Analysis
-
max time kernel
118s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10-05-2024 17:33
Static task
static1
Behavioral task
behavioral1
Sample
303e7738e2a334a38f63c0c783694085_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
303e7738e2a334a38f63c0c783694085_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
303e7738e2a334a38f63c0c783694085_JaffaCakes118.html
-
Size
460KB
-
MD5
303e7738e2a334a38f63c0c783694085
-
SHA1
8670b2ca0476eb390d00654287b1b4ddd05ab694
-
SHA256
46b7e290bbaba4fa0056d75424d4dce34ed3831aefa6bb85e9b6a225aa63b9a5
-
SHA512
905336ebfc391987af9aad3a40d8919e9a87d56dd9eca914d5604e1130cb9acc5715596e4ae75c1ec2571dc493f287597888fa7234b4975cf42628ce88ee4740
-
SSDEEP
6144:SosMYod+X3oI+YWQDQrsMYod+X3oI+YTsMYod+X3oI+YLsMYod+X3oI+YQ:r5d+X3G5d+X3h5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{642411F1-0EF3-11EF-84CA-6E6327E9C5D7} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000eb5aaab09fce882631bb43edd70906e42780adee51a22b3e7dbbe7e6d08d114d000000000e8000000002000020000000ed698158af94652eb5b940b6c7f32979ffc541079e4e25560c708135c53caa7a20000000f1ca414a0400649f5a4e0c3d508369d893b81242e508cd42f5a655e9202ff02540000000fd65128a2aebee578d72b10450081451d994157f6ad8614aa5602422de44e7ab91e8a44677b9c22b54f3feeeee7abdb614514be2aa8d85da1dd92111bc628cb6 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c039033d00a3da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b0000000002000000000010660000000100002000000061eee7598172823dbbf5584927e98769945a09f75a62d935401b733f1b210dd9000000000e80000000020000200000003250675848cba96321b682b83b7ae4dcae2dfee73e6192852abca1ed3c2edb32900000005779e3d0cf32252316c3e32155fa322c479dd6b62dd9986e511733b7b1a9d6a3a0c5e513b7d830bd43ca7519d0bc56ab75c2fd77021c8616b7a31ebe965ca34d6be7ee9f19c829fc1655bc5cfe7b3a15512ec125d2908558f2923a30ca747870422951d96203a476fd5586e48c4dc3166941547e2bdf6b3235ad903a7fc34d842ce802d45864e1526a16f2f23c60da9340000000e6ec1b0eb5bdb89575a38d7cb878dd26c917c6b4f3e5833ece5de92ccb615438dee495946ec22e479f175480b09bfa307a7e77e33b3e5add199ac84dfcfd6b18 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421524268" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 640 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 640 iexplore.exe 640 iexplore.exe 3036 IEXPLORE.EXE 3036 IEXPLORE.EXE 3036 IEXPLORE.EXE 3036 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 640 wrote to memory of 3036 640 iexplore.exe 28 PID 640 wrote to memory of 3036 640 iexplore.exe 28 PID 640 wrote to memory of 3036 640 iexplore.exe 28 PID 640 wrote to memory of 3036 640 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\303e7738e2a334a38f63c0c783694085_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:640 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3036
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c099a8e70977a7b1775de35f1d22b55f
SHA12700b0c1b14b710a2f94dd489df1c586156fb390
SHA2567bb05c05f1e1ae13a5c8981c137485ccb37b1d4218ec284c641d47c42f97fe8c
SHA5127821da19f5af70267d7e741002ed7eb02bdd127774d165dd83a3d382b590f7044f8b3ff7b2537941347e8887c84520d32826a3e35f7f87bcde41a70406d42b6f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50d4a98e3e005f629e75a7a13829009c1
SHA19ebaa0dfc5eb431f2e09d3d14d77bdea1e503269
SHA256ea2b83356960e7372217aa5abb94e5ad02f43565211b4cdf6857e809792b7cb7
SHA5120fc939e7bc9b0224ff6553e190828e9406caf57ec5b6cd9e5b6e9080f59b244ce1cbd32a0f2c27de3ebe6b6636d57bae776138712322acbe00603669f4cac3ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f4e4cda551c23f15779811dbbf54dd61
SHA1bb5f20c82b95c336bc43c26e9c4812c3af5a2b2d
SHA256f3bbc19d7c99333419341c679de9bd36e1a8fa2f0071a992763d49b58f823341
SHA5126dc47daaf90e00e0e4b86c6271f4a67dfb4e3535400d72ae184d3fd4ef68485164b83119abb8304bcb8c84d304482a0bd894ef39dbd04e1e5694dce1a60b3234
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d93535d94f35c4d5fb4b0798cbc57bcf
SHA10c1eeb732488d3f091f70e7fbf2a745917daf2f7
SHA256039b1ce09dbc016ec44f66976b61d0548574de4ee2c30bb95423cd9657a67262
SHA512e1d2b2754ede1ed04f3a38243813f6c05d1e90bdd1aade905c53c5037473fc929dd075bb571ccf1e2bab72a552fba168a74525ba9d82041c5beb0c1a8ff88b2d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f7a80764de9b4141b3c609240df43a55
SHA117e00c3aa1122c87d588f328df0d6e6f9f54e21e
SHA25678978cf5749a6d8109ad4ac97168e129f73679b79e14831ef83a136c10c9fb84
SHA512b19d92d64a2cff15dbe58f35e5581bb8ba38cb862e66fa2e4841f9c0a2e41a6e22510ef97b424ae842f9a99023aba13ad2432907bac55a1b3df2352705eea3f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53fedf330240b4b0cd78b2f20c596ae55
SHA15f338e4cc92de67c6a9969539b2bcc25825a2ed1
SHA256d5822f8cbc2e18705d367f665647ad3d83693056894e82b1e30723501c0704a4
SHA5127415a2b2516441c863a4a133b769bb45bded0ecca5f62640e02ed5c2af250c70ad9ad7c6a25067a5cdb86d530f3012cd8caecfc92653840802d1bd0a62d71337
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5355d1d2203579e546464138fc24fb4e0
SHA1967dcc8337cdbc35a0c9d0d90f878f13e707c8a9
SHA256f22b63bca13ebb1332cce37a90aa7ad01dca7e416f9de23ccad72d8625cd6262
SHA51282531e4be6b44f56d0681940221096dbafd04f9657889626afe0ad26d8f41abe5203391d63ae245cf9b98eb1f8329c0c946a3973efe91c07dfe838bee51d843e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55984ecb056601691409140e50adb115e
SHA167c548aaa1ccfb6115f2a16d49db369c0ff2c27b
SHA256e47af8bc85d43ee02d0a916aeddacf45fa7d5239b446feb9d8b0d4d89f10823c
SHA5127eb5bff28354c9a904e517f73abf1696b4063c59b196d38a90c74848ab608f295779beacbfcf5026798c00e7d7b315afba8e9728f2514fdcf48548010fa9034b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eced9b8084e843c134e14ac8e813ee6f
SHA146a620c126d72167fb948363f27903283879a815
SHA256f2afbc8f0436dc718723b92ff5ce84ce500b565f30d030138375c2f4abe682e3
SHA512420064fd9ee026c42432e6bd7c40b40fc7c1f8cd55f76218e9fef9ea8a9d1d30e4c64a6a15623105b8943f23cd2eb7dcb12cb46d68396c6e3b696d13ec20b8d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5650e97bdff1ffb299786c29dec430899
SHA163a0d272e2b9f7e45583b66b2c65e19d16e8b525
SHA256380ae849bad24803053c01cf9c3f087d9b822ff0a321d2722d2ca00e4ee3689c
SHA512869c4f19072061bcf5c5b96caeaa02c94854ab58f17ba90c00dde2c9f4ed145fc59015b79a9c2d9f42f4d6e1a2521a11a561ca1c1e48ae4da701395e912f626e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD587a74ac2c532f4538f72cb6ba4b1e2f2
SHA1a322ddfaa8f6aaf33092b24c428d14d0c179d064
SHA256a6a1dd6cd2d77692d9ebf15a4ec5918dac558600bdf451113da14fd530f0dbe4
SHA5124e04db09d963475c128a6866d10a3f01c5cb6cea133ba1667d679c233da915e3108c684cc78281c307d7d8658a4f12820e90eabb3dad5c41dc6192e34df2bea0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b1a43f9884aa40ff13c97db3f07da571
SHA11f016954acd800137953364bc4a0014009aff3f0
SHA256493b7b753e1f5ef6c18328948225c4899bc5f0c1ebdb8908e37ae51175dff9af
SHA512671a7920ba3829b4b83c1370b4a9e85d0c6e685cf5d9104cae1a058b7134b9fed733fb9e974898be6e249f99274e58329c22989d290e6f7c2e2b2161dbd5ba5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD547b94bae9385d4ba056e5bc52a3db0f4
SHA13f15c484f7dce6791f6753f1915ab1ac8adba563
SHA256be917c8bd5f6323e40a76e25f82c0b25c68499c409eefc679463c2e020ac7afd
SHA512a8e4f58e87e810f45604867adb31541d225c4e651ddb953491678ffaea51aecee6dbd0da455c47ca2eb5c0e6bbc7d2160ed98b4f5c8d6411f5607380f72689ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d4ff68aa5e7ffefebdedfa72e9da4767
SHA13f18f5efb8b45a60c948df2622b5db7868dac4b1
SHA256a61b365c42cf6c09fdccaaff178fd693295e0315875fddf0906e97c16a94eb05
SHA5125f6b9d0cfad7c54b0837e2924a8404fb81b268838685401754ec2c27bd626fc2b0f95a58145e62843d25fc6bb79f165cbc8cf30308c7be955b10192fd4c08323
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56c75fbc432cdd380ad5a00f4421d26e6
SHA1df8984f7b6e9d4e37973838db3ff72c834798f2e
SHA256bbbfaa15cf65a4d50876c06cc5d437c14d64d5f733a2c66f8b5364ff7648a505
SHA512abf98bc530b7e4961161dcc45c9093dfe75bc0d365453472491bf24b183e9f834da82c99fa4d53e5926ca823824b40888160ab9572cde2ea52eeb1ddabc01cb4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5297fdcace502c9a30c8761a53c3c4c36
SHA1e0e16aa996a7dbd5c792641720ea9b67abd92642
SHA256a6bd7e2d3765cea576dbadd2c5769d949535c4d717705c4b6774258196a23590
SHA51280bc2e25e72d4af1a4a34fe31386cc4827b7d3ebfb69c0c3ad5dea7e180fa9dbd69c246e2a281cb6118657ca95e1b4cd60c1bf2a3e8acb7fa9f7c9a2216cb4cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5183c269eb7a9f413cd96863b11920d49
SHA1a27653b27ea35cafee6fcf6afdf3c07c1917c632
SHA2565607bba5d1960e819896f4ead8a9913712a529ace24238f287c1bc59a0430061
SHA512d7a6e2ec6de5ef05a7f05ea8daf29a6e528aef9297a7b901f446c2ede8b58b9eddd884d946170d75551d3ecb9841046cc39aaf566558df0bcfcff54772e2f197
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b5b511162c82edefa45a9676505650d5
SHA14affdb3a4e23beb49fbc1dc01580bd1006047202
SHA256ce646c9fe04051f75bd5ec33ee26877d03f3497581ccbc7fea72b79fc22249b2
SHA5123be6f24b369ca72c8456cf4cbded37333a9c859c8660b5dcc6904fd130a0c42589e60db5e5a77193f2ecaf4278773e23389ab694381a5d4bf44016a8f923cf35
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a