Analysis
-
max time kernel
121s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
10-05-2024 21:05
Static task
static1
Behavioral task
behavioral1
Sample
310ad8871cbde2dce9bbf272f1990435_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
310ad8871cbde2dce9bbf272f1990435_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
310ad8871cbde2dce9bbf272f1990435_JaffaCakes118.html
-
Size
460KB
-
MD5
310ad8871cbde2dce9bbf272f1990435
-
SHA1
c538dc11fa8ed284343788decfc77341b05dbdd9
-
SHA256
eaa827998069533eeac14704871042968a7f2f528196b57ee582639a3c845956
-
SHA512
8a6f46ec5a27e5841a64fd265850e2e7bb68a732b5ab7969b3b55a878c2378336b8e3b0e19e6ad1bb73684f9f8d71893d329a046cbe9c89387d6ecaeb4967d95
-
SSDEEP
6144:SzsMYod+X3oI+YDQhsMYod+X3oI+YUsMYod+X3oI+YLsMYod+X3oI+YQ:y5d+X3i5d+X3Y5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1A656CD1-0F11-11EF-81DB-4E87F544447C} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000004554c59a403e674d0d1440d2aa246060c51639223569df82078585d4421065a3000000000e80000000020000200000007f102cbc96085f778ae66af7c291fc708ff746211176e92ca086baac85e0c0c5900000001faa69aca0ce5ff51fc115a6dd39bafe47879ce40ca71fb990f03bbdb979da05cc8dfdacd1f322701ed2d3ebf2e36d0610e6b634be44018f83ce01fef148c5856c6f4e6379f237fa0bf9e9e0455e7bf203f90d2d4c575626c3fab3599c0ac885220747bd4b7e319dfbd27d000dc34e1203902bd0dc7cec447475431e01f498b5a52875620304c2cdb799194559fe8c2740000000954c6d34869bb92334c92c3f148174ef60684c453fe27217011bc25961b348e4a3c1692893f5df9dc457fece2b6150005136f10a9d978672a08234bc943f182a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c07bedf21da3da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421537028" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000004c69b73df468cadf90de36d420e087801e3391bc130743488a1b8e79f2daa01000000000e80000000020000200000001978cf7c55418de480f18405e81c3d2b1845a14eb3a06f6fce9fe09c4cbcf14c200000003abbe3ee15492ba074fac70eb994f193db73bbd3b111e797de462efb1ca29df8400000006a9bc03e591b41e6d09869c3c9045bb3d8ff1e1f7c0a5bdda03593ffd95c15c311ad909b60d01fb094b200e7d7e3a6661e4779211bafd0463eb9f1dfca51e7d2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1744 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1744 iexplore.exe 1744 iexplore.exe 2112 IEXPLORE.EXE 2112 IEXPLORE.EXE 2112 IEXPLORE.EXE 2112 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1744 wrote to memory of 2112 1744 iexplore.exe 28 PID 1744 wrote to memory of 2112 1744 iexplore.exe 28 PID 1744 wrote to memory of 2112 1744 iexplore.exe 28 PID 1744 wrote to memory of 2112 1744 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\310ad8871cbde2dce9bbf272f1990435_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1744 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2112
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58ea08d3b8a0ec02a3a335d6e5126a898
SHA1d3477f4e4f1771f41b007ed841d1ab9ad685a0cb
SHA2564d2a70a0e834034e6fea0940d4f227108d423613d6db955e2e4bd2a1f4126315
SHA5129ca2377d3a4ec3b5eb903790062f86dc04f6893e305b381d8ef422b89a5002984cb1e04534fe114d91c9047130760eca66d06e46fbc6ae576b9cf61889c98581
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a2219168dab613a4156f99517e527e84
SHA1e542da21f856fb315a65b667d59d7136f8532a0c
SHA256dfcf90a410805aaf121ad460fb76c8e90e0c3c961346e95b57fffeb4c8ecd1df
SHA5127fa7f8dbff6a1afc3307cc9327cc980029cfd453367e300ba5c6e39fcedf35b50f28711937e423b06b3d2614f7b650d124ed01d9abe4d973d26c560dab9f25f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f20b44b0c0276f9a0bf361e881e77a42
SHA12bede9ea7ab6cc87869f753dad4d87e981825f63
SHA256849236f04934322f233d414beb5ac0406273c47069ac20ddb060253e784f7077
SHA5125ff66aad339184adf4c74430eb0f89f52c87ed15fdab2c33e44d0f5bd12170c8a76693ad1abf4ef1c037a1f5a4622d9ac181372ca46ebe6f1618a70ad6d42b30
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5002df6bdea0d7fb12de7e1c0edda2d60
SHA138ba95bbd605dfa882e6f7a73206f611819faa21
SHA2566952fc59ef33edb1a8cb49e3270f7dc57e3196a06f846760ba6dc47f824792a9
SHA5127339d423a937e9dfb0fc10fe66cd0e4ea39cce21cb7728e66566455fe684a89037b28bb542b5287c597a9c3516a714f52aec45a19296dd44aecf3f96adefcd5d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bdf9f84eb5ac4644a6abb91dfbad1943
SHA11be1e59619b99273840667c9626c9ff8372a96a0
SHA2567a54a536f8e8e2527d4fe4e50e7abe2743da63c5de419fb79bb26b285de89858
SHA512194b89fb9a4ea00a3110a948d4471b49d61dc1d3d00a46ced8838bce6ac6e31ff15025f7adda44e5961ce8d2a24d136d0b61f477e69f89918bdc9c87a2cec421
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ac6b97fe732fbba9204f334cfd436b7f
SHA19cf1be32acdd9417dbe75c33670c53fc314cb7f5
SHA256e2125e9e9bec3495a07fc2a6fdcaba03474d4e711f241e6c6eb04c63676a8a42
SHA5125e91a23fadb1be6ca8dced83bc7ca41e729614c26b65f73f99e3bacbc2af68761506a715a72782cbc22d88a48567f25c7fa6e60697537f72e76b65ca871aae8d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD548249fa222fe69366e456537d44226b1
SHA195341b88519d94222e04aa32392cafb640912a71
SHA2560c21e53d06a468cf380569133117370f1a26c3ef5fd5eaa7e67dee92807af1ca
SHA51257a2a342f6402a86451dbb7c12e5da92c4ab1a921f9a497311b14fa5dcca187d1d8d6bc1c6925d7668765bee6716a33f9c361e8072185da510328b8e4e66ea50
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cc0bb58641012fbc3dc7cde7dad96cc3
SHA1201f5b81b6fc502a32b4e7b1b41c6818296afe03
SHA2560f2271b73dee03918da04717a1ec650252d6bc7286ea5e67c3ff1af2ca6cefcd
SHA512179fae20d4284d43d130fa0c2834e237c47e480e5ad35e1a9485c892623faf3d80f0b7388280ef4810b222e63a8ecabbe860b1089b61766d5db9c846d8d20c51
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c2303bb137ec399328faaa75a2af96c7
SHA1463d0ba1d899447167bbf422ddbb2637f5dcb66f
SHA256000ae64403ea285908f7d13b8baff9fee724c46fdd2f092f80eeb5f8b378ecfa
SHA512419a4b040e02fbb1f4a64e0e63e0d4a10841a734bad70331819758ace0808d293bc725b663d8402937b3b3f8db098934eda9498a52c79484eab5ed0083c7acbe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c43dace371f1253db025bcd537d1a27d
SHA1b9bc9972c7fbf1da5a64507f623ebdf34a2dda0a
SHA25675891f52e5476b3fbd7352480f2c5d625f7bc13dbca6b1b4c8d1446c9d82658e
SHA51272d25bef4401a37d8f8df2ce47e6d0d547e5b944b2495d112a1f347a10649117a2b268bbcf85aae68521ea7e6d23576c191d18211ca2813b7b2395f8cf865d12
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c532b0e90b27db3ce492cc5dd438a556
SHA172ff4ff5dfc1fd40c9991299fe756a9d25c3d999
SHA25659d8d96d36b9d617233d02e75524e5400fb9e36725858a87c9fa1abdd92c6bf8
SHA512bd9ce0184ba533c586d2c08ff4c1c9b597c65fc4da11973750f1b3019c8025207ce17e4458705bd3fcce8eff6e502990f567296aed7b1a899e6d69a37ced2c48
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bc92a6327576338db8948411086b9132
SHA19973075bb7dde3c22815320699a8ad05b8c3f797
SHA2560dae08093079629b73a738e3868093a96d244d6a540cf4772a9606b290925de2
SHA512b5a688c763100393b4fefab633e4e900a90f274950447e690158540c7e765aa5c31d55cbeb7e82975e85555e9482415fde0efbdfec62e6930c4d44ff8f511092
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d4dcf2c15637c0dad3fd60e758a3ff8f
SHA14593167527781e8c8674482772bbd093fd610b36
SHA2562289aae9ab81c148f9b283c3d859294410258cebcd406db27552f1aab3dcc115
SHA512551f9ada17bf825b2fd90b84334c2858e289df875a079785ae6ddd7f9248ca11deff59227b46685c8d44c0aa07e64bed30b794e63bf7c3998e0a8394caa02233
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fc783bd3f5b85edd848b9156ae204f97
SHA156cf838fee94aeb562dade1d968b0678de61edaf
SHA256900ca52dc4b231fbd08ac47344a549aa05d446c25e36da75d3b0299bd9402335
SHA512ab84e76dc39a46a22bb1cf1d73187a090dcf6df19ba383fe759b6ac2b8d2a6e4afa5d3a1dfb9d92847c40bab0f2777ff4e74ea620bdcfe92d5c3948544131e36
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD572f5e0a9e7ef8ece1079827fb7f5f498
SHA1c3fcb90bbadbfd32e189c13173d0d95e57b548a6
SHA256766489a5803953cced712b4be1e1c431ce2462c519b23a06079b4228a6dfabcd
SHA5122e71079553090c581630e72772503914a931ad1126f08c9987364939ebbc21b140f1ffc3f00f09433b30004ae749a963a38b245ca31a6ef4335dd68894c9f059
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f59cb489aa393bde0be3d38a184d1bcb
SHA19f00e33ad2fddb2f2f8087fbef14e9aea1f25e6a
SHA256d52906b52d4825159b7a8d1d887cb61dc52299eb8c06594b7ecb38a4ae13ee84
SHA512ec0f4b6838ce0951b987741118b561511d9566fcc1997babdac86d661745c27fbac5a0f9e7c819cee2828eb45fa5d02b31e206b3a6f4ff85de476125a6544e27
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a2729b73ab4d12fec57578c065ceba36
SHA1155f094bd8a1fcfb9f5154da76fc53580c784a55
SHA256ff36f9dca782f6b1b0c68f17fc17a54a169b66f8d9f90c37a07ab03b0ba88709
SHA51209d1db479f1584db442e1cc64780348a884604da0849567faee11cb221ae286086cd0e0a71bba69e6a5a846e20a13257646fbb9ecbb542785e4938c50d18d96b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f3c37b2049b92ef03087d9c746a6e2ad
SHA135b78d567d31bf252c76f5ba0f6ea99a711514e7
SHA2568789b6f7b182b98cfd36f61a45593e2a11b1c6a593f9210f2ce080bac224392e
SHA51257a620c142bfa9247a72616402aaa5f59996ab17ca872ca38a38971bcc68aaaa6794891cf19a8a4cab7798b5d087ea90aa63691b2549d65d46a90716f40e1164
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b5f5ddfee53582a68be8209e7e9e9f51
SHA1b159fccd1a64791a7ac42af53af6cc4939f1d69d
SHA256b5dc1163f7500b47b11397c8ee0e621f3af22b1e452de5fa86e0b56e48d23717
SHA512a5288e4f84940ab7caf0236d780de8c662ddcb2bae1d6323327149eb2e7c048ac9e15f6c93fd8650c288ad707541ad63e957a3da448f3db227db2eb2b9723c9e
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a