dc30801ee1584400000007277d87ce24e0ce430cac36a92a5518ee67fcad52ce9ea48eef4fa44a8fba3634c856763318f9a9037442ed807d983407603362320a2d1230ac8f3db290cca6c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2620 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2620 iexplore.exe 2620 iexplore.exe 2248 IEXPLORE.EXE 2248 IEXPLORE.EXE 2248 IEXPLORE.EXE 2248 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2620 wrote to memory of 2248 2620 iexplore.exe 28 PID 2620 wrote to memory of 2248 2620 iexplore.exe 28 PID 2620 wrote to memory of 2248 2620 iexplore.exe 28 PID 2620 wrote to memory of 2248 2620 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0905d13b5f83e4b8ca773c50c79a7e0d_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2620 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2248
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c8768454cddda2087aa20adc8e655fa4
SHA160c19388c971849bf38b2dcb0ac8b94c60687e18
SHA256fff82872e2962d7ff804fb749805923c5ef4bc92394e6e91854ec9b14ded711a
SHA5125f5c35baa51c5c1e6a4099b83d2ecda774512742e4f65ad35d33c3eccee0c4d8c428cc565793be44d02cc7b9cda7c635e5332539992f9bba7ee51cd33737d8c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54baf2d371a69d18e061c77bc20abbc04
SHA172117f9552fe72280e130459f2a3b490f0b367c4
SHA256cef8472aef36dc88274597ad8ba26ef7963f9e5ca08cc5a5bd3bc1f8471bd06e
SHA512a2407d57385eb02a72111d22395caacb8d4ec240e9ace244ffe65396b8520f2ff28be088f7a33de4aac0264c164a2fa2928871ea0a76705d2f186d46c9a9af5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53b11d221060c7d5a7c03b1f6d6929f5c
SHA14c1036ea4cf598dd3073e7c54cff57550480c98c
SHA2567f30bed0d03fd31c27d76467d8e19393f4e4e045582f338f4376620421a46dff
SHA512760dad491797e4975c605c3399c879bd17787b9ef1a3f6032f97fbab7c3db615cb006e9551087f08873d70d0f6426b9c380ba411094be943b3a57c14a4b68219
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD511956cd74338651c897b0f760a6b6f55
SHA1aee1bea7752e01f467d3531cc3dbab8078cd8c41
SHA256bafcbc558423625dc7cc460535214c0c7aaf748be786cffb0de1fe34e81be8c1
SHA512a02ccf631c66ffe13bd24b289c01525cfa725040305b4689321e737f40586989815753efd17cdfe7385c6914b54eb6ed16d341850d89c6319be41b2d81303acf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b9e6785e93c1424b6a78c654920474ad
SHA1544256bf42d8fcbc647a6b6f6c87333cf3afb49c
SHA2565191827b0fac94f3c1c1b44eac0f64138053120309faf7e49287002e4455a0c8
SHA51247ecf27b0cac18cda935533561ee2ada12415245e46775a802beafba6b311534615f8b85d332da7649deb3b4ae5dcdfb6bb889a1342f7b2fb746a812086eb990
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d8da1384084876704cccce10969a83cb
SHA1df832645537fa33a8e12f12cd2167a60f826a158
SHA256ff164fe4b4cd0491f6f9a6180b2275f0360c264e1e9c681de0dce23002e93437
SHA5123667d47cc2b269aaf8c02d47121fd6535d9198a31320b903660b103918ebdd22c2066ac5cd849e5d6697bd50fbeaab3d614dbeb8635dbd40bb50efbbf351bd42
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5756fd118b8fa964a71fb4bd6fbe74f5a
SHA153f68c6a9f693d9c04d44244d8c564af971a843e
SHA256c109ddb50da30bf9a4566c48c01696a07845fe004f41443c5a096e85ff76a290
SHA512ba978caaadb8f4e1894d7b250ecd26689a722a3dac07ae604ec47810315931809abbb67b582c181a596f53a79538e78acf70be7c924091d47cda6425b3a0b263
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55eab6b8a42f9992afad1d2a48201b809
SHA121083471ff9c7965f94d162af33b830769af3df2
SHA256ec5da0be16d741a5031801fd5f4c4fbe77ea4a8ec5388f419bde6a6388b32cf9
SHA512e5535c65dc3a462de12b9282278d18d594fa7b66d9903bf135eed6ec6d59a1a78d453d098ac5408796ba454a57ac41219a012691ffb66ac7cb4f10b41c09e690
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50185fd818d319da440b144cb3de8e1bf
SHA1af6db06551591aa0997e60bac0f9d80de59cb2fe
SHA256dd25d3d641750e6da18442f86ad2ca83f622978f9af6bc8bcfdfcb2ea24156ad
SHA512a56da045cc7f04176dfa7cc0f4177eedfbd9e07ea81ed93e27780b575771503990e94e9c8cc39fd13e0430c5d2e5709d30e7e1c6558a6110b57a724ac51afbb5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD560653f8a7edae73ebf4ab4198e3f58b8
SHA10c19a0bc76b05a2905d2a288b8b4025ed554b81f
SHA2560bc74fea0ab4b5b6d40cad45a7070705a02dffc82fdd6961c40b69ccb1c56c38
SHA512e9406ab3ee6429cdbce1cf4e89c3e8469c69dbde295e71117ad04837290930daffa77f9014e8d6091f303aa935abaa63845c4bfd9db3fb231a3265daf9095ea5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD583523b3541a050235b9f017d07a2f85a
SHA1e360e85cbc752a0966416d08163c7f15c57381d5
SHA2565a154aa4db534737d7cd493c9e5eb1fc1c5fdedccb5d65810fc3b07422cc8673
SHA512f073e05ffd08fe1862033fbaa60bd6d2d9b5ed382f7e42835b082321493f307bf72ae44c1e3276ea99ccf06d2e59639e9a2e716ebeca9e6bc249e9ee8d082972
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56314214a756ba0fb50b2e29860356075
SHA1e1586e03f8ac008ab02fcf06a919b7ca49b58f2a
SHA256d829535df1301d91f62bc7e3ac5ec16497183347a14cc70d2dc940369951d477
SHA512e34ad4e2c56b87ac1cceb2aa7d585b1cce55940d03728953a45eda1781800dbae6962ebda1e9c47df552c381d1238e80c67ebce5f66138174c97c4f98ca899ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b9e5a8cd10b8d372bb4681bc8713fd55
SHA1fd735b91e362cd6405f033367d20d693d2c24d57
SHA256784612364c82fc72ece2b1c47be816a6bfcee9798f951eceb6af91619d8ba371
SHA5129e15d6e4cf8d82ad0438f2c96334eb8ee9bc5c1a7586c259ff6df6c947e3719ed1173d77250d0adc82082b2ea432fb21246d6e43df8c37247390588d57aaf2f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD534d8eabcb3fabf0930f474a28949c5e8
SHA128521f1718db521e54dc9d082f2a96b87aeb22e9
SHA256dd5439bc1fd48d8625a1142d11a3871fbe97daa53f6edbd80e88fc1b848ac4f8
SHA512a4429055420641e3b562255b86e835b3a76c45d9ebb940f4635c6f20579e6b4932df98ac5f45c83ed4b61bd8b6edf3cc7c3f79766448dce3903d8692baa5bc17
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c785ac61b597c355a80d4cbe1aa16ce2
SHA1a949b8a7a9dbfb8fb7b5a6a886a4bc67f8efbf92
SHA256d7098f01d8e621f0d0b657697cee7ae8456eff049a20983dd79db7d8e755373f
SHA512bb0d5436487bade8f191fcf2449f478ca5dbf80150663c3fe471effa94be785590da6441b5b1e82f29834c1d6267712f5db385b68ada891bf37d099a06729d6a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55afa0dc664723ddd88be7ad3baf863e2
SHA1297dbdbcac2bca944dfd47d873269a04ac2ab240
SHA25648136d782dbe45943efe716a938724ce2ba8b6fefe3a7b85fb6bd67372a8742f
SHA5129994c86b386a0ac328a8df4003bab69c8a73e1c75295f390bff51e22fa927d6a66908a0a65b25129d958c6ac41e7b373623bf0c0e905e269cf7623628c07b835
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50ebad2c1d7938763fc35c0a080948e53
SHA1c840120cbc29b1918f714cf3f08f68b3463f4816
SHA2562d738d1227dde0c79a5d3fd3cbf7f24d1fe02aebbebb98c2fa5cd1c8981b0ad8
SHA5124a202c06d71518b4201cd3b42063735cb42207b0ff11476631e89ce1b3b918db8fb56b380aa2cee7fc2ed3b044b11d1661e72ad1eff655d9ca8b99d5eb342276
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bf28811738305b06ae6ffea9c5898433
SHA132c52568e1fa5a174cea619b194ff8cf4c514b46
SHA2562eb821684d5c6ebbb34e4b4f7cf946ada36e62d7e9423c4a2449457fc1950d5b
SHA5127821cb1ec7b43a8d7e5207999ee8871baeb8e44e44a3eea3afb83a56179c0a341c2d384a0db21eedb74a3fa89fb5f0ed090dfe48148a60727b11ce29cb8030d4
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a