Analysis
-
max time kernel
135s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
30/04/2024, 15:42
Static task
static1
Behavioral task
behavioral1
Sample
0a177977d2a879f54000789392e8d836_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
0a177977d2a879f54000789392e8d836_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
0a177977d2a879f54000789392e8d836_JaffaCakes118.html
-
Size
128KB
-
MD5
0a177977d2a879f54000789392e8d836
-
SHA1
7a296883117ac022af059611126cbc89b77df7ef
-
SHA256
9feb9b7186dc8616e9df06fd8438c3178b6cedd5c72d2e73e50a02fd7ed91436
-
SHA512
2d1a9f816dc19d3245dc504d321cf65754a4a577ea34dc799d12c1133a1e4b2b82c1a7b159a3f6fda6d19d35b34200b4c08e81f2676e42680b3e71f6f3e50645
-
SSDEEP
3072:1ccvGiiDEvk9OXyfkMY+BES09JXAnyrZalI+YQ:RiDEGsMYod+X3oI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000e582c6e6ede1625bf9f78f3328f3711615c44b6f07d15bf309cc0343a7ad935e000000000e800000000200002000000023220548dc7e98587c9bebe1df6cd8adbc1d0eb03ca3071f097e4219e46b206520000000b740984455f801391c85001da183e1e8a852ddf020a214df65b9b2215f63743d40000000fbd542bb263a690898662e0031880c182ab03446b33a5c1e19277effa66b60b15c3f5983fc254fa39417565f00b4b00644fd06a460ef2c7713e029e42b77b735 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20668c0b159bda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000b7ed241d298663617df55775734052437c39de275a996909e1192001df3d984a000000000e800000000200002000000058fad25f69cd233402cbfb237a331871b96c5063b36e44cb7c7f4fd60808daa190000000abc4da2c30fdd8e9753f77f529be5e2070a92cc039b0dd5e785bdb8f353c4160b1b25af5de7ff3ba495473e3f04076b2aa1d161dd4b4d45b6763907a91e6d2ab555865824ba2814fb5571b13d1d8bb462fe434ab116e822404bfb6100e1906a6576d3970935d4e288b569959163a2e616b0917afbfee2ebd7c4be4f5d3f396b660b5a8622cb26d8113a39e179d59fe8140000000e9b992821c16932e6f81d044ec5e660a0397e7b2bcba425ea5ddafa9dc955822696cd936942e705b6e654998065b5a4baec8974acd4ba2f748400ff23d918658 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{36DBD4A1-0708-11EF-BDA8-6EB0E89E4FD1} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420653602" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2372 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2372 iexplore.exe 2372 iexplore.exe 3036 IEXPLORE.EXE 3036 IEXPLORE.EXE 3036 IEXPLORE.EXE 3036 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2372 wrote to memory of 3036 2372 iexplore.exe 28 PID 2372 wrote to memory of 3036 2372 iexplore.exe 28 PID 2372 wrote to memory of 3036 2372 iexplore.exe 28 PID 2372 wrote to memory of 3036 2372 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0a177977d2a879f54000789392e8d836_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2372 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3036
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dcb741773bed1be7a249fa1077c76ad3
SHA1e8c6fc3244069a3ef3902ea5678209638674531e
SHA256398b3751b839b89aaed8e452ab19a3331120d97b27cc12de9fdcdaf1f5f6cba5
SHA5125989c76444fa55dc3af88ac014d2a87faa2a269981a42c3eda937abedf68a8e1e26d2c332302d4a77df845ea3ccb0edd3752b30967450789c276ac0fea26cc62
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57a67102ee53e6cc768911b6e8a0cc638
SHA13d1effae318029314e5bff2930a3c0208fe38db4
SHA256aeb3bc86405215abcdaa2e89e2c52808e200621edef5401e3321506d0ebd7217
SHA5123e648819a276d4351f69d3d5e56694e462c9b0915a77633996fa5adf545548b42c86b9a9674ebe5f4512a98d59ae1b1e9786bcb9115538bcca2158f286b508a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aa0030ccbb68463e818428bc4a215f4a
SHA16758d362a88385e9c5d3935adb08a0293d950212
SHA25661d6cb2ac4e7436ca7028bd0973e880a34afa57bf7d303d4339305134667a0b5
SHA51284806bfced4ceaa2099cdcdddbd49333b8daf84c12fbebae0a707b32c1f007a9e8fbaafa75b74283b1ddb3d6ccf0c72bad7d6a100699d6396123d332583ba36f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5de0d5db5583720c61317893788f74689
SHA163935904c02459f4239f9b44d1d5452aca63f1dc
SHA256507c1ea52bf1af4a79e39c5865c3bfd17410ff69ccacc2de0f642457a8cb2611
SHA512f6c1000912e1f32dd581bce8773b7c6047e964d566851f660e4239001f84bcf8ba56d143f5d07b30c81e62e09ae15027b18ca1fa76a850b00320e2f3d4a9ec0f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD558fef2909e7e0a9b70af5c6750b6d05a
SHA1b07c2ebe7f9bbc17a1d4e6578064ca6bfd06d068
SHA25639b4379c1fb065197dbbd62d82f50dffe07e98ff8e0f41f0e1485924b694315f
SHA5123fcb4f39437f5f4cd7a1cd47797189f4ee9e8caa574b8b8b0f3776a51a8109cb1cb08ab05b08dc10358c5247e71e5bfbd8180c111b1ee5999c8390d254a45ff3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50bfe7629afbb110c9d57b76aed72e5ab
SHA174dd45e5388b405dd23facc590feee0aee29e301
SHA256dcb9a5d25c9657afd1b48a45cdecece19d8548c79d3c4d08500846d02677d9fa
SHA5126ad57e7048328228190b1476194e01bd25c69d3633aa2b482af9db6a35cd27e536c4dc094642a06bcf33b4224b7328c2efb3256345b22abe2fde22c59c18d968
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55f529841fa760f69af5d8a563d9748f0
SHA1dd65c5beaab86d22d036419d3e067da999f8fbf2
SHA2567836257671478195b2cb1da0d230e0a28c33e0291197871440331ebd8bbfa115
SHA512e66662cb69b50a6c8954f2512ca75f5b2b1082995ae9a64c7fa155b7104eb79b0ca5b32ba4d2571e9d6d9dc4b1a1266c1f52a1d17f41e1657a8ab58d5b58a9f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD566a4c518719bad4b70ab7f1aedb4d677
SHA1d9cd252528c2408bdcf8667a9c9743d99644cfd4
SHA256c9b09497bb7c959e2b6680ef505c99b3c0e1ee0b7e6216d25e2777c827cbf63e
SHA5125d097c00b5aecb4118f9d83efb85c088ee3d43eb439409f9f582144fcae9081777a12593628df7a60a34e39fc0e5e6389d7a48fd11398f320c59b26d30fdde4d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55836db98bdcf269a3648226d62351715
SHA1a6aa95a7fcc8002f6ee4ccd64baeba66879c51c3
SHA2567ab9b105d6eca7960497143598769f7042924ed8b36f328bf45897fb42d7c709
SHA5127e5580563c7e08bb3722e39a7ed8d881192e5c3bed436818ea145c4afdc43e1e99df5174073750969611134880c473d057de39429569159a561f6227009dca14
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58588d96c00f1ac64cefc94916132720c
SHA1b85752a0f34f1853d50afbf5a3b687b6bef1dc52
SHA25653e3314d0fea20319a00814a41f54fcbd158b7fc49489575824ff7e3a983a031
SHA5123ca719bc74e2d7f4e71e2198f563c59aa372a4da22ec6742bae723d8d450cb8cb2b1d466d600efdbfb99a189e55b6505e5c6d4e6cfd6f978879d4d727fc7db66
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5385fa17ff5810934d11f76c5016f5d2a
SHA13b9a9f2a732f1829f4f00e1bc376ee0e07f9eb11
SHA256c493a86caf3c595bcaa144a21708c84305a96952a3318949b5ed6916e3732d17
SHA512b00fa9df94b8bbe83b39ef3463949cbc5f0ff18ae4eb59b2a493bba771f2fda957ed7bdf661f7e3c9daa186b704dc4d3961b22d1a138add8f4e26ac4d41faca7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51a338ac2fdca36913cb233fa84adfd2f
SHA1d23119d5c9bfafa381882401fbb7f9fb50ebff31
SHA2566ad58eb08543769b8005871233bea2ff41d4eaafe92dbf5c4c87695396e8b0d3
SHA5121b61c01c283713ed7c33f5f99d6b996eac1b5de91f16f2fafabb5b94e1e41809483f514c7f619da99cb8644b520dc611b76abc0264a104bdcf6ba7a48f5c91c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD520ca86a6f7d5ebdbe476f5855c3ae373
SHA158ee09b228e85d0c4ba3a2c66800677a5df1a34f
SHA25669d7acdfdd52a6e36de0391ab5684288841623623e39b7dd764de2211ea7370d
SHA512a6609307aa85b5271ecf3ef4852a6bfeb43996acaebed05a04f6f11cefc4a1d04dd0321879dfe2487e2285075853ddf214f927da6db379394eb97ed7267ad755
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53a47fceb9cb1c5f0773b8cb80c74b112
SHA1adb2a5e8aee8468eee285aafc8b2954c2f49449f
SHA256b733544b1ef47c13a3ca756a67dee47640fbbdb0f75c7fa29c2b77622239d120
SHA512353e16c5dd68961a1db5d13308fe042c14af09433d0189114ad98502505504bf37ee144f9ef4e5e23547059239c3ae0da4fd79f81c84ebf1e8e80728a4272b20
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52f921f24ee8d1ef188c9d47432faba0b
SHA165c0285a955121ad31c163518e0dbf8be5bb49d4
SHA2564e118dd5ca7185eb5517f550a900fa14b054fcf0a349b0a39705c757e2b93187
SHA5121b7ecb7b3a852d6c70ef179f540904b9b42c467b25b0684787bacf28e1cccc414f9ebcfcae2f5f202811900ec70da9a09c9790118df618297192886775a7bd27
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59e1c87abe720ae7f01dadc6968d3c816
SHA16691318ef15f000dedccb548d67d0b633c7ce1a5
SHA256d63cc764ad26f6afe4ab32162e272a7b47d2cf2c543d5076cf1f35884fe61657
SHA512f9b4a1bc70b4227652815d0e888cc090cf11febda0275a6464f2ad2084a8a9b82cb499ed7efdb70a542f1e0780d180277a7acd611cedfbb2eec2160e825fec35
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a