Analysis
-
max time kernel
122s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
07-05-2024 02:01
Static task
static1
Behavioral task
behavioral1
Sample
1f11732eb95050868d021eb15d8cf922_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
1f11732eb95050868d021eb15d8cf922_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
1f11732eb95050868d021eb15d8cf922_JaffaCakes118.html
-
Size
7KB
-
MD5
1f11732eb95050868d021eb15d8cf922
-
SHA1
ff2080fbdeb53653f56c2ac0bcaf6071ae417564
-
SHA256
39a51e43b891671873db72a9dd4e0808b53ac345c314d67f25943844f6ce5648
-
SHA512
778daf039e836997a2792bc1f2c0d623148766091e3d72cd5d1ae3cc4e603d5edd4d85876b13f0dab823da2ea6353f4172e13f71b271c6295e0077e48074921f
-
SSDEEP
192:A2gZlRjQbOTMLWJOD/d84/XJ9u4GLAEQhyW1mlFpH0oT2M:xkjAOiUOD/d8I59u4GG4W4HpH0oT2M
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000004f88091779ceb1ce512a3923e8e560d8aceb2e693e101fbfb1737374332420a7000000000e8000000002000020000000a1c5779e2322e779d9ca2b4ad7dc237de2478e8068b31198cf943308b3cc59269000000052dd9a764d87f36424c778b893edd0b5a83aecf10015b094e1013722243c766e15801a1bec7d42adca5c8bef4dec8d7b318226ad136d34574a561f4d871d4459fd946d48dc8d50ec16a95539c9808538709d809b1a46b8df27d275e53128bf33c0a0cd77dfcecd4f26574d1c0a69c76863fe3507befca3ca28dca8091ab784bf01dec77be2f540447b2187bfdf3ec664400000005898537e0db47bad8834699ebf9fd6b8c5db3a4dc085645fd7de01138fa91e194870d154746e99b9651504c114e6da8751ecf0b97fc269f732efe5885df2e350 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80faa08622a0da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421209148" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000e63b180a665a0f03c61574a22577bb2a3e7cc218857dfe3f33998e08293100f6000000000e80000000020000200000003aba1014d5967e8068708ae716bd02f6790203c53f92067c4cedaa7974bc3c2f20000000a36575cc2c8bba6777be54e712328ccdc0ae47f2c5305cf26dd909bed491c258400000003c5ee53c3e427fb9890e774534cf62c709f173af3c2f561e33b010450d020ae8b1bbdfded99de907a30bfb3eaee50d3e5d16e5ab62248a67e0fa17dbd987b289 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B20DAD31-0C15-11EF-B73D-E693E3B3207D} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2156 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2156 iexplore.exe 2156 iexplore.exe 2928 IEXPLORE.EXE 2928 IEXPLORE.EXE 2928 IEXPLORE.EXE 2928 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2156 wrote to memory of 2928 2156 iexplore.exe 28 PID 2156 wrote to memory of 2928 2156 iexplore.exe 28 PID 2156 wrote to memory of 2928 2156 iexplore.exe 28 PID 2156 wrote to memory of 2928 2156 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1f11732eb95050868d021eb15d8cf922_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2156 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2928
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD556c3a34006f7c2d95142f766bf697aac
SHA114ca64f6b0b959b6410765dbd54c5c10d7ad61fe
SHA256230233cceafa7e35210e48ed7daed94e49601f50d729d7c41420f9276937118b
SHA512d4794e3455dd26109de30f82e597a64932b4bacf9bb7c322d177413eb672a9365326108093929b66a193992c02e2a8ea3d3651b5608ee325bccfea190c569e25
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD584f2af2a4f3d5719c12d91837e91a72b
SHA1b8912da68c1b2474a2e2e1b899bdbb317636829f
SHA2566bab32d537ce3367377fc503036a210d50e500d5ea0fe7f0710f24cfc07b1fed
SHA512b71ae58492503ed94fbdb56d0123f3a8da3943fd6deb300c93f46b2ec3309227e20750a3d0a80670878636a9bddd58aed9eaca0342059220d8fbabf99ae19ff5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54ba79025eb0a417a7f01a34aa3267296
SHA10f489263998e61c4326636e322b1adcf8e2191e7
SHA256f7e53156766cb9008fa504de4c711394819028cdfa482c29b59a9fc39d13e458
SHA5129bb57af3f04200badd59a31bac42c52475ff50a8f483ae554f6ae2baeea010322e84e59700d30c5539fdcb252405bf8a4d26d6c8b865d5b0a1b8f4c24dce8efd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bd314f92ec709a4b6b4e58347eddb2ab
SHA1a05d90fee766bfee4751d5f5598fcf74b814c3fc
SHA256b012c5b286eef535995b1817a737b01a2c27b6cdb4011aeb7a4b130fedc68123
SHA5127eb92706c18e7b3f5c071149d539757d7419c55d8997baa8ef780ca0791f491313f703f272bfe64d1b958940b5d6b5d63355b6a3029d971d7ae7c9fc6a139bff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50cbb7273383ccadb7b300745db6b7423
SHA117a06c36415ef9e1ba18847b87b5061a1912d15d
SHA2560cccd42027c801e655b04245b0c76ec6d17233c82e33773972b17fad5c85f5c6
SHA5124be02ba21e0adebd49b2cf35a70d2bd5f45262fa2da4a7286306d4cfae9ec8b2ccdbb7a2cf49c141c4aefa270eea99f056bd2cd21f5954edc5c0e600ee2bbd4c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD588012be804dbf9caea0f288b35a849a0
SHA1b105b367de4b3b600cb43e06d5adf3397ffe842f
SHA2566c00a0e98916ea4a6c51a5a05a9c0739c43f81774ef32f26209f8fe3b1f33fa1
SHA51223885c66fbcda51f6c5fde160fb6b27d0fd28c7272593321b87710428489e27ab2408fe7f7deb9d09d674147d55aa628564c7b8a2bf14d23481d92948b3f9c70
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5adf750eba76c3c1e713828a7705bf671
SHA1bf1a541ecea54666db1875529b3a0ddf589342a5
SHA256b606c357a45ceef6504040bd74a03b8f5c3553893d2f88145540aa68b98256b4
SHA512a37267c0dc3734aabb1f4299b59cd87f76793e86ccee712b535a13de244dbb0d9fad2ec7b7e9eb708db644ec0a83a8783bd6bb29cb20682324ba29fd8d5485f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5da8268ed4833895894548e90b574b488
SHA1fdc3ff8dcdb9ca3d9299324516c02d4fd5620939
SHA256f45feda5f123a15e52df9a88806cff2f3c2b22044b3da0b7e95d26746ec3050f
SHA51264145d648b717f21c0eca3637c001d0ce374f0756d7186dfbe47d15942fed404b8b1b3a94eedcb8bcc3b51a32cda728f4b254de3a4d0da97cceff0f784bdd509
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51af2772c9dbd0447d30f57d648a4a9d2
SHA14d0bbc5a6604d5334ce93e03df80657b28373b6d
SHA256f0063c74ec54b4cdf669550466cfaebe5cc043777ccea162ca48496ceab9ffd7
SHA5120656834538fb66819a4a80f40c4aecc1c573f59b3de64cb80fb9b496bdbe50f552d93acb3574cc802a50e794aeeca8c3971bc1ff6774f383459deeb892096733
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d12506417d26dba69bb0d0aa58ce0e08
SHA1850e825c4efff3d9c81d00574c9940cb40651d9d
SHA256879b91e57534710bdd111a393dea0c11c900562e580f2bfc3ccc8addaa2a66ed
SHA5128b28dd4263a1e132ffb8dfac33f1e670179a56d10e5b2e7af3f11c9ba008206f58d94d3517bbc89678fa50b38477af15f64c5cba03a7824c26f9608c7f918e1b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5637aba1bdc2f42c64dd0e1483669b2e1
SHA1c88371e019946297de195a481c1e36a93c68f384
SHA256fbf75dd1bfc910773bfec1341713a864eaf06bdcbc937d491869216ac0a8ea4c
SHA5121ba328fa030b42d286109d66d3bd55bb1b358e1adb5bb1568ca300df3d4e7fff41fc2226090f3cc1ab42ab1ce4f6ead4ad837fb13eda47c17524ae0dd871154f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56d1f334a7010206e31d4e1cd255e816e
SHA125f1bd6bd2da781255fb6332150c67f10ff70d58
SHA2564a60658c8362604808b92ca8d61f2798145282f72b0dd1aa4cbe05344b8fa70e
SHA512f860478f8c2902c05446f4dc92d319e701275ff2d6eeb34e1067bd992da3854af46feca8aa9c026f1024ce50774237bf9b003e6ff07d37820b4cda5d19c5e04f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51e86b044f9d66299a08b2d29ff7c320c
SHA1e08ad3c8bf37422c22508e8fffd9bd9ff6fd64c8
SHA256e9dd53387202a76113a45254064e1f090c7c95b4844870680ec4a7546780ca08
SHA5124a3f953b87106906cee593b91a62080059b079b47959fda4905e00762cf5cafae0df6bc3fa91b7d0898e5b1bd4eefc37e8bd0edb5445f6b64bcad46fda93e4dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD541766b66ed5fa44acb54ca5c9128fbbd
SHA1d2029f951b54d2c762709d4ab66c7fb9623e6cb5
SHA25653b958f2ce0d27fbe01aaaf8abe80185f95bd1807d82151b9923cd3b26ff154f
SHA512cc632c70f92af72bf49552e5692902acdf286cbff40662d1c53f24ce88d05019bdb9d7669d3f1d6c81a582ff1c72c7b181dc24d1b1c1dd78a985c88acd00fe93
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d26f0a5283cca0e00d883dd7efd43e86
SHA108b599f1f5349f4db402d354306d2029a3361d83
SHA2566255820d6da88a02d45dea12a970b8f4f81226969cd6cf2fa2a6450c4f898cc2
SHA5120f68aab2e7ae3848239461f4c5952de8c1650def7be1e8d78d090d1b8ecaf4d126b7b1b4b23a1d5f4cea34330867b2a0d28874d5330b8ff02a7b168dcd4ce286
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cff13794e50e1fbf61de23c09c9e65ac
SHA19daeb3801a884a1afc24953f5685ea5d00d2c4e2
SHA25623297ee3f753c3486eababab1bfc4b440db25d062a5dacc24900d70e1f053cfb
SHA5127955fba699931cda929c8e3bb7a70d90cb182cf0abc299285c6965e912a555c5086c48250b5e0edc83b5a728182a21a9d7f5b640aca87e112b304cef44307394
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5adb19206f2b2c3fe82f4efef02e2fd7c
SHA11a3694b0e59f7efcf568ae0b540c7883a3fad5fd
SHA256f78b92cfe4199465012530d62ad1e1d194e23bfdb89d669f67a33e3e828d8e01
SHA51250d1a0ae656c22b21e3c93e106d28a6cbb26d4d0faea725cb0e651b2cef0a8e165c48ea3851a2ab143aff0586f20b99e4f0f1556949579b4458b324a7e41013d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59f987f0950708ad5968dd31ecb6d71f5
SHA1bce1fc2a1f71d88d9010e14ed85ff21fb09c109b
SHA256beda1da5cd5cbc1506c79f2ce39abd4130bda1f6ff42aec0be8e68061ceecf7d
SHA5126aaed882fc02fc00762b33d7456b777d34d4504c6ed1cbbb8edbebc5a7cf2d4dccbfc2dd814e2cba624d5abd654273df6af4fc2e5b094dba11baf42fb610bd84
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a