Analysis
-
max time kernel
119s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
05/05/2024, 02:49
Static task
static1
Behavioral task
behavioral1
Sample
15a46acbe6d79d925ec136695e0900f6_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
15a46acbe6d79d925ec136695e0900f6_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
15a46acbe6d79d925ec136695e0900f6_JaffaCakes118.html
-
Size
102KB
-
MD5
15a46acbe6d79d925ec136695e0900f6
-
SHA1
421b8eec8647ac21b1b9304ee27d940ed55d1180
-
SHA256
ef7dcc65579f37e49c666be660de6c808e6a003ae6e4d0cfcd8f31ed99ebb81f
-
SHA512
1158b375b28d865de059c9bd0b0c5b3f34c83a82c89e52b94ba72fb68c88a12bd84e02ef4b90141bd4ac8efe3afe30af53e5683ecde4e34c941e33c16306b05e
-
SSDEEP
1536:/gguqpp0jBVdUVVVVVVzzSSOOyyy66IIKKGG8B8BxxxxxxxGGddttGaa22hhjjZx:/ggzpD6Vx2
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8B713C81-0A8C-11EF-852B-6265250A2D3F} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000bce403957e66fae6d0fff243055aa9b5ede9870f6410469ff542824a771a7953000000000e8000000002000020000000e1dd9ce5f45000f0fb96c26c9ad56bf6fbe77fa55fbd9d629586c2a9bfc1df4390000000afd2d8fed585e45b6701394b9d2004ed1f881a64bce2b58f76d15d7d7e5287f7a98d832a059268e9c6334c9a6f597656c49ededf62ae46ac8671c5adecc21bbaf9478de36e88dabdcedc31932f9677d381420f5ebde49191e5dacb97e57eca4dae71134aa0371f966555ed3c87267216c33427a5a1b2a298b00e45eee5b74b83cd891c3fa9e1626182b4af98f29f0439400000007c28d5666db1f90e6a7e8dd012c387575ee3c8af48203968e1f194cfb6a1d2bf11ce7ebf16c4c5e8be3dafe28e8f7dc7889dd2bdbe769f77bfa31c2942e89cf6 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421040290" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000003eaaf22b514fa19357e5ef55d9577fbb01c0b702cc76e25c03b96c41e51a8641000000000e8000000002000020000000cb3fcec25de48e14f7e912319c0fb95ae6010fd4ab974f44197cc33cefc60c4320000000d84beff5130d6cd27127205ddd14404eb51f24198c291da1c55196b3e0175f1b400000001fd6bad4d90f67b0aa309239a74e89a23664ea386f10084e83e97a97e96099c989d92bff05fbb9af56b7ea18ea3f05bd62e2c9db6106fabbc5b3b75e2b293eca iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0dab362999eda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1744 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1744 iexplore.exe 1744 iexplore.exe 2148 IEXPLORE.EXE 2148 IEXPLORE.EXE 2148 IEXPLORE.EXE 2148 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1744 wrote to memory of 2148 1744 iexplore.exe 28 PID 1744 wrote to memory of 2148 1744 iexplore.exe 28 PID 1744 wrote to memory of 2148 1744 iexplore.exe 28 PID 1744 wrote to memory of 2148 1744 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\15a46acbe6d79d925ec136695e0900f6_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1744 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2148
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5616631af0b8735feb081ed1dbc235bc5
SHA1b6509e19e1830931c024c7c5f4831f7ce6b19d4e
SHA256dac03bee78744650769d5adee53a15b6fa38b0b81935258cf8b343a01cc474a4
SHA51213ee98a6d891d0379dc6ed40d79c11adcd3db0b33e0e282ebfac6940652721de4aaa074a14e2fc16c7f2462921f8bb428d4c679b7aaa0179fa79ddae86ba672b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50feae6ee5af5fdc7330875c4d568b544
SHA1dd5e3bd5031bb98d5883a0513a0c3073031d31f6
SHA2563050f1c3c7faa92df3f920ec4791cf1dd770d51c31901a997ff4a6c9bd76a716
SHA5127c21ebdea043d36f15cbf2899938c6d48119094f510cbac5fb70a94a1492629a4becb8fe7d6410ac1e5daeba6a355fcffb5ff48c583f88c16d4b1051e433f293
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53b7732450ad40805dc0db90f79a8f31d
SHA1a66839862478be3215c99ccb30ee34accc202e12
SHA2560a50e8cc53ac5f012d9605c558907c31ec30321bb17fc73820ddad14d9cc5bac
SHA512b5bb169f404a89dd86b20c4e17eca8a52fca82393e48164df64d6ba49698db014b4f097b461f29abc03733b37363a9192ad331a425088c8c48c8aa00a135301d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51d547dd30577cd8378957a9a76170dc3
SHA109a5e0c581e8a6e980a23f41830e4c4870503f32
SHA256a2b86d85cf254608f05350bdf66febd9ca50ec48041ea15f6d0bf5447f9e7ce4
SHA5122d26bf0b9ba7a614ada21c170ffa2356ec8a46dad50921e5e5a02256dc484cd2cd522efc7bbe1261c1f43d3b0ad18fcc22257ad6a1eae1fec7c86b86274ebdf7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55d4d27752d69a809b63409426b69e7db
SHA15c19f191d1327c5e0f4c779d80fd15370c8fad01
SHA25601d9c000a245a16188ed29b9091ca79814be9599b6b93b9c895dd6da251e766c
SHA5128bc1ca1ab943535df9b4ddeee7ab4625fae375d8c7651e25912a3e9aa013b58937e6ec268bbbb073097fe0d18d79ce031765892df7a1dfd087795fa849911584
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57224259c21dc5c3df85f3ce6ee5eb981
SHA1d3f70377ec3f7d0806a7c754e610c9499e38070e
SHA2565364651d8f6e375e5f0d302454c88168b24b4415e5f25aff79e52395cd126488
SHA512247d222a3d1852bfa831794a840a1fca15d5e404db535497d3c208884dedad4bc76ae06c2befed88f011e17b3f0a10bdaae0dd76427bfd6fdcf136853e021534
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD583396869fa254e6fd9edcbfe5d7f0551
SHA1c232c729e020c900b85f795202c739b90b478a71
SHA256150d73ca25dd563d9f4f55d91807b1c3b21b20e912b5ea7841af4dd73ff0d11c
SHA512d29d1732347156f32bde9b2f98ccf09f32d133e2fd7d0cc62165a1afe57b9c30b20ec77d66927097472185c6d9561c989bf70d7ebf6af6505b67730926c992f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD557b04a2550463c88f5e571d0606d0818
SHA1830a19b9a0aebc2d1966a2c4cf03656c3ae8b4be
SHA2565beba1da006ff429749ecfe27c8b2736779c4f67fa466fa590687819ef937a58
SHA512c8b0e5e84111f1a1acb65296600032b03709b91923f68dd90c5c4c5aa88ea09b5f28cc3eda5fa971b38989b12cee53cce4eaefce7e3c3ecfb3cdef75a3286a69
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5187a348c29266531c15d9a7a0cef83c8
SHA150cf8171f69bd809b1c477b48430c3008a64197c
SHA256a0f38d5301297d36fe831e9008501f088118740d5c127b1cbac6c7e89552311c
SHA512f2d77281f9a28fbfde099249c179eb6bb44f3f90424aaeab39a7d576cc90932906e2651f226dfc8bb146eab32a7dd34dc280c923a0c420baf68fc393b2982833
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57b171667a78e701c9896107435d981be
SHA19abd70c955e0c835cb17cc365162f87302cbf22c
SHA2563ffa4b173bee1b7659c48de924504acafc972af7ad1c29a575831f8b844b77f6
SHA512ac4b13614579f8144359dd3b3c736bf8a2d77289d4ce52c78cbefc255d3054b14dcdacb6c964cd158a6cd6553c634ccad3b388fbdc7b7a89a97064b51d9c367d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56e080077a74e4acce7ba3c730b1c9f4f
SHA1dfe296a7242fc48f1602dccbd8845aadee321ccb
SHA25610c571fdce82ec0a0fd2776f8b260f647fe5368aa37efa0f961d698fd41c51e6
SHA512431b08952380a0b0975ac41d78f19482bf921c1bbbfade10472dba5678147462f42c2f0cfd6a7da11a93962c16a6e259eb5e577b3cebb9f2027f9b8b22f42c04
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e44ed6d71f41ec7fcfe57519bbf7e487
SHA1bd342e3ec353fa87323bf6c6f07c3f235d87eb05
SHA256c94af62d83317b97d6fa9a04a00f55cfed65c03a5ce1263c668cb51064748e60
SHA512bb8528b9fa30e055f586ec98da81586eac62b13ff1a90a5ea159bc1e7bcc6d045181985f68dc20a6855b90f48a7c228dd074c5f4f5d8c00f9e1ff3753af79ec5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5177369c600812001503a0dfef198b21e
SHA18d3bc9015ef6d2adc324d5479fb47c891e049c55
SHA256c4562e29e289bcdb88e605156fae72f2bc13b04ca4198f7b6e3d0531a037a549
SHA512a2817b1c3ea34f31e0ad3a7a99295179fe1f2fc36065bc0d1506312bec7db1413b8c62a75330a29555955e66a7dcea7344c46ec71c61e40b6c5ae87f0cbfb627
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51b1b05e6bd003ab5157aec52822ee9a7
SHA14765a15468fc7ebbeec64bba1f97659fb47fc405
SHA2563387e5055567e04cffbf540126aff5141f268972dddf4e4023fc722356ac9a81
SHA51246275cab84f868801be095db45cb025e5dd09de8b908227ab9a06b03504f1b81d1eb3831407eb89bc96f60a3090b1f06f579a07e5b9f6f9ea17ee36076b1e9f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD505bdcff70cbc4fe8029764cb041d8a85
SHA1849f97c8bfc5fc4f4bb60f947e25adc77eb41c68
SHA256f026425bd2a55b563521a49224298968d87b5a053665dc6c118c5a6c99a99cd1
SHA512fed39524a6836b8d6fad86f910d20c64c0f1b3eedec2eacbb4f19bda100f55888187ca4c86212cba2244c42a71ea9acfa877039302a0daec332fd9aba1e852ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD553fb9eedea3cd0a97969f6cea51fd9e3
SHA1821b7ffdb72285b23cae8bed747dc512cda95bed
SHA256141a0b13cf0598196734d7dd77608535e0bee52d2a56f4e1378790ebc415f358
SHA5122c990350cc5c4b1f38f9b4d4f8a6df35a5697b8586eeffbe9d9da03efcbfc61176fc6cc3356a4826878e5727bc03d28183451a90c8debc451e5ac58437f0746a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD515f2b82e40c4d650dea6d4f834fcc1b6
SHA197c2c6200a93670eeaf20ba3078667ebf4290aa6
SHA2560d81064c2c13293b3e6f194979c9b2814964585c0e8a8490e35cc3bd391b5060
SHA5122a3ae15baba42c057acde21f6d2dba28a4addfe34c923464b6ca1c327a623d8b9ca5f72e052153f973e79c95cbc5075ea258b31490cb6ccb2fe346f39b408c5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e874d0712498610c00eaf1a73006be71
SHA1d0d7cda50787aadcb482832a3dd0a616355e2d3f
SHA25676aa279ddd037827a7acb0b2f931db59c10b19ff83711c843dffbb512f9d8e83
SHA5128ab01abeea567d2155ed79775efd2f33e436080107eef1b57f65da13c467a85d2ae30332cbff93eb9ddb570e54b798de4741680c2d7e5e2637e493600f0ca6fe
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a