Analysis
-
max time kernel
120s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09/05/2024, 07:07
Static task
static1
Behavioral task
behavioral1
Sample
28da8d500c394fe67ee82bd72b2195be_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
28da8d500c394fe67ee82bd72b2195be_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
28da8d500c394fe67ee82bd72b2195be_JaffaCakes118.html
-
Size
6KB
-
MD5
28da8d500c394fe67ee82bd72b2195be
-
SHA1
134af3c9982961ff5079da715f2aa577d3d7d6bc
-
SHA256
ce11c8df9fbc44a70170a1662bb136690139885bd5f1aab1e4b2c305e9e60083
-
SHA512
5d1692819d239c2cf8745678146c8500df1d6733f7952fd5a8358e5bf95f0d01411d9211a425b771f5a6713ca24b95daddff1f72c073e12dc75f41602c122ee8
-
SSDEEP
48:9yhwf3ERHfvXD4Wa6xm9cCTlXPwubG2ADTw/6wQrS5roKGUlYyKWhWwwNa4Dgzn2:shM3sHfHm9JlnEy6/oGscWhWJd24D
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 904b84b0dfa1da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000035b76c68a4553672c3f9a8634a2d7e8401184cf76b5ef63457850efb4a5aa57000000000e80000000020000200000003009b800dadf9131f8f89aed1e8d9cd44c3b35f9c21cdc1e39f53c639956ae7b9000000002ccb30ad2e89990c507e6c198ec4c8262875dbf7eddd6041bf6f6f2211fee124df489cd789568f0bd5bfa52527e53d45910efe2f98096fc6eaf491caec77dd46199eb439458c43f8db94924e008fc128852b49db01a05aebf1cecbbaccc0a209f23b51b4364925ea7262487eeb8598bc37b66505d1a5d67dd5811c5d4b1970083dc36d94764b8ecd90c13bbb16e2b9640000000427ff2f391b8841c01fed6bedd13297640bd95fe32dabac56dfe39aa9d69f5647ccf78dc17e1b5d2d8e3ecbefdefbaccfee3ded1840d4276707ed9aa0b353c47 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DB842AE1-0DD2-11EF-9960-CAFA5A0A62FD} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000931606032de6eedd5ad198f4dee3fe1f3a9015637644eb575a82fd4f93179521000000000e8000000002000020000000e5416ac7f7fdbac03287c679d51c0d1c3b8d3872ad5d34c52c4e99b48c82f8d32000000072e2837b874e413f8250800043981fe6900a846e2e1f8749fafb962552fd0f3a40000000685126a46ce87eb6858127ea010a4ba5ad0a8828c23480656187db73d9ed4c34a663d5ba7f97fe2adaba039e6fce796459716beb73f9e735955f9409a0a0ba77 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421400344" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1500 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1500 iexplore.exe 1500 iexplore.exe 2900 IEXPLORE.EXE 2900 IEXPLORE.EXE 2900 IEXPLORE.EXE 2900 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1500 wrote to memory of 2900 1500 iexplore.exe 28 PID 1500 wrote to memory of 2900 1500 iexplore.exe 28 PID 1500 wrote to memory of 2900 1500 iexplore.exe 28 PID 1500 wrote to memory of 2900 1500 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\28da8d500c394fe67ee82bd72b2195be_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1500 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2900
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50e7806d2ce1bf593bafd9d91b1bd74c5
SHA13f07f6e76c4f03563157b0ed990b35d9ffef6b65
SHA25696a68fa603e2e9fd69dfaa33d3460443390b21680e03e6c069965c92bde725a4
SHA5127848f123090f93895053515c1cae3f24e4f02e49e94288ef8ff31b0e0199d09d9831005421d095bfad9b0a076aeb30ce763d20b570db3143430f921f0f3720ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ab6d7f9696a70fdf468c34aff62e3ea2
SHA1ded1c1eba4b9171301446033a4c13739d6eec1e7
SHA2569314e2f3324f89b9292f822817f2dda356c0dd56ac5b13e6319d3cd9d94febe2
SHA512ca6cd2ae4fade823cbe1373ff66ba1dcde4614de93879f61d93448b76c5a79ef14bc6f64ee54552e1a801713b3537acab56a96a10b9b8280a2b4a4254ef3ad51
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c134dcc0a457ece8e77ec0d0aa2d2f68
SHA1f2fb13adb759decc1e149745f7fc138671aa4632
SHA256d1a06e7cb583ce33a33d3ab46185d341ac4e5749de7b4ad4e23d3e9137b816f5
SHA51282b424a9de6977b5333e68e9087452d6efea05ea84c467be92627c62a0a8b02fe534c46907700633f457a5ac49841ba301f65f363eb16e7b5118a804a93a33e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5235ab305278ea36d1974d4adace3f5de
SHA11f630c147029da7647036e9def03bba68d261496
SHA256594564ccb9fc82c9c456106e79e754f9ffd85862a663db982d1bdc81f63aaeca
SHA512140ae1182ac96c5c0f178fb3bdb266d0ef5e0fcfffdc1622b656c816faae9aa794fe7c7264b5a3625199d25a657a8ed2e3572d55706970a95b4e27b08dd5aea5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD527d34d4daf235e23d1a5f5490ef4a1b2
SHA186ecfe7c0af99ebe0c6bbe02fe287488d40f3e12
SHA2562910ac5a5f1c4f916820846243eec166cd48cfabdbfac3c5d48aa19304f6bfd7
SHA512603df9b5f1a6a8554bcdc7de0778621a3b72e02049b07745df4b9a29f971b163d70b9c03d6b8d399d8c71c829c970b216f334acec8944215d740558a8c24c3fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ce70e2ed2ddb117fab7a4c2ce437268d
SHA19f48b6e78b50ceb5d4c85555b6f3fbcd55b81b57
SHA2566500c16236345c45518c908e27dacbd5828cc3cdd056154d8838d357c1059325
SHA51245cf165c548dacc6f0d366fe4a0e37256d80497d1cc67950bcbdafa97cda160c5f52cf7a16b95e564f03081270ebaeab0faed2faf6f59099893a965fd8eeb836
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD504dcd82d4f8d68e8bf17f7775967f6ff
SHA1fab603493b8fd7a413b41c3fec12793af2aa47e4
SHA2566ae352e2ab9c5d29f863d1e30dfbcec5b63e4eb3c4b3546e1279807264122bd8
SHA512ea4376620d8c3cf9470d0b8ec05454734e2cd315b280b323ca7a9ae7ffa424f0142c51e8219be812ae5b7c695eb22e758a55408cac79ead0e4db24defb5f11b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54b42b644d50c0b82fe95639b5cf0a844
SHA1851d0f815ca8f82354053170350c26abb9b65d5a
SHA2564b95e1c89be4b6c853cd34b64abb96f91c283a5978d4a7200af41a350c1b0db2
SHA5126f3d259074be70be7e5727ccf6b13b98a76e433d6d9fddfa6c5a2dbeccccf6ae00ca86c39ec3642d0a8630f5eec0259d671644e98d79b5d03e1640f0251992c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD592d5fc71f5272deff0c24c8422829a13
SHA1c56ed70bcf918d2bd095a299708809cfbb961c1d
SHA25652492d9f699ed7507fe7ffd96d4ce8fb114b57c3b1418bff2b50a826bc804719
SHA5126414e317c2a60691a3437b188d8b1a521358ca1665ea67a09d228d18a96bb101bcec3ed0fede162a864e5867550ab1ef60ee337335c5cefeaa533e80c24fce1e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD521e01eee137a619943cbea261e7c6843
SHA14a139dba458837fdca15573d76168378671fc141
SHA2563a92d19b419ff1792240554e73ee844656defdeaa8860eea45cd0c9f5d05ab42
SHA51209edbbf03f433274f60b746546b669a79681e760776e936be2700027223c78e1658a2c2200a90f16c96d1a03f0bd98882143fc0a8a971b85e6e5495907e7412f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD512c4690c4400b72cbf966c30cf98f05c
SHA16828ca8910b53ef5e030d417d41efe23f6007856
SHA2564f2d278f73b245e8131a123c47e9c39c199334e946a8678fb1f7b22d21e8e698
SHA51238440241ac786e3524af2dcdce06cec776bb77209663251314a51808d7550e2e470ed86ca691f589f3a041fe520ea8058473c3b93a51643903e6fbf02da7d884
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5808f99b492a1d58491f4347d7e3e3e9f
SHA1e3ce98e4178181cf382b9ddade1e45f6d1fd4f10
SHA256462b89cad64e53dc743de97bc1c6eabda8f6dca11fd47981077498b0e0a92726
SHA5129e1c1b72edb883647a3d41da0c56b38add23b17d9f36389293a4183c63bafccd8fe3d49ca62eb1595dfbdee366034edc2fefbb061654426afec3bf4a5446a410
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5181206d20df34fb24f3f1838c1fe7d6b
SHA181564cbb005e9511c253c340684740eba83905d2
SHA256df5f100cf6a19eca23ef2721c28da51334caafbe358d62609f55845f47720d4c
SHA51275aefbe14a98b7d1e919841084a306052c11ad96d5cb2d14dd9a235f49afb005c389a0184b7ff148b1479d7e6591e93fa8abbd9dceee1332cc07b7b1805312de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f913dbf23bacf9a39d798fa3f0e685b5
SHA15fcb7ae8311f1399327ea7227f8b7edb796d2b38
SHA2568ddac170d809eda6ef7d8607a032c476dad99c96c8eba0790426f40ce4821948
SHA51215aad64afe07a05b18f7289ad4c9d74c4d1892484c5d004d1c6b1c528f78c37610f778911e34a0920130aedb620cc5921b9aebb3c5357f7d09b86ea9e4f3bb36
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5da61c4cf02d5c2dcf0feef4f38c2ee2b
SHA12d5fac877828b3dfc07b4af0d3d11d3a38f3c706
SHA25693c2c04bc998c1a83fc680cbceca96edcad472bb3f9644cae27466b60eb722c3
SHA512b5572803681537f3e044e742399e31345f9606ccb3e9dcf11736dfc8f8628ac131e9579b919ff5c11f86490c2415837bf2b67c78c114457d39c68d0c2f73bfcf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD573cf0a79e7e7d6762df42c60af19b74a
SHA155611c29f9898fe5dd6cbae28df176ae919b51bc
SHA2560587af5ec3cb6b36174c66f5293f3af66b1c77d7c332694b5b0122621d7438fc
SHA5120e0b12ce89dcded5f8469c7aa7155a803ec1458da1462efd5430eeb80095ec955f650cb6f4e3fa7a3b201f0b01df010e53c24d9023335bac146a18b61f929662
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dace991b7eb9e8681b357d960e6c8758
SHA112abed32eb5e63c59a1a5bba46e099d9b0dbde7b
SHA2563361b4ecb21a86ced480ec62828df7836789cb0efa3a5d7080b0df610db760b3
SHA5121d978672dbd4883e6b430ea99d9331a6f62a81a77cfc466ff5ef062b8c4dfcd1f3f4149d3cfe77c0cc2a136cb17e3dd0bbf701bbc0e569bf5afd1a72fba8dfda
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a01e128f01ae7a407b195d16086bad1e
SHA12627a770c7652067cb9542a25bc5c178d510f0e4
SHA2565fa801596ed324685b7922205c4ba1dbc24422f0deea946acc07f7da95cc0614
SHA5124541c29f2899a37e50332b30bec4b67965b4154af3392cf2eda21cc6b37d5b837f41896dd4ca3c8dfe1b8ec981d877db9b6b278c1f9fb6337cb017a5a364a4ed
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a