Analysis
-
max time kernel
145s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
07/05/2024, 07:30
Static task
static1
Behavioral task
behavioral1
Sample
1fe423257763b9752433849cf4862454_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
1fe423257763b9752433849cf4862454_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
1fe423257763b9752433849cf4862454_JaffaCakes118.html
-
Size
38KB
-
MD5
1fe423257763b9752433849cf4862454
-
SHA1
b2b278307222c2fd6ce097bb0f79328efd22147c
-
SHA256
1bd1a09547b394b4f2594a764a11ae09c071346f592df021debf36f95b35adf8
-
SHA512
11531d31a6b699b52ed089a9e42f4a054ed50ad99e9416d0d1fb1781be033dc30878104f454b3e24933a2d56ebbf070d7cf62827fef0e2e1f90234cfdf94da8d
-
SSDEEP
768:SUFf7jI1C8CaCPCCCKCgCoCWC3CtCrCgCJCRCGCnCTCcaBvDsLpYgZp:SUFf7jI1d/C9lBxLCAs5WitKsivDsLpF
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000eb95c667bdfe42ea4c0e2b79bcec07068b237a191c6f9e7fc460982f301ce44c000000000e80000000020000200000001cdabf32f4cba62c4ef334fadcfbc0236bb1f7d463b9e0b7026631ce713d2dd62000000039e0458ff4bd8a781ac31849ff4a5091f32d39c0003d5bdc672e3c03abce9bac40000000c3c9aab6cc49e9621df4ae652833375dce215437d2d1bedbc454431801c563ccdb7582c895e1d98e530458a44bbe0e0f004c55dc0eea340533258ec4762164f2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000009a48293af1af829444f35423dbd8abda062e77f069972c1c948c2019b226092b000000000e8000000002000020000000fd83b9f79e3b6a49c2222f1c55974cdbe3f3d4ab197c3c7f6727fa7b0e40d4929000000004e0214b353f96262b871b28e5a417ad35bb206341880663679866ae193a97ce08be916922d52eda73934244e5b09da6b33d334bc2abc498440db6256bf1c35cacb28f089f57d38bdc7a8eda18e590d399b0a6152ae7fd767d4c11eb7c52414435e318aff0498d8c6d46279ee9a70c78f024a7fd28687e94281f52bab665a6417fd66c05d708ab2b85291fe30123f5cb400000001e6dbc89cb6332cb2e4b0bb017a5e0638a7e5fd4a80cf5710dcd3738ce279f35995ef3e2bec30ff9fc8f29775f4b245b6ea443e2dc7f630e0142cb6f187c3abe iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 902b7a8e50a0da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B9590D91-0C43-11EF-9ED8-52FE85537310} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421228916" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2700 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2700 iexplore.exe 2700 iexplore.exe 3012 IEXPLORE.EXE 3012 IEXPLORE.EXE 3012 IEXPLORE.EXE 3012 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2700 wrote to memory of 3012 2700 iexplore.exe 28 PID 2700 wrote to memory of 3012 2700 iexplore.exe 28 PID 2700 wrote to memory of 3012 2700 iexplore.exe 28 PID 2700 wrote to memory of 3012 2700 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1fe423257763b9752433849cf4862454_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2700 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3012
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59ee6d25c77f676e26c197e572b9b8bb3
SHA157885ebdcd5d7861b5d38084cf4e399f3f7b1df7
SHA256635af5678888d27e262a3f77521a60e2c2357412334ca25195a384e23efcf325
SHA51249662a5d9c7818ca2f235fcfff86081ee53abb83ce9efd3dc914dba873d1a8239032376ed0a5af742ee6dec7f2020cb575fff0940bc2cb74eeb28557818a41c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5da9d16fff2acd0c7aed03b6a1b79a53f
SHA1c6b0e5ebecc3ba5732f4d33b754e54d578c5bb54
SHA256509cf5a0b06af6f514f2f4401f95676ef791e88c0fcb9b4e77bd6c79c4e9e963
SHA512ab83b02cca9ad59069dc73dd18668e65c4f0eb214636f93030bbe1cd17998c0ae6d2ec319aa4c40d4852074ab81a879feb14a62e0cd35fdcb077b515e4914556
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59f31588b64ce4ab5fd576de5d7e1acae
SHA1e74ac9c373e779d8db1f2e7a987ba96363c4060d
SHA25660ab664e5b0436047a5f36cde90803ed3c2577414244836084b43077c054a6f0
SHA5125d450bf98ac5a160181653a682e9a569b9bdc83bbd91d80a9c29aa77f337947853d8ad3f3ff56e388100952313f4d77970cc1467bc32c2d47216614fa8cfcbf0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b47eed6569fbd9b15a8a457fde3d5b09
SHA16d734a9c50059b2af5c187f4aa2c6a0df92bd97f
SHA2564153fb16404041431fff495fe0023fdf49b82c8f33a8e5469019163413434e6a
SHA51271003c9da45385700e7ac0367aee8723d54df631f0feb18daf5e02ccec43e8e5dbb645254be34b5d8668379bf87dd8cf64367764193684b073b2c51a8fdc72ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f5957cf99f4d45898d3e1eda448799cd
SHA171070052127d774e1d8139212499f3de699d38cb
SHA256fab2af722d56e6cbea6a969aa116b794dd855cb8d1efaeed8243e751bbde2704
SHA51260e7341e7e8091cb41ea2ae607e4babab653af9ea771ba035b512aa957e028e4633895cccf347f132b7f7080950c2b28f3ff50327927f7b8c8519b200b67a752
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53cb5a4c9e8519383b4280ae7d88352c4
SHA143a236289a68e0820f8c61a92f344557925bcd0d
SHA25649c6fbf4cbbde170fc2493328060b2d6748b905c0ef74df2c4a6773facbf9482
SHA512504253306e2b4fccf221d496ad7ea224cf2416e16999ba2abbd5b34ef85d6bbf1d1252fb5d41d6a7c1264d5034a2ae389bf104f82d5d2ed689e4853f9efdbae0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54fdca86df24812a07a97a308c2c83601
SHA1f3a4a69d4ac52deba93bcf1f58b8eb3281daca77
SHA256459c56d82f8431db92332fe602467d7f40f5d471c946a894debeeace681da55f
SHA5124cc7a3ca6bf82de5c1570b76b98788c072f5cca0e27c54ad66b9f150f8e697a0600b5e6f4032c410887e4f4521b63229e5081f41e22139e383837310f4436f5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5be41748c5ac719a9eb875d55d18f4f48
SHA1fe179c9c6028d7d53d04276d1ffd0ebcc8144de8
SHA2561d4a766d615d817e30778b0751308d2eb3bc6ed8bd3ba12372f8d6d82b0dc8d4
SHA512170e62ff8e6e38713fb6d4548d10f558a04926618407c5231d157534377d0c7d887a93f16590f70dbf9c0341d8e9a73065b4f050a086d2e1b479f68a1ec4330b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5436d0ad1ce3dcb9e557980c298d39681
SHA18724bc6639714a641d768308f1cceb5ae3c69ac8
SHA25692c89fcbffc8f8f960d6876ead632f50674e09d86f9b6964b3177d7f20a9ceba
SHA512f4b41312965a0af1891d9cdd4a88f6d43724ae586a19ffabb9b0ca439573ab149860c0c77f18642b82c293df33e1083234003412a82fb48c6f61433c939b4b59
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54e15fa92514b13a2c8a3f152babfb80f
SHA100bea725739b908c24baab29f631c35efd0f3167
SHA256dbc119ee9f13e4097254de2a4b16b6f5c034baaff91c5d1853c1ac5036677d4a
SHA512ebf5ad3f08798ad2021573aac5ce33382c71d4f88c584de3095818e141996881ce2b3c84bfe40c6cdab761320e7463bd8baf1e33da58269ebbad335aca23aaad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD574e9a9716ff92ecf950dd54035d30ff3
SHA1b3d5113766404ba5683f1c7c1266574cbbe561f8
SHA25666447802434e4499ce632076bc4bbf0552d567f79ac20f1c4697258a65a823ba
SHA51228f0df4d80726f390ec1001177349bb246177f8d6620bb2c33767a08d5e5b10576bbdbadf82def8d21dc7ec7cba025067e76e35977fe52130c8a91cd94c50aa5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54560ea19cb489c7f3e1f920e1242e218
SHA1f665b44946a07b3870086bbe7c5cf83791ecb802
SHA256854ad347ade1b1fe4bc331d8e13d5ef18f30ed13ab27a6a436bba2c0af2c0917
SHA51255c1995642a8adf49424fdbc722145c1dd2d2a9ee1777ef0228cf2b278965102f43b768689d26f4280e2135a224afd0170b7f82f3632372d3c502e7f1253d143
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51929916fa57bcf10c9e996eece5d2c59
SHA10193927a8ed0b9d274834545d19771027c2ffe09
SHA2568fb0091907c2a51d3a4cf16fbfca2c498b275c7f9677345cafce6ea1756fd45d
SHA5127cdeb9fa4355921c575c607b90c2504917ba2fc80e21c66d160ff102ab83501768897d735db74292fbc6bc1e13507ae9d26effe7c27c179140dc5441b571a416
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD570af3c80c8b11e6f7529806b79e6eca8
SHA1e82c32de215b1067fa9681ff6f9caf6c0fe34988
SHA256dfc1bc435f1e906931b85b938b20dec4d864ba29df5cb6b9398a5f82ecbf7ed8
SHA5128c26fc7ac2c4f58592dca07438d2f9e2a2d659e2785217ad55b696c8c12ba187924eafe9853c94b65708fc24f2ef22ac2b52b1d05f5f23a9123e983fb6a24e50
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aa6070c0fee7ce0bb6bcbbeea02fe15c
SHA13fa7c919e2ff5b5a80ce68965b9f8a5b7c1228b3
SHA256b5f016aff3ab921577a56933ffc93889e00b9838e7b255f8b540dacd92f47658
SHA5127d116580547dd19f1eb416536d2936136022ec99b9e6bf792b2cc119494db1b4a841ce7ed6d379ef2b62583317462242da30a290ea6f10882d1bed66646402d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c4c7b632d423245b71052a5c84fbb94b
SHA13a28cd8c21d47c58980cf52630e967af222761be
SHA2568f0b16735eef0f203a71e01bd4322605cfccc509e76f71b4f0ac59c52324088d
SHA5122fa06f8be59b276082e643f06d1e9d7327319425f723a6697aaa2e72f05c7bffe1a446b4d248f36ae05b06aa0474296af9ef83f54ee312a549f013da59df8583
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5191605dab61e6957618c35e048452e99
SHA14ff3e66b39701685c6fd277e66630e9595f1f634
SHA25628d2ccd6bc7fddd3f58336e117e9c26a935cbff354747ee19a5f8976dbc6a4a1
SHA51286217c5f6b1c1a08f93f234d38a4a5fd7415379eceb9c3420961b045643a90133edf7cb61d733d6a278140d14a58d07aa84a42c7a3c84104cf027a1f3c1329f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59f39d6b667e9e01ad8186ab559aa3a13
SHA153bb45bdc7811c4a99361e5042c76680d3b41ab0
SHA25648341278129aac1e8c2a0c987734f87ce72c60c8dffef10cfd850c159e4294d0
SHA5127747dc1396afc981f423e4afe4d7cecf764051691babc20405696d1e0260d84aec97849ddd06204875ff4d26b2cefb2e181210b6684646a38b4ed7828e5cd5b5
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a