Analysis
-
max time kernel
118s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
09/05/2024, 03:34
Static task
static1
Behavioral task
behavioral1
Sample
281dbeca347a975aa2604282846bb492_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
281dbeca347a975aa2604282846bb492_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
281dbeca347a975aa2604282846bb492_JaffaCakes118.html
-
Size
460KB
-
MD5
281dbeca347a975aa2604282846bb492
-
SHA1
a921da40ee3d60351c5f42dfd9bf9ecc378c4365
-
SHA256
18cdb01f88c994b521e9f7190aaa3c4ae9a3c837c58fe376f6190eeef5c8de80
-
SHA512
2a1ce76220d0e51e98cf8728941895063508b9a045da334ef643f789dec9d08780e1fd5576c24a0ab73d5b5d69e676eb5b8fdac4bbe1a35b1066e80c07b505b5
-
SSDEEP
6144:SCsMYod+X3oI+YFQdsMYod+X3oI+YbsMYod+X3oI+YLsMYod+X3oI+YQ:75d+X365d+X3x5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0534af5c1a1da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000005ecdbdc7c575ad42e936a7928f96c3c43150061002fa12651979469b229e46e3000000000e800000000200002000000090e094d9a2504e600aaf6f833354179a52d741801870327f0d2528a2474593a5900000003a561b632d40d0a2c715604abf5f7f92e0511cff7dd9481fcdacaa23aa7bfc8f299ecb73e244da1dd290ee9722774d9c5360f4790a1199be5255a8f1f993db7679ed90f8f91d25ef0733eaf530f694fa325113191838467406f1022dbf7b93bd71fd0244fbd7e41f343a5ce5512023b195c1feb77258c5054e2fbb57662dfbc5f8a2db03b91b33997509b5ce0eac7303400000008b296eb4b1fd078bbd15416880243e24eed7c3edc5115f70f13393c6f6ebd2e2d179dd560f1e7fa71fe71294fe66be1db2cb302b20666055406689aa7add273d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000806c41df451ad2db85e2d6607490cd49a988056042faf03bd801822c52d9dd23000000000e8000000002000020000000a52281c85c67eb47ff7206d49c3374a8a2dc507a63857f1c79aab48a74318efb20000000feef7151305f33c375ac0e698ecd32d7aa7ccb5b71b50628a0f4a5e1e0f20a32400000008ea05d6b2db9deb882bf15be34b02d2af3375e68bc31b089f7dbe3a726939765c1407ddb7556fcdee91a7a83ed3fc174492989970aee9ec42db917be881ea568 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421387566" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1CB98A51-0DB5-11EF-99EB-F2F7F00EEB0D} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3056 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3056 iexplore.exe 3056 iexplore.exe 2168 IEXPLORE.EXE 2168 IEXPLORE.EXE 2168 IEXPLORE.EXE 2168 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3056 wrote to memory of 2168 3056 iexplore.exe 28 PID 3056 wrote to memory of 2168 3056 iexplore.exe 28 PID 3056 wrote to memory of 2168 3056 iexplore.exe 28 PID 3056 wrote to memory of 2168 3056 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\281dbeca347a975aa2604282846bb492_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3056 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2168
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e52d8843da60c491f0d3f0a53520acf0
SHA104f76ae4f946f9b0af92a77dcf0a460a41e07839
SHA256f580a564f3d43cab24c37272e4b02bac20976554f65a52b10eb1d6fcd223583a
SHA512945f865a147958828e16724b5eb035d113a62bc3ad9c5f4406268e5964cd9146378fbb6c26d697f2703f0899187b5ad9d8c9368853e368f9f39bec5bc581f477
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57c7efe2898e8c387e59a416c8c4f5446
SHA174de829c51b9b24bb4146a2277827d2ec728edea
SHA2564b128bc5151a36bb0ea0afee9ef20c665959f41f09d57a132adb7e804e3d9152
SHA512325b53b4aac2ede2995286679d887445424ae6bcaf280278feba52fff92d147939d0559d2befa8d4fefd3b3bf4ae382a78ab4caebd5f065a8908e554be7295ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dc25d33b49ea27eeb84022c9cf104ed9
SHA104d35845cd92d6946ddc62df560af97acaa32141
SHA2561011db3cf14efa50f16da5e12be62d425ddedcbbea64577bdd70f4c5fb75536a
SHA512da1feb9cf9588048e15e8832b08da9aa45c0e6cc732ac6e3db526e00108910677de041cf57b62ef6e323b48d4968740fb8d14cd86a249f7b897c2551f2b2aef5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f2ce021020375d74e3bc5e60822058d8
SHA147751c693ebb3e2e5b5c520eea524289e73fb297
SHA2561e75ef2b773f2f23ac9bc89a69d426fd20d1669996e55a3698e833982ba5d6fb
SHA51258038df2f6f81869f5340935139118a2e639b674782e58a05ed7f2f1c863f887faa4ca8798bc209c6adddb81174f27d7849917179fc6c1b8a47c62b26f5c71a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fff6070a99e736668605d04935490e43
SHA186ac153e27f6e8ac7717ac37c17bfeb6957ad935
SHA256f89b3b76aed496dc92ca74bc797cb2f41d5291d3fb1cd4e4300b3ffc79ee1aa7
SHA5124b0f38450f3a91d2283c6d1398c8a0d233bdad7f0d68e3426f103960ebc16aea06b0d443cc61c48e53a4a8d69d606b3225623159fe0ff99f7c146b808fb34ebb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e8d533519764b100684949a6352ea25c
SHA17e0910e40b7fd24aab0ed66b561ed36124e1d4f8
SHA2567c4a264166ebc9bea311bb8e7727bd228c5e59c1684b246d402eb433509d7981
SHA512cfa559769e62b92a781578566c449fc8440e1891f3bff0bdf6738e572e5e0d3f5e12bb339c48923a09dbe87c945c3c14225765eb5f2469662d42b0f17096d618
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD553c97aaa103fb3999f8a94eaa0f75809
SHA1258e5bbba49aca4cc97de5c5c0d47aba69977f4c
SHA256df87db5a3340c17353356d8302ca1d29a00d0e982dc776217ac967676206d968
SHA5123e26ce49f2de89940767876b3d0cdfb24cf39b001d095afc841bff0a29d4a9cebd382fe4f494e5d2ea33f7c04db594a02114bb1d1f29d7af959008f3e25ec6cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f9fc1f5739679a4a02db77657c5209cc
SHA1addb8d5c8b3084597c60a73121806db8198fc776
SHA256cd876d8e5da4535f54ae345b9000770bcfc3c5e8e979c2eace028e0d9a40cfe1
SHA5120514e441165eeebfb5e7aa1eb138c651a068f4cca3fd3ab616fc1a0f656deff3954b1337f32d7e24711ae51bb91bde483f1e9d45cec3d8baa86648595c214e7b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54b59065b89e4c67c0003cb8a6312e1cc
SHA13f3f1277b55b45edcf5913f44f0a0bad66e633ad
SHA2567c54f09b7574de2787cccd9efc71b9040546b3350fcc7d4a725b1c876ccb5dde
SHA51245e292102d8b213e1429b66e865ab09b776076c24a78a58cf7176f60c38bf791d93e9e75ca541d1d5bc119aa5a68399bde5402c3b90c5284071e04bdb18e6b3b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD559feb04f713cc90621b0e7860a47087a
SHA1323768afa132d509b85c6aaa15cb3c961f4b808c
SHA2561ccaf761d6f9d5d7c5c748acb025e734b5a2958e0b1e50b5790465181c15ae84
SHA5122d159081521d72621f33a6ed3b31328b61409f766574e248beb40d3c92f606e47a38d1d94cdc5efa11bc4e874681e09fd3576fc6ec8708efe352fccde2fce961
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d87a44ac82c7e4f939791b6a1b73e83c
SHA11a0f29dc2e1108bf139e4941c1a21eedbf1d202d
SHA256034101c62d1681da968f930044f9e424f88aa3ec713caca630deb591f37aaa34
SHA512a06cea70f267953879943297a5e5fd7ee0aceae1f94caf6393182601c5d5b4639fa66b78941499b40fd4ffdc7230dc24dfb85218610b3af7b946f12e4388d4e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57441908cc4ee7427deba383b91bd447a
SHA17b0500887a46d8f4cc38dba4a0b6002f508d5a1c
SHA25652c670cf9fa81fb87ca83f059323ee50bd16db13542bf7249423b530b507d4bc
SHA512c997b168e1e3c60022a786a4eb8aaa0a18ccf65c31c29d950f1784f312bae702c7cc14c65862b8f8dcce0c078f7e9960551e05583d23bbfa6b3339ebc27157f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d381ce3bd851905287b836acf66df37a
SHA1f4e205de113125d6b6d8640b6fd45c772b5d46d4
SHA25617976f995b18305d0768bf0785916b0add81e6e3fb0baeafc76b60f3af7a3041
SHA51233e0f7ed20c78576ff8d1684fab71259c0e29f06e8baa4c6c17b95cfbfcdcc300fe02f314b661aba9966059b05f9cbc2f2eb115eec51f7f8821fee3cb921565a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51d3f73227a40f381bbe4c45a93171664
SHA1aa38fbf9c6af7c92fc00b27e73c02036e7d26a1d
SHA256249b22ea2695ced2dbf79c855220946a773256b9b563de0d57d4d18409279113
SHA5129fb704c741fdeca951f42c03972f2457eb9f091c3f020b7f8294d8b502f0deba0eab5b711e63e014b966154eec42eb974595bf5dfdaec94b702eabbe252b0141
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a1d4f497b0e34aa710718703a5a6c361
SHA155372c168bdc2e547d7de6351b7ad149ef9ee5e0
SHA256c628277d326af16cafebc66a00d4a728c9c212ee41eb36d4b6149723de27e597
SHA512f60e896c1466dbddb16c834e5aeaf37b0fc5f517a565a92644c82286b1ee3384b770432a64406150a82a8094a76c8a3af6e410355a0057073aacb37b14a93ebd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD545a1ab248e541cd40e5773572d7f1b11
SHA198fcd3dfd5786a4a4419b74dcf1d390df1ac1cd1
SHA25608b7372d37f1aff761f34e56e7c885aa200c7b62bf6a1f722568b858d30c84a2
SHA512745811d13cf88af1a960fdb4adf4ddddc2b671253379ccf40823d29992d39ca1bbaab25c3aedda6703057a2436143aaa44ff420fc54c0f5a34d53e19fe9339ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5776a3680d61576ab06ec428e687eb27e
SHA1114bd5990f579e5024122532ac83895a9744371e
SHA256ad411c9d1aa24eccdfce23099a96d5b2162339a40101bd4c414941c56ae432ed
SHA5128ce0a5a035f47fcac413538769749f06f55a68b704af453d1e3ff296c710d9fabd2cc8be57102b5f6d1ef2d4f69f2fc0fe99d258ef0272aa71ab3ca90fb63176
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b6b60a0eeec79ba04f9c70ee87b5b11e
SHA10f5da8619d9273b019c2291ee85770fa94903af7
SHA256228d6b09b1633ea2aa07601351e996f917a91f066bd4713b69522bd2f1eb080b
SHA51274a1afbcea91ce93a0dfb8ad476eadd0ba7aa166d18da129011f8d1bf1e2a48bfb313a72917ae8cd81c8260f66e2c6dc865d955b4c396b6ed25c0998619e0ce6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD506a92173e81e2986ba336dd9e416f046
SHA1c57e1d45e39a410d91a367835cd630fa6e54b59d
SHA25672a204e81e516d203651da6c8927d38b600a056f18a50cee9f8cc81ff1feef1c
SHA512c644815fd56e7aea1acddc6825411e6cb48cf6aa3c65450cd4d7d27ef7460c335c6a07d5fa299626bbcea84b898ba60d5dce434caabc3103521f9441b857a677
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a