Analysis
-
max time kernel
121s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05-05-2024 12:25
Static task
static1
Behavioral task
behavioral1
Sample
17a8c90dbb435af68434a7f8f48bf140_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
17a8c90dbb435af68434a7f8f48bf140_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
17a8c90dbb435af68434a7f8f48bf140_JaffaCakes118.html
-
Size
4KB
-
MD5
17a8c90dbb435af68434a7f8f48bf140
-
SHA1
f66aa5a816d8e0b16b88cdc3921aefd3c735cdb6
-
SHA256
3edaa5a1c3e025a305aff969c52547a46994b8402448442e1c6258f0f5b4a32b
-
SHA512
647107b04e6d9a1438f1aabfe3cdcc07e3878706fe1cab04ebcae912192f430396ae0b34dd16434eb6e6b48f19a19cac5296a26c08ff855868a054e99d4d634a
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8obEBSo8t:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDc
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000f440ba70b0559efd73fb8a0ef272b9f4a201aba529f348b4d7365fca812f2776000000000e8000000002000020000000b72aaf499812e81313131af76fe5cecb1115c2c80e40137802b8c566ffaebaa020000000825a266e088b1d61b285168bee05948ce9d764ca87aabcfea1cade174c3492d84000000049af1017417f5a002561c5f47ca105be87dd3d14ed141de6423ec696096c3d40acc11727dc5584bdea0a0f150e94a82887d779a6c382e798448a9fc2ac264f2a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A07940C1-0ADA-11EF-8414-4A4F109F65B0} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000509569150dece221520d935a13863a3abe976b82fc39a2e85f69ca0a6d38df89000000000e80000000020000200000002dae075dbcdece20dc2ba81f38a7202106ee3a47d7b3af225910849d4348a87190000000300d4e586317b32a3a1a3a78cab769eeeeed628d543f34d09b146af256ef585ed4587c373aa608e6f63a637b6cb2571f709d20e667059f6ed1b855e3e9172f17ffada9e4e1354b0e1c138ed8cd532fcf461e920eb1479a682c464cd8d46e22446fe4207464b4515d9f1e9dbc7b318fc62985577e10e84be3ca38b2badf127ea1a4399779ce897c1f065d6cc8ce45bac840000000eb657046bc0043da0c5fb5e79a5262ec1fe835c6d7f04eaf682eb7c584177e0821fe02bc14efbef3c508b6fc3dc69608903731d13edd017e2e5375773da6235c iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421073826" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60bdfb74e79eda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3016 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3016 iexplore.exe 3016 iexplore.exe 3012 IEXPLORE.EXE 3012 IEXPLORE.EXE 3012 IEXPLORE.EXE 3012 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3016 wrote to memory of 3012 3016 iexplore.exe 28 PID 3016 wrote to memory of 3012 3016 iexplore.exe 28 PID 3016 wrote to memory of 3012 3016 iexplore.exe 28 PID 3016 wrote to memory of 3012 3016 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\17a8c90dbb435af68434a7f8f48bf140_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3016 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3012
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD559469daf2ee73104c4d23555b8f187b2
SHA115db230ed9f9502a4646bd6b2a51b0b67bcc65b1
SHA25632cfd67d9da01f31c4d3000460126e8080d36d5862ce8b917d44a75f179c990e
SHA512abbdefd02c2cca5a0297d65cef8be181d8db6711600f7bd79a7778ad217a08242b038fd17a02319a4ab32ab26aadf3b816b3f218b1fd1e9ded6d941352b779b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54c6e292dc884ec64e30022b856777008
SHA19caf78e0b8be11698e36d413506005fee20d5c29
SHA256f30bdc9a16507ef41929601edb85f73be1a5e95bbf60a8cc4b2b5f69dd6cfd10
SHA512b1dad6deb5b9077cd30f793091a5c0785bbf17cdb480389cd96d0b666f4c9656d67deab692af49895d497383b3e9fd83c5894b18147bddaa551564aa9ebaadd0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51de3d36b01c923992aaac11f22b51b22
SHA119c65853a2e07880e610e3350ac602012390d7c0
SHA256af6f18da1af3d556be89965ac79025e2feece4fc193c5924b8950ca2fc8cf45f
SHA512bbb7c2273b2a8ed1c031e5ffc4a5b42195cb3bc5ad9536c048994f5f1ef62a2610e6f4d3823fe7e49af7478fd39994f0511e3a855925f6995c3b8eba35063da4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d0e8113bcae9802624ee703c9c1e7883
SHA1c13f64bfbb9929481a6ea6bcec9e04292671fa85
SHA256c33f13f50681d19e23331fda73227b0091c7c6c97cf096beec353dd826f10d48
SHA5126d72fffa3794a09f51042d36bfa99798a21681ec0dba5f14b1b4753b8e0ec706284910637512458e84b062e16fd6e3c65fcbca9cf0fd73dca41050dce93b6dfc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50f99bd2720bbf6a779cb0c32017a3691
SHA16df763acaeeb379ab2235cef12eebacb839e5786
SHA2564b0010cd7e466017dd1606cf2f330e44c468b548897356f94a87b42ad7bc6ef8
SHA5127fd0aeffa556eb9d10f05c143363a35f0665a2f88dd523c295194624f1f3b557b657940d559eab9ab3f7b8ab6378731e4bc5bb34a0e89a8d880a4deead2462f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52fdc9c3bcd961b7dc21715588d95c9b8
SHA144683749d03b032a4a16bb2c988e605d4b475091
SHA256b089869dcdb97783bd7102f53c1afad723049383a56fd8e0178d106558dc3d60
SHA512e89a8a4095fb68b0827ddc81cdb18fdd6aa2194c8fc0d282e2c09b7405546b6c0fa70902ad960a46617c8b47f965a8b9f245a098346e4920c591eae57c1638d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57f1900f746f9237f915f35bac820fbab
SHA192caa9bbc2192269158c9d2ccb30b0eda318753e
SHA25651af75c535c077292521f7bd237b3e065a36996ea66cf6b7f17eebeaaa9d9f5f
SHA512d66162056240b1e95bc18d3e3701d23d4d7e4f46c27e5372b35d1a55e486114fda1a4da0f89b08d7748f3d5e43f73c6d8e0798d8d1d45fecf103d95dd7f0c26c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bd917f4e4f1980164a2c383f63a17a8a
SHA104962a8b54083e882fb5a6444ec221f9a8154152
SHA25686e2e27b59a16ae20540264e47c9b186777326cbb303b9e1df35fcd70c25c2e6
SHA512e533c73f92c0a2cc5443ef04dc988a1d31330844f86979ffef4368002b5ecf5495f3b8881f3aac14df99147d4a66de47c7321f1eb80e2a37d904b7e90b8b6569
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54b270e7de1c91b15082f41338fd42063
SHA132b4db15e12d4edb898b95a76a5f517e0d8d1559
SHA256e1749fd55fb0d9e01c6f1c1d8d17d64448675eb6e927c447a5f75d0f5d006b6a
SHA512d7c4fed525016eed03dae09bd7ed12d560428d99e6cc0122917100a985b64db9a357f398fbb4bec04bc4ed6dfde2e1c28911e4cab4a87a213899b24f970920fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD570aa8973eb7bf4c87dfb132a6e0494f9
SHA19725521d0930170bbaddb3ff81d194948f6e3c22
SHA256203d2cdb39eccf33e564e6818f852e1b5ce2cee2bf49b231c810454830b72852
SHA512bf65538aebb02c0b23d9299d3fb1133536d8c458f75ce0db191fb041ae691dcdf70938106574ed93259a1f21c34263811e13064b6b4e7562b3050be4e72403cc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a6ec0951b07d15c05389e924db5a30f2
SHA1190b5ce15d9e9829b2abb5b2c29a0369c60da60a
SHA256d757a3e22543bfb1058b5bfd41b08de41dad856ac5a24b2cb7b71c70da1dc403
SHA512cd948a0f981146bb0b5491eafbd5653c59956cda93cc23fb89031c9819f7ec8b592a09d97db14e7c90ce5461448a18ccc0b34867c3289c9b1e57aae337c37215
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56adb9ad83a13d62453d3a02db82d64e7
SHA1906f3143267b377f558d9662f99b7cb48ac5ab22
SHA256d37fc3233fc6e1e6c06eec41bd0f866e8eaab31daa71298566a257aa45d0ef21
SHA512f3da1825808443b9477dc674d4d12020a74a75a9920b6e51b0795ae447967689fbcc3136b8b4db2eaa66b17f79c2e07f7a5118329aea9c9e5c461a921ea20524
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5be9741f119feb6b7cd6afc27faf9ff6a
SHA16f8b9c86fe40fac0344395ee056633faff9f61a5
SHA2562e1b787036ff428af6446d79aaade453ac8ffe8344c811c3d14a69aa672c7f3e
SHA512f36aef1333f727a14b60c083808efdf95a5c716694d0fb95284ae22491b6abd5b69c1da6b46acc7780c22502771c8f5d64725a1f466d71cbd9fca6fbda49db97
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5384066553ec96cf7944cac9aa9d2a3d3
SHA15c5e6e5c587d6f93bcd6dfd46a9d1b987047210c
SHA256a85faa1522f2f9409d3042886f9ee02010bcdaa573db9bcc4c7a3e324350bb8f
SHA51243b0ee67c1ce35ce9f5e619c53f57f620a2563a90c6f2dd93c35e37254ce66c15916190a085bf06956e6795e65fbaee4037a0eafa96aa6f0c9e8ad4bf42bc3e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD551d15f5e335cfc375d978caf626afad6
SHA144866228353087b44f9480f58aad592f0368bddd
SHA256df2d9cd875cb2bf2adae51ff4896bee2ab7e81d02fb7442594aa5e5f2153c258
SHA51286c71a5897d64927e7382a7acc4f891e1573ba939732b65efa7fe12a702ee759d8a71ea4a60163c513b0ffd22ead75e7d4b35e3d35fd52b37182bf43b967f579
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dcffc94401c75ab187e42f2406378bb2
SHA126afa492041b623394bb4e8861cb087f61184448
SHA25672876f15aba1efd6f15fa991d51471a38316288a4ba2121dba3fa3cde12f5698
SHA51276975b38ecdfb540550eb011580504503bcc7eecc930727eece77babc6d4b1af998c368f367682f69354893ef241630c9a736135b147023d5d0d5ba5911fe3a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5305e25ed7fe6ebb741b1613ef0996f64
SHA153927dc4a0feda63286885b4c2b1a5607c0e02ab
SHA2560a2f614f1808564f122a3db5e86ca41202249d8c2f699ee606a65c06b7c553fe
SHA51269611bb9b4133f696a35ccb2880a8475da5e3124f250ebe5889bca8be368be1668f828eb06ae787ffb617cc26588e820d65203851269b111023f58079c4d561a
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a