Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05/05/2024, 11:55
Static task
static1
Behavioral task
behavioral1
Sample
178e77e3182166aeef42313734f455b1_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
178e77e3182166aeef42313734f455b1_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
178e77e3182166aeef42313734f455b1_JaffaCakes118.html
-
Size
24KB
-
MD5
178e77e3182166aeef42313734f455b1
-
SHA1
7821b94cbc2fa1ba6cd37fafcc9916afcaa5c02c
-
SHA256
77d947cab320d1ea4b7817bfb6fda12e3839d459e2439d4bedc37b7a157899f6
-
SHA512
9d78f24979c8bf6c927595ad6e86c641647e0eff02dfa270bd82c96aa60f4a953c755bde1065e6f5fbfc54fc3bb984178edd0ded8da22075ee547a7df8d47b86
-
SSDEEP
192:Hqvl596UxfvW4j5fYsVKR1SPQLF7hShJ6N9ZYAvtc+mDdNVMjP0kur:Kd59nu4NxVU1hcOP0kur
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000875d9b7a74e88db2f30fdb0e2d34d6e690cf55405ac0f790a08a7208b3ce0ed1000000000e8000000002000020000000c262534aa6f34e6d61c02f616254b6fe71e76cc4422341e91de831d6ce55081a90000000172cefdf19e018cba22179fee0605198e7a999e2fa0acc7562d1b068679435b3c28be3a7bed700b57961d9b968f4e7ec26db11ca7000fa7fbd1a8501abc2643bba8a3cdb23011cad379eab272927809ea2bebec94d67a663b566556df4b3800bc000a8121642a88e06a082fe49a50c7b7710a756645259f28156de036fe661d3194b35019e5b395d1b12840881d0784740000000408c802d4531a145a09479ccea4b95a259d80668aa44678eae649eab9aca8c7907ae8096b933385c380153946b329057766cd67369df1a8a33dcd6bb6fdf14ba iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421072003" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000ca234e816bb184b06a1a64174af74042bca56ad83b8084bee3672b66e2760bb6000000000e800000000200002000000031cbaa60c8d80ff498d14878006100c91e66783637891f794d8d6f6a1711829a20000000a503c5185cf0946fdf255a50dc25fd172cb1b51c6136e87b2b61bc13c33b9bb3400000002f558a61be4bbfaff107e2e2de1ed928a0db7bbf353cad0d7a9c2b936f86a3fe4bfa672dec6d89b09d7b37c8a651fcf50b5598cd2a52699976e0f2078c718a05 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b07bf836e39eda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{61E03751-0AD6-11EF-8A7C-66DD11CD6629} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2232 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2232 iexplore.exe 2232 iexplore.exe 2508 IEXPLORE.EXE 2508 IEXPLORE.EXE 2508 IEXPLORE.EXE 2508 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2232 wrote to memory of 2508 2232 iexplore.exe 28 PID 2232 wrote to memory of 2508 2232 iexplore.exe 28 PID 2232 wrote to memory of 2508 2232 iexplore.exe 28 PID 2232 wrote to memory of 2508 2232 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\178e77e3182166aeef42313734f455b1_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2232 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2508
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51c992385f7a56eadaf3ec0f39db78cbd
SHA10930c0729abca7cc502c0fc30f68fde94d75fe6a
SHA256d4173312de88c0350c9128a74ed00469d56e1b398a5c4f9234e830911f49cde9
SHA51258863075cfbd88e4126a93d295d2c10bb739be0b8caecf80cd0b9111b2ec832ceaa54ad73a23bb3868375847cae722a7211a369e824d35621b18a92bbe02f6e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58a1440989696b6fdfbbacf0c691a3d6c
SHA17461ce09c1811cb068caf95ef01c9bc27081eddf
SHA2564ee0143410bff8f9b2f25be1da70d894af5defce505e4d0d7813a4321f1a6c62
SHA512539e61587845b028a89aecb9605261080b1fe3de0842f8eb53e689b2bea12cdee4f281cd060a4ac6b7effad7909c628962d1a7613a2cce403d8e419c6570becf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d86b66090d20b3765ddaed112dbc1dc4
SHA13937c1e8aa7ec2f4daa76b91441b62308dacc425
SHA256663da2d37307295bc040d8f7992c0426e8225c717fc62109b5ad61a6ea847a1a
SHA512dcef46f9e34263dd86d78179af755e189788dcdb9c7e486a973264138d00273b4c367017fd18f5f7372abd78d1a13ad6c94a9e2dd65cd8ef8ac02c5c4be35f98
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5347cf67b6de3a2dc06e76aa4c5d8e18d
SHA11397fa0e2d41234d66cb81e1c464fe24d098223e
SHA256d1ff360212445cd03a9a27f4d6f988acbeb46e57ccd73e42bcb2992fb5a9e729
SHA51263824ea3364807f6bd91efa99acc9a562e53fdc6924ce9d1388f24ba60b293a434761586413add1f33ed546e9b66ed4a227fe2887bc35f79ea17604dbf58748d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD526754899ec7e6bf874fbc12d7e6cfb72
SHA16a9f77c98079b50a248048fdd5d3e41cd50c3f38
SHA25636780eab09d0e6df66e59e04a4eea35a6c0633a5781820e6f2d501b585961ff9
SHA512ed40243eb7e3d42eca8eee6b97a612f4aef8927dd32711df561c44685ff809ff87de6d52bf21806b221411d95deac9b010b9d7a3994d2ba428ddf71b30c655da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d27fd3a62107ccf704340418d23e4bf8
SHA10ec520c3b66bcda5dc2109c9b9c71a9e250e6d1d
SHA256a0f88551787ccb0c143d4c9114e09b1c0cfe19262ee3cf7a8ea9b9bebe727a79
SHA512fa45cf1f897ab0194ac5c05c38f390ab78a09c1f0428b9087fb9a87f25fcab06c2a2ba01a915405b4d962cbabfb33311c75935a82ccbf7d63922af9745d3c712
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5986f5e87b8adc7972cb4c8b2012b67a0
SHA116889c699bbec4878771fdb9cd938935f970fc0c
SHA2564677109963009cf67719d24ccb36fed3ad8cbd8eaa22e3d395d0dfb3dc68b665
SHA512e7b40424900514108204dae6cf2e3e0c14d81a2500a31638ff70ed3a464c978d9aff7ea190e1fccb50652799bb4aad22047fc4529994b2d0bba9bacb65d1bff5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50f37c52c4892601e0f38682db3279a2e
SHA136bc6b9d7ab191e67a6455836f1c57ab38acdd3f
SHA256c63b3da12bb6d9f373434db9bcfa3a741856d8b889c797c051e9bafcf07aa5f3
SHA512e1685b912da05c538e813ec335a27336424d1d9633436a829b6d141718366fd7fd7b9b286f25285c14cbe2e226489c40915fe49506f7be1f6d313d4ab0077dc5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51f24d96170ec10f552ac86317946c488
SHA18e2cfefa3b22681eeb5c4575302b79358ab24f16
SHA256764f7f511012e253ff06b3d3f3580b494362ff35d87706cd4d7182a10b251912
SHA5124d504cc30f94e41091f0d440e16b40644f8046d1cfdb1b0421bda53f04defdf773c3be76649ad2004ba017823a4e3010bce8fc5860c8f5d9a2e0040661316e4d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD573e934571e72f697deb28670ab649e57
SHA1cd215bd66453913c2fc9bf2d3d8c6c4ddfc52509
SHA256cc9428fd08fe1664a8c4bb2fba61b3eb89e6ef58483fd23a3f3bd6f7ca1ee583
SHA5121409f2b46d551427713405b7f070af06e22f5121f668a94bb0c6ac9ae2b4092367815b82b2dbfffae7db6d422353ec2f6eac74188fa700955dcac92df12045bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD564484fe79291d8e92e2d9b0dadfcca36
SHA1962b633b16694cb9641e1c03dd4301d3b2c5ccc8
SHA256f7a83ccf02fcd7a6d1aaaa92ed4ec1797c4e98951045311cf09f00822e5db0d0
SHA5122fb81cd9440b2ecf0d149df6d152f8e8475f91a06ed255fefa187e15d1e7e968c9b27aab6bc16349a5821d78850bad5c947c781717db84415a0aa988e72cf495
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d2aaa3349288929c332482634ec7ca8c
SHA173abcae773c05ec64e733a572fdd99f2b86ef234
SHA256e60e571fee3ea5455c8add19e4f48326e9544e8f4661445e281f464ae718bf20
SHA5128f42299fe4f541903c18e99a988b0f4afbf2e3ee9e4cb119c4e609d79fe81f91f4597d1a072cc34cc99cec2c670f0be3f79ded331a0699db44935e0d48c5ac53
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b1f7a17d808f524a55ae4ac4e182641e
SHA148a8f8130eb197cacb345730cca3a229aa58969d
SHA256c7f4223059978e67c091dd0a4b3085da58b2443ea2cae31058ce883768fc989d
SHA512e8a394b4e3ed8ed4664620aac7a7f6558a1c36af73c703fd1492775f46ec3b2cbd9c8a0eb31057d3ee83eb817bc79e2a1a9fe805509f7ba5044509606d9405c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54d25e8d32c406585584038278aefa91e
SHA109b5d324a3ed3623e3bf98f30638eceb829d9578
SHA256ea05ba61d259721f70d90804391fedcb5521d1f5bc2c1ce93ef4f7fbb37157cb
SHA51213c5fbe2820855951039b2fbf364eda9113476a324007396092775c4521a5962e4650e56ee650627a4dc2d71ca65cd7caa3027e51884d92c7482780767f65d5a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5db51b1f55860f3d568274f224bfbf3c9
SHA185730f2672395b1c4ab0a2306ddee6069ea3a2fd
SHA256c50f0a5f3a01408e1dcb2690fa69d91adf583f5e4cf26e527dae89dc3fd98ffc
SHA512d2762f391f782acaf223fc00716368a77b4eade6866c440a8ac587423d746c0094ca0a1b3829f76c2ce97366e05130e7dcb4a7274effbe80551bcbb0a353cfee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cdc622a25dcf8bfa6c09ab2fa94431af
SHA15b88b0348a0542cdc3867ac0fb085922cb24b47e
SHA2566ec90a3cefc1c5105b92a123936d705267c6cb759a647f958ad12bf1790539aa
SHA51295dfcfce9ce9b7a6e3cb09bd43578f8eff222b766f3bbef6a542ab32bee946df9f966f268d92d58ebdeb3c55171d99a406103815174bbc09afc8205ad82ca47b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52a68942eda6ef53be0b41ec7e8b6e46a
SHA1789b9291e9bfa3e41e037edcdc0a9f760b804887
SHA25689163d65e60ff1508f9328b6884bf3f23cfe2a4e85ac87677942fca77de04b32
SHA512ce75bd7e8a11b0a66ed1bd21d9408b95406b30fab40990d16207c01643640417aaa5195d091f764b7e6f195066215fb978728f7270f5871da925b6c35c6ee9d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD532d9acd9e8ad8aba5952dacd9b739dd0
SHA1ea9e12763bfd7d8a67aff9d5856f815a89fcb53f
SHA256bef8515a089b188e25706c439e7026f2e9140eee2ecab00bccd036bcd382008b
SHA512eabd1eac4a8fff9d8ed43384e2bf218f78d48e0fa7e93187263cad78ca52a8fa6e404f312a05d7566f609f8e936f73b7cc4fcff7e46898ab5dc89f2c5b34664c
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a