Analysis
-
max time kernel
132s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05/05/2024, 15:05
Static task
static1
Behavioral task
behavioral1
Sample
183c58517adae592fcb3c4100f27c3cb_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
183c58517adae592fcb3c4100f27c3cb_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
183c58517adae592fcb3c4100f27c3cb_JaffaCakes118.html
-
Size
1KB
-
MD5
183c58517adae592fcb3c4100f27c3cb
-
SHA1
7daa757ff3c1b63b401d9c1c6d1841e8db607e4f
-
SHA256
76bf4a1bb847444d3529ae0074b491c2960eb445d794ab96649537502c12682e
-
SHA512
32a9c3d22176d89a0f63fab31aad45cc4654a3851b5c897dff15b8ed04ff9a616e3397d6b1cc6ace9db3256d28f6376ea7bdaf643fb2feada4d819c460eb1e51
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421083381" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30c0b4b4fd9eda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000000915efafcc8ddfc5e2f293066ebf9ecbef8780b53a85543bf97eb66b36844cb5000000000e8000000002000020000000eda1a0197299a0f8d3f11ae0a12a135824927de5b87419ea15ae763aae55302e9000000071f5aac95018435b024bc1c22babcea800062d6ef18f32fc1801f8279e05b183f182697c9e126225c6c02bc67a2d986f96ee73e2489ac543818dfde433b566e57e7ef7281cc7cfd8c684d86b93665bd7f9eb18509ed212530179550d7f15b31952b6908a3902a27690e605e40ab5ee566efdb53def01d01a0e25ed7fee11941f7919c9ae4f97367cf7e10e702a9915a5400000000665dd2cc55500f38430427bf111cf9a592b08974f13068454829c31a09405262b18c99b09b825b9f95e0ae18cac621103b96a09fff94cd4321949780bb8b3b1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E04A5F71-0AF0-11EF-8A7C-66DD11CD6629} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000acf3face9c0f3412054a4be0b2b9e27f664346bf09b752016a462ff05532cea8000000000e800000000200002000000032ddae8357c98198c352a6dffd7f89f3f8906734c1e186eaebd1e53016719074200000006a6a90e96f0cedb1f4dc702407ac35b2df69fbe69717bb2584a4e052a6a580f040000000d03ebe5f7f218d21cca487022bdb40783f6dd123900f9fb58e75ffc9e30d879f8517ca5ae4ffeb1e4aba50d5bdab98c41cfa8d0a90810ce0787b2591a4ab5150 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1908 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1908 iexplore.exe 1908 iexplore.exe 2508 IEXPLORE.EXE 2508 IEXPLORE.EXE 2508 IEXPLORE.EXE 2508 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1908 wrote to memory of 2508 1908 iexplore.exe 28 PID 1908 wrote to memory of 2508 1908 iexplore.exe 28 PID 1908 wrote to memory of 2508 1908 iexplore.exe 28 PID 1908 wrote to memory of 2508 1908 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\183c58517adae592fcb3c4100f27c3cb_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1908 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2508
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55b74c4996226745dfe37384362b05f0c
SHA17af4f9a8ef42450b755705532980de0cc31b583e
SHA25653619c3b4db2253b7700116fcaf690bfc584aad2a844f4b9dbfed56e6b043ab1
SHA5128c1ed14987459f33fe7a7dbad64525b52352dbb3b4fe8e0b04450cbdc3f5aee1c165cd730481850f40c8e0265185f4290ffde4cdf9868ccbf9882d7777e47547
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD576c4f80da8aa6be51204db47520ad412
SHA1edcc10c5adc2aad66f5a82c7b346e8f904893bd3
SHA256d882ac7c87300f1f407ddc5d2a0cce48e6b27748633c8a5dcc2161e9630546ae
SHA5126597a50acfeeba479cf3e33ad48b4c39705ca3abccfce247ca4c4733a528259c64634dc3c4e1d9b4fa971196d30cd19c36907a669d75db7738bd5381fd37d4cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50bdb1defe6a63ff71630a6874c77a467
SHA11cd87b5fdf323f811bceb978572ead138582773a
SHA2560842401d383865aa3aa869dd206e10e252c8f822341a0ff988db4b67f5bfd8e8
SHA51210bc4aaa3bb6d0258dbdbbab3fbffa53be5548ad0e7a2adea9880db71e30cf002392d521524d6306bf32c73af0fe5e15b11269e876c69bfbc827814d54d13a5c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e0d2fe427dc820013185872ddee780e6
SHA103b832f48c6f1fb3b3e89a1830291c32d966f63f
SHA256b99391fafbdae70dc2d32e728146ac60e0dcdc75f1dc8f2ed2125fab3a4dd33f
SHA5122376565dd41208240f34be57dd6af268e8f976bcf07e5d8c1f3e8374df7cd6cdf6a71cff138d1ecda2f58b0a6ec384887683b528d875c52046c631aa51607916
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d8c9e669f07cc6a9c81d4a88ba877b2e
SHA13f9f3f921d18f6a136ef635c611b8304485388cc
SHA2562546bd5e1117736793d63a7a2d106e741b3d7e1b5f240db714ec071196f08052
SHA51211e058edb3dbb41533efa56840422866a4189df1436cc467a7fe5ba64348c7ae9b4f162151349edef049c16b56a37fcef2a86c2d5e18fed95f15cad2be526ca9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50f5bcb49c4bbe8075ccc2a35b3bc463c
SHA167fb282cf5cafffbeff5b889e1b56f401b8ce281
SHA25604ee5c567a290f6b6022933eff7c65b2f9cde3a88518d5ce2fd5d0a1d8e9ec54
SHA5122db1eee75e35c02e984f87cb41244a76e8e2a3c934356ecf810defeff615432e554924830e1738a20a1d80f784654b47d1665cc80b37cec4daddf5a05d099d4d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5be983de5d4e2662493ff4a1ec3d3da40
SHA11ce024b5128a46fe4d6aa3eb5828f0de830aae29
SHA256117285651f2b6f3ffd4f8759ec5a51ad429c15f40a144b437b10c44896d1b619
SHA5124b3d62dc2ba800ee6ff960c62a67f6e69d9e72124f2fd306c6c021ac18fdb2b7f0c6f92eff3799a53442e0f613ceb9ce4d15add529785ab868ce5c3e9d116cc1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e278d9629527ae3ce6120745b05d8c3c
SHA150586ba78ecb9c96f5fbf521f31c8d8071e8fa23
SHA256a5c4b2ac97ca4f9cf5241e63fd482a44bb5bb74d17d93f44d46e7af58b28dbfe
SHA51213dfdf76e071b75a29a8d4f5cdb0a8d3c4fd9e9878e470a6e751efda766ca8ddf2550415801f5489899d1bff5778845698ff9bf8e875c8cbe4756fc4319716ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f2248d6799dbe0adcf1a32eeef1d32b2
SHA1f9bf779bb133b92b104c422ce6f80b107c2757d0
SHA25625b44f20d752578253aefdd1c1dcb8906e73f173060d2fcbd4760af523e6273b
SHA512c4fa770818c6a38d5a10e038510f760536aa27fe5263fdbf3e460fced65b99d351b3caa0ce9122d0be7edde8619e6990fa75b4715e240fd4e6e34fb735f8d7b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eb7d10da1a98e3519058cc844d5bce0e
SHA1fba77d02821ff04d31de317eef2b819170226313
SHA25646ce2204790698dc1f0fd361c114b80bf7735d15ec912844705deed71cbe787f
SHA5129a0a71793136a7ef7688a08a8f4f1a76f315e88a0431c69ed8dfd5336698ff9806483a9356409512ee6302edbd7752e6506551e96d6df4916d1bac080fa5a8c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54e85b128477c6c9d177ea024f30e200a
SHA1e986a5ff160f7e7c145fff90ca061d84b453c43e
SHA25673be2f7e62e68458afd7369c45dfe184ac0eb72505524033b30f7f5f80048c52
SHA512f9730f9aaff2c8830869a4289cd399c5ffe28654891e7cb88f80092c964d50b6da400472afbf5d1cec347b9a0bebfc47e6135ffe5a60cb700fcf8105c020b5e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54b7912bc98e2e90ffd1fefdf673387a2
SHA16cdf4f51a864d156f2577c6083497aad67dee5bb
SHA25627008d77da6d9281dd0aa54957eb5c1463b27f2de3986d263d8562ed4a64f3cb
SHA5124e2ffdf1ca5a2674e68e52f626d090835a41c22ef9ca30bf5b576bffb45551c740f91160b52d79e1f368978fba18a0477852e00870d2b38c163d6852744e6e48
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58b80ec596c6506adbf6c4855803922f9
SHA17b33fb4cfdd1be56587e92759624f40d775fc7ea
SHA2568971b1f6601e4f76254db82cee9a8e7f50b9783a18d7f887ed241f5a37d422d7
SHA5126c5639365579983adc6920a2b094e4832283f45fba53c6c2e60eb9517d16dd2e53afd2876a6f80e168b997e457af17aef88162a3afb891d37d746d0547014b81
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5da07d16d9dbfad1413c58bd46e2723b3
SHA148fdb12c7a67d9d9aab642c437c0e2b4f2240c4c
SHA25664cb0c186626a286986c7157fa844db1ce10da7995df42179d09ea30c838c260
SHA51228d5be868b8e853daf2b40523c9b0c62a888251247601aca6d78d2ed2d60c83b77bec124cd8061fb115295fde7cb3f3f11f61aac5547af8ac481f6d9d6585623
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bfd6929338b3a4faf565d2a91c9c682a
SHA15dde2eb29f1a5b1a2efb3f8c16c4f06055551db4
SHA25611b1ce0cb3d66c03c559f443547d6fae089f4312946369fcc47ebdddc8c3c262
SHA512e25c983aee560f2afe9d2cc82543effea7b78b03f198b2ee884f68a0dc64659cbe7771db7d0193b408586db12d3a6228cf1af960820e916037412ccf69176e46
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD538bdf3a022f88e0e2c2f76cfbd38ed2b
SHA105c183ec960b09be6556f61631ed157f2847ed87
SHA2562da8cf9765b5fa935a193ee57b901c12a368cb9171daed2e72f74c4177baf868
SHA512f67863c32f9f1b62563914fe98f021a79bc3edc387b51bdea6e240e68553dd4063407a7978083ed3755663c6c082984bf12dc91218ed4746ae467f7e2a82e731
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5736f1ce8ef2b0e84505e47b264f0b7ed
SHA1e7e2d5a7bd43792619976d052a9a56f3519f0f26
SHA256edbb3ffedf38291effb76de48414065c9fedbb2c0ab93880d67453161360174f
SHA512caf33ef893ec5c12cb396927a600e1e4a03fe93933f734dc31c645b77a884369e41bd0161140d8228df6ae3b83588aff9dfd7b3388ffc36046d0fd45499913ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50d2e64d40f680febb10b72a375e149b1
SHA12dffb489379e66acaa80e49925a48140435f2107
SHA25677ba7e90c5ce5c3c9ef6e7b91438ca7dd7eda9c4a9ba0bb72f0b733fcf46227e
SHA5126b8880949de3be5379a7e97f8fd39e3544eb9bbe8ef0df07947acaa1e3412c579aaf0e94b7b99573728265ed0762a82adff799d96b1744d24d61a0d728b2f3e3
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a