Analysis
-
max time kernel
119s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05/05/2024, 05:33
Static task
static1
Behavioral task
behavioral1
Sample
1632b7931b45e263353e1d714d239485_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1632b7931b45e263353e1d714d239485_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
1632b7931b45e263353e1d714d239485_JaffaCakes118.html
-
Size
461KB
-
MD5
1632b7931b45e263353e1d714d239485
-
SHA1
90ff8d037322bd8acc800a55a3911e787e8d511e
-
SHA256
f61665122ac1914312842b87bb12a79f954acf34eb8ca152066e9615dcdf1c61
-
SHA512
34c04b05c24d41ba815bb40162bd755f6bf6d25f771c9722ccd7aa5f7a56bc3d5d4a14f7d1db72bb7b28c10dd8a2204979c419b8e09c7adc05107563b19f03ae
-
SSDEEP
6144:S5sMYod+X3oI+YMsMYod+X3oI+Y1sMYod+X3oI+YLsMYod+X3oI+YQ:85d+X3g5d+X3v5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000a05c39d2256c81644012828e6b5cbb9838bf4cb69c3bec605dd27760af4fa3ca000000000e8000000002000020000000af542e9ce8c36497a67a4d06ebeac42727608e96b7859b482e0c39945505b87d200000000ae6218edf27b9cbfea0d9954c5ab36c03df0093f30a63f6637e660d02ecada4400000000c7e45d74724d8a5247ec16818f2a8a4257ffcb5fe1fca2dab6ac74e3b5c7300ecfb36ee2f9fcc405106f0aaaed64306bb43e57f4161ecfd46d2f16ce23e433b iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000000c9152eebcdb3e22f5fbd123cec88ec05d109f0c1b90af8f9d5608a3db47ec5f000000000e80000000020000200000007835b6786b3148f0cdb2d170a967f6cf99f9b47ebbd2c3520ea54ce134e7de7f900000003a906ce6ea668204a3d37901f31b98958a15e7c3baef2f9727048d5b67cec940e15b196e6a2a3b5e491fece01962711fe62e9c81f5f8da6f9a73d4afbc838b8e25e24c7e1c915c4fce3341b16ada5d6f427f8bbd621181acb15a9b0daf1af48bc3554046a2a134feedce44458751c904fcbd167b890512bd60b4d6d63403bee02a432e6eb715cc2ea5663cffef13e84e400000001bdb4b569063553098797e551597d46f4c680664985f8a66920337197082d3ec0cb0873a80df2c9f594269896db5161b3305fff16d69b397d1435333c08c92fa iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421049066" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F9359451-0AA0-11EF-A7EB-E60682B688C9} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70f102d2ad9eda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1692 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1692 iexplore.exe 1692 iexplore.exe 2616 IEXPLORE.EXE 2616 IEXPLORE.EXE 2616 IEXPLORE.EXE 2616 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1692 wrote to memory of 2616 1692 iexplore.exe 28 PID 1692 wrote to memory of 2616 1692 iexplore.exe 28 PID 1692 wrote to memory of 2616 1692 iexplore.exe 28 PID 1692 wrote to memory of 2616 1692 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1632b7931b45e263353e1d714d239485_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1692 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2616
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50835f99b984c8c609f74762d7472455b
SHA1408e60083b589063793e266369b49814b473103b
SHA256fc5f677e3ba64b0f1e9d818be0b18bcdbc779172fb46ff65ee0c0f78738124e0
SHA5122e6c95449f9876401eadd1c010e81ef3fa9fba42b78ca11eb4f5c569e9da3693784120b8e95d92779f9802dfe19250c5748a17fb11c395831bd5d1748767da65
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53fa03b3dc03fad3223e7646b26397dfa
SHA170c4320f222fa5b986eb64157da527887882bbc3
SHA256ba937984f886ad0f99523060f44b9011ddbe8366675d29b6af21b7742816f2a3
SHA5127061e07eb77f9ff2a8215bcd1f1a7c86127a85eaefe821449ad57b5d2b4efbe5016539c3ca7b8d66b630154a379a8f5dd042c0eaa576dbf3fa8d77685b7f6b41
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD578a1dd1775010c580634d638ac8dedd8
SHA1a4fd8aeda1295c057e91b138540aa5271f1c1df1
SHA256ad8d3033f476a2ffc33d16f8f3bb8cfb4b13503c170018b21df16c777224331e
SHA512fd9469dca1c8814c404c04f28cd5a5a24c0d99391dee1443ef409f0b986b6d0b4cf2dd9bc12502b59483d88f3c2cc9d2d5ba5b313e69a8a32710e3dc76c4f481
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d80a078cabef8de91ebefca46b3074ac
SHA1c301509dac6ccba1d7bb5767f764ce53dacb6951
SHA256a69136d8f4653979a6f7d05e16859f9c6f1f2707642e2fe5493f18f2d7f1c466
SHA5129b849bf31d7934a136b73eb1e7db35e1a2c5c9b99fbf4d903707585626aa01fcdd182e234f440ff28f31f8d75130922638637f5a7328cd5dc6073581fea3c4c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD524b5f7fb4fd785fad738509c6f9b6d82
SHA1e6938eeb8752dbf3966f08ac59ab7fe2d972b430
SHA256819d449fb308794ee693eec471b03cb5d63e6e44680f90b1139a1bc0f0bd622c
SHA512c2a6f34dbc29df454a057aa9c53c720735d384f32d444b35a421cb92c4d6a3c25cb7414c9fe5a27198948c3c00bb3bd0bad2f80f71391d9af19e1b4557f5fbd1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD557c371849f182bb169a11a6a073ba451
SHA10c6aaf93cb0a599d398bd0ca9b3b92793ced9f8a
SHA256d7320d368e3091e618c73b0a877c21d0857e1872ddaf889dec803614283687f1
SHA51288ece85c44fbab378608a37f243c65edab4c235661fb6863cee7cfbc794cea80d3c6cd9c65527c8c47a88df65e4c140ee5ee6adf8396f084eaa17f6d890dae61
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54a11df1af7c91fc9283475ca8234944a
SHA1ce31866e2266c13b5620668183fb32b145fe753d
SHA2563c6d77abfd84b2a1aa597b025de51c763890e20f71904e1f06385556658a5ba3
SHA512ce7ac2e46079d3af6950d2c7a6e190a6780269521899e56b8823692d2a56f2b0126944b32b9012187bc6c55e726f1ef34e245e52ec14c63e28e7dd3cecfe0c28
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD560bf346f248601af3b65f0a81a2116b1
SHA1ea22e4e5c55f43fad33023dc6de35f752dcdb1ea
SHA2566c85939deade94104df8a8a2a20118fbaf88dec6f8fd63c136a74822b02dd21c
SHA512f8ecf54678dde0ed1f56f55debca401960598e62c3ea34393d99025cc43d7ad237d09dc14289663a6c5501656a50c3e85cd173495d5d9e1da5ccd557d72fbcdc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5656a4cd4618fc7ae13a3d1c4735fdb1a
SHA176ea6510ffdbf4fabdd3d576f2ea61ffdfae52bd
SHA256daae649564e98d9dd0126489ce98ec215079c817d8263edeb3ea733ea72041fd
SHA5125e19260f98ee9a65ffedcc15582e5435c37af4394a02222115c5ab32922aa1cf84c564d533b68faa95623d61003aadd4e43121eee5b4869ef53a692ec9c453fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c391574e6f8ac4ef055f4f064374919e
SHA10f719f525fc9d56907942326bf98e37da0739026
SHA2561a25c89aa5554ef8d6acaabf8e27e99ced514cf598ab171c80c7900c01c9abe3
SHA5120043fe3d533cb37476eeb2cd3eaf0db93ae1585b130a75a3b357f97afb560550b9119a076dfec59b20959493037488c0d676d15af39f3b8874e3dfb53dbd9346
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dae514c9918b051c3bd60cc8087b3268
SHA14e75a2a49d57c76cd1eab5b98a83b1f325005593
SHA256b6fa91db3fd9fef7c21a7412f74b40fe8655e4b87a6edb096493c341c9767bba
SHA512939668b9e1ab69aee55783ec77ee5355ac6b0fb9cdd5e697b73aac7205e977cc2356a77b1b12bb91081d69b599095c29d0ace31c413b82e7909971ba86ec50d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dca4c0fc3747b09c2d7408ccd53f5752
SHA184cd339f2e2a22dbb4640818e5b00095d0adc42a
SHA256eb6ba4388b1a78dd5cacd645dd02e1bbc0f7bbb8dad98e44b207918e7b7bd328
SHA5127e3991c2dd068149cd3864a4256ba62a1c1b666919f547d1a3b18542fcba798ce7b9672dc5e7e397f040884a878d517e3ca361abe8955637ba78855f80a983d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58d6ced410bad8efc2562a07820e5bb0a
SHA1fbb5eb6d45945f71ee52933256920f8919ea2369
SHA256c1fb07cefe6f8f6d2ade4d69c3a4f2ee8af85b249b52e77c41836071c6ad1026
SHA512826edc5a21195ceff18d3bd002c178a3334dc381921268bdff948136e3cfa5dbdd90b51c2b1c0d74bd7f038cd8ca49ba901b0ec4fbbbb199075dd7423a08194f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52d356a9cb2ccbe0f7e77f86d92c47fa2
SHA1fe914b64bd8cc58e39c3c1d74545343c631e2087
SHA256dd7c9f79fc8aef6d024a3b0dc277f3e79caa1d35dd567bbd945c62d24ca4ebce
SHA512aa26c37e37020126f995c3f1d92c30321b560b541cff53121e6706800274ff896973897f6a1bfc5940746a1161fad499d82b2e67ca3d786b256f1702db301951
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5404a6d0eb6c8f32354f5df97a64dfcac
SHA1200f7ff537aa577b7ae489f1539a9dbbf10026c6
SHA256484854e5d7345b2eaf7f338d67ae2a0e0ca5b3159e982edf597e7a9aa6801b59
SHA512ad30ba3eea981f6daca4b5464d21a40353e9ca085a49a8bdc73f6f05356dfaa6352f321e9f23dca1d3f03948c94e77acd0f78214a28a5b7d7b48676c48eb3d21
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c85173619e85309a56c233e0fe20f262
SHA15263731c23d21e31e08ee52b1fe4f8afac0518d5
SHA256adf3ddf7e62b66f20f287e4993d645584f192bfa2be8b2c20869df1f8ad28f3e
SHA512366e6bb038d9869140c76a9c69d81ded060f8b1877c2bf44f2257fa171aaed29290e93f6e1c8676e8175abf5e9cc5de100a005cdd6e44b801b7f00a77b34be64
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5480d60945657e9151a750e604d21f79d
SHA117645ec7b4e21e539c37dcdf20ff4cff8bf9a5e1
SHA256bd4569c50edb89c95c3fdd3eef97947bfe71e5d9ef55756e47dd0d7707ac46fd
SHA51286753687321263ae465c778c8f9bb807dd281b618584956f95ccc8d7beff9ce1b90e064ffe2efbef60e1f9340d0bbc827e445702e4a3894268ad5a91a2eabbf9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59dec5239b853e0c2eee0e94527c69c1e
SHA12a0961493135773953379e3d17ba9d8e24489081
SHA256014cbf1bde0548508c7bbc2a46962d0cb73abeaea5ccf5a1eb623b999bd93f66
SHA512644d0d515071854597fad35445895fd29401deed49dd18966cbfd3ab8ae43fe34c07ff8b87534d874b250488162899b347379679d772f707a20197eedc89b4eb
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a