Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
08-05-2024 15:35
Static task
static1
Behavioral task
behavioral1
Sample
25873b3a11310ecbfcbcebefb0746e95_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
25873b3a11310ecbfcbcebefb0746e95_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
25873b3a11310ecbfcbcebefb0746e95_JaffaCakes118.html
-
Size
810B
-
MD5
25873b3a11310ecbfcbcebefb0746e95
-
SHA1
d92604433f4a3016957bad5213d767ee8f122282
-
SHA256
cd70af7b162722baf5d637b834095da2b1a210091244a2f60a41493dfcc5ed3a
-
SHA512
52d5d56d461c557c9e89eff9f6ca9708f67e59a9e9f46a6e444803344d9d7410d211e07fac7ae4dfeae226ca376123cc1bdb6c8ef5673227dd641c3677c949e7
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A7159911-0D50-11EF-9A67-52FD63057C4C} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000268027dc07ae1a01bb4f5b25ef1f147f98a794ad0b23ac57a4d7e9226474016b000000000e8000000002000020000000c0c4979226380a812badacbb688aebe5145908ec2674e64666dd9932663874e190000000399fb9759f88ec4363fb171716881fcafed4a66dbb666857ec385388e20ae5c99d2a9c412e7ab5d8c14227e2e22a2922706bebd31f7d0112b27372dd4f94d44e0f80e48cf50608bb6ccf8a99040b68d28bb0c78204b2bd84d644462331216818f0cb6dd8aeebc8764ddbfb1c1430f4081ed2e92c928747cecd094003eb3b7455b8f584e7a1488c56125ad4e5e214926c400000007b73f4acbddce520a8e3052baa72d83f61a806eb11eef48c516323922c1a709a0a07f230859c004d158b4be9039feb9112a9f7124185d29b99ef24f3a4e6850b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000023c2062d91b8a9bf1c06241d5e922fa93e1e6d41356da46ba1c77a10b24e2059000000000e800000000200002000000085354758b33e71eb6e11df659d691918f41c347ef8e81c91a5ec311aa7466dc9200000002e0bf7416898785e931206f71b8a6180bb69ec6b9f827fb0c271926407af8e1d40000000802d66987df97b5152247e128767800c0cbbac3b6f03746ba3ade32aa219303f4ed9f5573bd377f372dff06dab84613e911085f495cb1709c208a238356f735f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f08d9e7b5da1da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421344419" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1680 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1680 iexplore.exe 1680 iexplore.exe 3028 IEXPLORE.EXE 3028 IEXPLORE.EXE 3028 IEXPLORE.EXE 3028 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1680 wrote to memory of 3028 1680 iexplore.exe 28 PID 1680 wrote to memory of 3028 1680 iexplore.exe 28 PID 1680 wrote to memory of 3028 1680 iexplore.exe 28 PID 1680 wrote to memory of 3028 1680 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\25873b3a11310ecbfcbcebefb0746e95_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1680 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3028
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d8e7c8cde45b6be5f5127ccf2313e687
SHA1909dcc26c1c8f3716a499ac888a100834eb6b45d
SHA256edc7db48c86b8d6ec6b36056d47f7884fa4a5a227252cc6080b8cb5e9a139385
SHA51239553a84815db55755d79431139bb455966997ba7e03a68878847e527eb9b50d79b647d4e647659e2041777b1f55c3e6b1d05b72e01007b201722f586c4d48ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a4f5a296d37c1bcd1a85580c447cfdea
SHA1935418402ddf77b18535d12d03a687c65f122429
SHA256862a14fdae3f233cf4c10ce71d804f4bf64188e5dc57c2a1e05906ab49c4ddd4
SHA512ee0eb9666bf84cca9d7d291e98ed95a23ea9f50ecac08f17371afd63580dec3bd045754b10ef6895d7e12eb349f77ff951f69e5bbcb7be78cf6df5e6303e51be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD566ff19ebe48bc92183b487ed428d36b1
SHA1a89f9b8edb909da55200dc651263675ccfb94bd0
SHA2562cad2afa0c4c1dd5e2c418569e4e2416aab5d15077eeaf75e57fb7eef8fc5c67
SHA512619aa1eb94858c36d4fe71030e848057bc59524a6c16cf3651ac776eb24433f050cf0864602549d9893802393ff462e650bff0b30195ed464f6a084278875e38
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5313a610080cfb71fbd4e971ed19eb3fb
SHA1e43bfbe9eae32289ae7c7abd3d378062bb1e7e0b
SHA2567b276fc91815098d7e613e5f91a586dcb9584c458687f06a26c3d203b96ef2dd
SHA512dd708cbc540381668f842628e06c9d89ac81fcd6a38c077b45986d91289c1258d0a8046f0513d5e88b81c622f5ae75f8771df32d9f415e983d2bcf0c5a4f2ded
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51a3c1588bf05543866bf9a9cec847386
SHA1bd0479bc1f3e7006f61ef71a9177210983ab081b
SHA25602b346ec0b95fc3c293e1807a139b7c47e865751113f3eb61f483cdd23c6058c
SHA5129ccf58a5a396a811b46156fb91efac9a067618148b6173d78ec2fc2d191c5a9acd62622715894164b4777ce33ac0a3977eefcba014324ff8a5125108cc0f8886
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5148de36a0dddb19f8d1628fb52f63e1a
SHA17e8f43c4d721dfda997d81d8ea7f091497c608e1
SHA256c1933e9c998eab6a2b2d1c3b0b7fd431a72bc52265240046338e38b498e1090b
SHA51239cca0ebe55f75940f5320790988bb072ee26b0b9dd5a53864b1f53f8c07243fc2924a409002cad9a13b1c1a1064ee655e4958c80c1ac0a233ce3050db6e3d7a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52b17e1d33187973cf410de32b173592e
SHA14042a00eb1731195c635b0cb7469c0121d761d84
SHA256bef6791c5d155ee016f6b1c5435ad51db777912a82c514e08bc4b7bf142a3560
SHA512ee3dc38a378bb9b25514b7062a9079ad345ea3d33483d336298c3075fb276cfc7753e21d915e9a752a1ad23f0cb6abef7e929783b401242454634efb9eb1734b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a9d6c1a097742e19114a00eb99072ae0
SHA186260471a54cb3551eeff35b728ae7d040695e2f
SHA256256fbf6b8db36d502cbe5cb2794b3661fa71a808dcd096dc42d0f5b831e09409
SHA512d70dc7517694be68e00b60e6c4c92d6fc66b58219afce326a9b15cf14ec3467aef13b20c46ca51943db10f2b3f7b1817481fd8451f47793e89b31a03b128c128
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD586601603a7197035b64603a92dd99dd2
SHA118f83896f0e8c7d7cc0f7124aead4fb4448ec52e
SHA256913dc1a11b54482d7163e2c744e162a76406695e5846c5251b5c72fe01c33ada
SHA512cc3c212f137212291bdbc66faa50e27801a19cdb56596f4d1c27456d80fee45074b370be8ac58603d418e60f11d6440187b8e1bdea80450ef1797a238b0af289
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f28af3829bf44ab52333ad2bb8a7a4ca
SHA13be6e373152baf5d8519df60a47eb237034c6c7e
SHA2569900f46dfba6e08ba5b49572560a8f38b855a7ff8b0916d7cc1fd4a2da5818cf
SHA51201e5209d543513c4f269a67aed27c3336bad6f5ea28cd3ca03c360f0c5e20efce2ad852f8c771146130e4c4e44791efbd30c56f4cac4645576eda96c7aca3c13
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD529cfa74bc0c25d6a04957aea399a40f4
SHA1e002359eea9eac7b09d5b694f3b1ce4f64fbd578
SHA256096907c7ef4106e9aa221aea6b48105427587ee3d328ad91ee99bc38d53c075b
SHA5124e26655ff9736fdc3c20c991672830925e22b2e5c98afb7b99d64083cae5e5025969a958d1b4d0209fd56cf7177919960ed5312725732a85f5ee8305f19f36a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5659235ddab82cdacde139886f5b70983
SHA1a78431e09469cb7dc2131265ee46bcd4b19f7512
SHA25675ff30026646d40b19d50cd0e90ef3a385992f022037ce3e3e67cf0ded002014
SHA512edcb2ff24782d2d494afd15db290e084c8c37f2b7f8ae826150423a4de50d96ad1c26996db75873db9df7b3831272188205889cc94068f0f58b90fedf43da5c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f7069bbdbb9ce3d316235ec75613b9f6
SHA193396b4f5a235ef78c262be8042dc3121939bcb0
SHA256adfb4038848f4a5e40c71474a1aa0b24b7fdc0ef0f742f857199f9fa0ce333cd
SHA51238a78d915092afd96398744f41e9c5b7d0a2d3ddea13b782bcdfc17f86f8834e25d5a6b78cc6d52e953c4533ff1ad6de1eff70cf39c5b2e015709b533931dc51
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5de6b2977ce7ef91bc53d4880a93e05ec
SHA103a9d25295566f7f1c9196d518af023496287a4b
SHA256db0f49de86f426c0e2bc75c0fbec1e5a850698e03057457c9bab5968cf9e1885
SHA512c359ca4b1c8dbff8384f1e06aedb73619c71e4f361f9e693b099f56e97a1a8147d46331f41876eb5bfc3c1281085867676acc2b63c7887190f2f5bce309faf05
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5950562f014679e02bd8bc512dde74f22
SHA1e44cd28221ec030c2d3b7413984e5e698577b675
SHA2561e5e9a5c41ae980597349ddb577ccb1f86552e23e2bc2ae92462d9d3a4f42c59
SHA512a2288a3046cdfe36b53d57135759fcaac499d5e17fbcf159fa529e7fdfd45d3a225a91765cd0875196016bc95f21a84c48878eb5c7261ee651f9ed80754fc61a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD526b4599718b53e9ccdb68538fad005c7
SHA1cb0b15185c75d0350b5ed4d64ebae2dd21181937
SHA256249df647235e1c1e435a2007e900dee643c4d400c1ac7c221e3fc1cf9cd08422
SHA51240c084f6b50599283fac3fe58bdb4d4f500b47bcd928cc2f5edd82609120a44f8090198e065db5ca4c508ba060a69ae70b604b1f448a1dc2ff100bfe7db7aff7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58aa527720b9292c1a4581a1abca842b8
SHA19838ed0716cc9c5b4891b10fcb588c225e9c91fb
SHA2568d9097ec054f454879bc4aa3e2655e9e9f31a8ef2c4d4da23cb8b670711d8997
SHA512db10c1acb921a72eef919dceb31b7c46a14fcae435e85889530940db5e2550079ba1228bc8a00f273e589fab6294a1130963fd67df4547d0c96db427f04318fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD504dfb31fd053b059c1b9bcd723b7189e
SHA18085170026ced1255dd26df49ed7c70a5885ba2b
SHA2566ef9a67d37ce941a14830323392fa03253bdc2d8e7c97af404bc2e6c6d3f22b3
SHA51234731fdc174ed2d9cd3445595977c69e55568f2b383c312fafc719c616ac92e487f8587b9608eb1a6d28d40c276453803f0c6dd9a2138a17d6d77809dd6dffa5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD557a90b564e23835fecfbad76ed37519b
SHA1011e1bba4f6bfe60d07fca21bba08a15e8dace6e
SHA25693d57d034990b7b83cd1e9ff25c04f95709e0e00405b964ec9e4854aa83cc3db
SHA5125879a290c721d97639d984a2dab2588863e55d8b7a3effee41cfc67a00aa178bdfa954b1b5b3b6f1722da812b0e1589a00ae92ceff02c2f9037ff0416251c458
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a