Analysis
-
max time kernel
119s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07/05/2024, 05:45
Static task
static1
Behavioral task
behavioral1
Sample
1fa220a8abc9651c818a5931148741b4_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1fa220a8abc9651c818a5931148741b4_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
1fa220a8abc9651c818a5931148741b4_JaffaCakes118.html
-
Size
460KB
-
MD5
1fa220a8abc9651c818a5931148741b4
-
SHA1
03066fd3064876d3d7c5d0f944399b1362e2eba7
-
SHA256
5abed085d93b0ee1cd03f6f80de1660fb30678d54fbc5113560150d6b1f8f8aa
-
SHA512
9b17d76ced7ccf73a847b2d1b1766817858e3cbd003b0c2c9fd5fd2211879a8742323f4de0b0f41569ba7fe16484dcb5e2c12c356989d826983c75d251426083
-
SSDEEP
6144:SosMYod+X3oI+Y9sMYod+X3oI+YHsMYod+X3oI+YLsMYod+X3oI+YQ:H5d+X3b5d+X395d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000009253dcd459b849f3c4f0c83a3e669b5e0542dad1d03b2e4e8defe44a80b4b5000000000e80000000020000200000000ab57b8351e081cc0eef1d96300441276176a2c42c051b34e67fce6d602a33182000000039f62e6ce43399edf1353ca1aab4520a23cab698396d11c335b140ffb9be1cdc4000000078472546ee23cb2eb9b66475ecd8071c8fbec08eb4f0d4eb05340a509365a31cad84ba2e7a8bdffa9fc64046685935f0bf06b9d0a753de5958403c035a5765c5 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c08987e341a0da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421222611" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b0000000002000000000010660000000100002000000030fcabd566b68fe64aada9ca4390ba132d9c6c6ab7715b84af8a03e4a4b079c1000000000e80000000020000200000002645f89dcfef5ba62cf6848e8db56068f3f978af9da6cd727ac0453c6db891f890000000159d3fef1448da6b8b141ac0e9ce60cd70dac8843f48f0fa5c836710a796bff3a1c8c86bd70e8149fb3d386a63d8c534f5285e359e643216b0b0a1b3c214f6b8d540354938a55fda9b68aefb83aa99d29b0d56b1b5e218d8f78bc382a8d98ef7925e183d1fc0d1a85e1dd99088ca3923adb11095f0ac9a9ec20cc759f260c4c4288f7b69c0fc80501b5c39bac140eac8400000008efa6b77d16b45b7f7bcdf991c50365e064358edb104353e1a11a8be921620fd379a7e3bb175801193a042428009992a1d44bc9b63c2a48270b8c4235109e429 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0A998541-0C35-11EF-8C47-FA8378BF1C4A} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1736 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1736 iexplore.exe 1736 iexplore.exe 1312 IEXPLORE.EXE 1312 IEXPLORE.EXE 1312 IEXPLORE.EXE 1312 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1736 wrote to memory of 1312 1736 iexplore.exe 28 PID 1736 wrote to memory of 1312 1736 iexplore.exe 28 PID 1736 wrote to memory of 1312 1736 iexplore.exe 28 PID 1736 wrote to memory of 1312 1736 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1fa220a8abc9651c818a5931148741b4_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1736 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1312
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD526a96c72865209dbca9f8b36ba74bc12
SHA13633a9265b825df0f703054b15d7de3318b208a0
SHA2563594bc5d8dde92bb9792cfef10fe81d2bc142d358bde5816296dc71b38b602d7
SHA5123b22e6e98f9eac76637e9408b890fb05fd6291ec360a528e64097c9426686a9882771bd0a35170fce52c26d7a468d7fa7c6fd2643193afd6a88dd3626a242ef8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5412f9789b0a483537001790f69730ed6
SHA1cbac4bba06235f99826b0b871c70a0e4e6fb2139
SHA256e4db4ad5c9bec57f00290f530b3a8a7973cb533fd784a4dc6edef862e17a7090
SHA51291dc6f2ce04dff1e5664d1c054b805b696ebba1a1d12d656f0c7e58482641365518b0c3f53af03b78e1843dedb8323822dd079df8550fe49cb31b3b27015fefe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50411bc074d3dafab422680b6616b4686
SHA1c7acfa5bf8878d8908bd39ad1b3471785383ea7d
SHA25617dbe195b6eb8794561d84f630b0010e9ef9bd3ec4d02c99ca2c4ae944f1baf1
SHA512972b379020d77e0cbdf4f4391182cd2b3e879347c3282bd441999ffa2fb19b752877ebe8e3797f2fa03fcd10fd839cd34aec3e9d3e33c82fb3902b25183c70f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f5f1a53dd429ce0e4147260c6c66ab22
SHA164209906b064947d1718587260da41a01fe0ed7a
SHA2569eac7c19fcfcd8fb480b7e7c5c39fed1bb4f341d6e4fbe64c6274f929698596a
SHA512890ea4b60ab53865675b3015e88395e0869cb96adb8f32daa331cef0246fcc1b013f7de5ae8acffeebb947ae5d0702609831a9ec4da67eb94befa52d8d4dcbbe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50f3fb2da2d269e3eeae5ce88d2695154
SHA1f92da50e43c2d1b5fefc7217d1d52512cc30f7f4
SHA2563a505414c603f9d0e4148186b556110f42bc38e5818f87fc6eb6d4a2d225607b
SHA512466e6552527e555930332d001f9733862ca3a1df9a97b3a3553c9612bbdb60ff6c19c7b40cd28a21730860e57b8689ff83f52882fad39c89dc114ae36de78ff3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f8565d8967ddc29a8174590dcdb6c178
SHA1dad9123bd064fbd543034fe9f6c3803b1407164b
SHA25621d3338d00a871df4a9563d6ad6ae0a82194e375d09529cb6e57744021661dcc
SHA512b0e7ed3d60dcc56e32cbc7aa268d5b8f4b0488c8506cf04600ae6e3859ea99c18e0a72fb7cc4b29e4b01ff9bfa390fcfedec8155accc4424a247ece6411286b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56eac8932708fb75e736d6447fbc1b6f2
SHA172caed76023299f4c2ff8384d986c81fa972a08b
SHA256a8085d5bbc75ae8cd4c291ee69c75a3fd43bbc3cf10ce78771df958abb284a65
SHA5120ea0c3c3341b56846e2d088f4cceb9d5e8c188b71e25872c5c2a3fda10856ecf202c86122ab3b37cb5fceede08222835f7ef16720104f8ecf1bd82e035eaa4a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59fb3e913e50d73d62bb2db23ca152601
SHA183fc6b27d46797683c9de974c3df86786fdc43e7
SHA256b8fbebaa9b10f34c7c64e3f1c8995e70e89e89900e0ac47279eef59c4b7438e2
SHA5123e9435e704db305b49c4ce4fab4565013f476c5b2c0fcfdfa2c1d1e43e9f18b68ca4fe6f34ec9bb120fddb7711a9cf4115896257e9ade4cfd61ecec7209144a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52647d96b0c2cd89759703ea47a8893fa
SHA12da0c0e251b9341c19ddc5074f370c5ed448c3cc
SHA2568084ee2026860234f1668a2f3ed3613b7704702dd8f4715105579212fcf9751c
SHA512ff113290796ae6447da11dfa20d1e4cb7b83c8de8b42bb60a6a7fa7d0c1ae03708abfb47fca22ea054bf830721a0ec295d37d93fa872ba00251b9d16bd98aacd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58e5a7dc0e529684831620b016816dcfd
SHA1b4fd4906d8fc361ccdb744b4afc3d8b7dcf95567
SHA256ef6cdb9d9b389d0154cb6d8831d849d62410bddbfaf7e9fc403b44aca599eb07
SHA512d7878bdb8c7506ccc30356b0dd31c0e995a7c5b89f1005ec9887abb4bdca290fc8be8aa5418a58f77a65f35651ec4b290f201d0cb758bf63aa8ec5d30c46ac4a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55b1eb2fb23f06c45b610a99f9d7f8395
SHA17192105d899b7c729527b80879c1231fe37dc308
SHA256730228d16d8c10a98b053ddb631b89d00aa02f98b05301a6190dd0e1f0ea2b42
SHA51227fbcf0bfd76be7182042a2667237eb7c8a1d706ee9a1afdf5963970788bf4d336692d6f69bd3e3a5b2471e25f4f973e2270ebbb411da06d41e3fdaa6064312a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bec3529f2e7dff6449bfed2170a554ae
SHA1049c74592fed70d644a63db04b8a95db5d0b5da1
SHA25653261e323ddf56d128c83a69413b581fe0af31378d21dc40f3d0f6068ab691ff
SHA5129caced3c86929e8612f2d39902d806ade03e207d65e14ef039eef2d2a446e7b21d642a02f0855f7b064023d9d00635ca2e7a6c75da006b9e2f7c8229412348e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51fdc1b55fd0bdc024687d8b6fea6eb5c
SHA1b76c71c8cd280a1e39c50a4b0265920cef6244fe
SHA256b2ec7c17909458c230a3ec0b8c4798a65eed073775bcc99c3d2d0fa0bf0b1f18
SHA51238b559c86c21041f1212ba19fbbfbc68e0b687e905cd6047be75b818d5c90fb3333cce5f49280ed716e457e8d6c50308ad95cf2bc5083a960f8a9a375c7cbde6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a8b6f40dcc35b9b0690f3559ede56e4c
SHA18b476b96932a9a52ce85526e0ae30fa97661710f
SHA256eb4396ba4cf5f6cd16e37f9b3bab1f78688f2db9419b82072d2bf9283d28bac5
SHA512216ebfd973cbcc6fb8e9a9b113c67fef94bea17ffd2eb37ad60d52b5ee487dd223716e6503c19924055f82d8411c77da4e9e17c5f2ab7223e2154d66bab8945e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e6a322ea5bc8ece33ea4f342a62fb488
SHA19c94ab9b76d073e8145ac7ba4c65bd17557986bd
SHA2560a299c25a27dbd26a31f11a1e395ea393543bfb024ddd934ce063b8f6a467ed6
SHA512bf8241cac41eefd3007c5c564c62194225bbf514943e98ef1afd4cb926f0259b103e305eaa0fb185ae7d4c1124cd61fcf45c1fd95aa9e7d2a158ae28033343cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f9c910356e708c5e5a7c93598242b557
SHA1b9b90d203118b58ddc5d538a98013e32ad898eaf
SHA2565712b1d3688347e83bd6cd008a7499e4e60ee69bf1c37d2399f3d35df0903a82
SHA5124e7830942bb51d4e1a5655f55b8a7f01ec13facd9d687c5084b3155cc9f7b598bde90172b7c94b642c0527c211fe44f587ebf16106604f3464e94ecd2d874745
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD585f84da770c1363a0673c020e1e2ce1f
SHA1d71e9e4bd108f05ee5e79be398875fa601cd40c9
SHA256309363a5e36df0e95745e2ddb9089495240f9a26d7aa87da6ca5c687f2914f77
SHA512154e6699c7cfd9066dcd1f5a098d5103286b04cd64bf57cffd74534f55b2177bcec101620c92b9a272491bad97a756a232e1768e31a180bf675d61eb233b03a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD566c79a3d9a9adf125e89855306f1cf62
SHA152512223d10fd4ce9c1a5a7a9815dcf0ecc2036f
SHA2566966a3fe894702a161f10d8adea8e6b0be6403f658ba3433329524241de76cb9
SHA51284804899a5f2be9336b4edf3e07d2064bb40e8c949cee3b5db7a239e15239cd3714982056311ee774f74ab7ff31c4c7c16c0091048f797e1b4851b3fa73ca589
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a