Analysis
-
max time kernel
133s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
11/05/2024, 12:05
Static task
static1
Behavioral task
behavioral1
Sample
347f6bb08ce5a88044b92c03b655d725_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
347f6bb08ce5a88044b92c03b655d725_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
347f6bb08ce5a88044b92c03b655d725_JaffaCakes118.html
-
Size
4KB
-
MD5
347f6bb08ce5a88044b92c03b655d725
-
SHA1
8aefa6510f038c28d386575bc4b87bd90eef0c53
-
SHA256
8b513c247f536733e41a7c74d3d0e36c1a2e0086775891f692fa8778eebe1fce
-
SHA512
22bd674a5a831e8b1facb97901a9541037118a7a93a507c691a93e6723655a2c31d9f3d6e28f9701428137eab09a6bd5b71e0066d1d1dc71be94ec496caba039
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8ozwik+bH:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDO
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000df2fd62d0b7d34a9b2be75dedf7183c922f6d452a83146ed1e3145b0d97ebfb8000000000e800000000200002000000047473cf5e11350922607932015d092d3404cc7ea08e540ef257a12e77c4aeb7320000000eb4448a4f86c936cab228ed99ee8aa7ad33d6cada79585a247bb4afd11b19ff340000000a7278ee0bb8e64b4e48b09c228c8a7c97728fe9807ee8ae8b125cfb9349dac492282ca224875f39b5322346a2649eac106d7f4169460027e56c503608a26ed34 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000426e510e30df9a02485c8ce5d101a2ebfaffb7d7d2f7dbf0452c3571bc3fe0cb000000000e800000000200002000000047f258d58f1857ab002b64e7c0a611a3a91f2c43ab67d1c9b475e7280487ea59900000003a32dd6aea017b5533d5e18d485b921e3820d2b3dbc999479f54f2692acd7da8f5b4650d769f8647e849c63e9fbd548ccacb511f2001c1555b9bda0f9be8595bb4637b76f4c44157feab12a9a3660b9e9e676374cf6652f4c3b061e3f0ae9bc25acdbc360dbf8ae4d129b897fe400692bd122892a4ff5c949ab821646f90bc6f27d6e75e9d244a01d5381ac38d4e193140000000a5b3a91201e356bd2654250ad6dbe9633b98ddc4c20febcec664198a945cb7697570c46caac541e888c90186b8a55735641da619b94e43adc07f8782dbea233b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B69714F1-0F8E-11EF-A596-F62ADD16694A} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421590977" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0691d8b9ba3da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2356 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2356 iexplore.exe 2356 iexplore.exe 2584 IEXPLORE.EXE 2584 IEXPLORE.EXE 2584 IEXPLORE.EXE 2584 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2356 wrote to memory of 2584 2356 iexplore.exe 28 PID 2356 wrote to memory of 2584 2356 iexplore.exe 28 PID 2356 wrote to memory of 2584 2356 iexplore.exe 28 PID 2356 wrote to memory of 2584 2356 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\347f6bb08ce5a88044b92c03b655d725_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2356 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2584
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55339d3587b37116530da06cfe2949823
SHA11dd8c25d0a98fb453c576409dbeef5bd72352f16
SHA256e75c68d73641480b0527efbbc689e2beb28dc29bd4a9ae1169030721a87c8636
SHA5129ef3528f5d6cca62764fc51a6d1aa2e6f4c012af95d514afacdb509ce2c975842897d5b67a3bb9352b6ccb10d5f212428001925b963fecddc270f2b41d845a7e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD533b4b8a2f215355728edaec6b5f8df44
SHA1e40970103d7a2b0fb090855668f8b9148e2270a4
SHA256be126490a67037b08798dac25932a3c699ef1ecadb773c50b74509db7f117c57
SHA512759696497094b42d85c12ab4838cfc91960125a4eff12c17f8ba08e6632e99ec6f2effb7842b74c5ec365d22f01d7a52039726865d71583ba0e7202af3f27622
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53e8c1f372a4977cabf5af41b925b796f
SHA1769950c1964c1e0d0fee0cfaa6c3d7b3aa209726
SHA25610a4e59e01d81f1bb83736ea460c902da30aa42d92d457d6ee83bcc2918ec1f6
SHA5123dec52160b3369b9a2f76792e0184154f77f0e7c913992d6dd4f46c0cb2b6eed886773a179b0028a8c9aa805057df5ff3d4135c3f636e5a539f3d190669b1519
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e26359cb99af4071021aceeec1ab97ae
SHA1b3b72c85da39c91c132d37990241d43c2a94c42a
SHA256ad71f2a8a825e572a577579fa09b186c1f1a532d641e75a39188130f51a369e7
SHA512336a11ee0a82e9a17d4e7100be821c197b9095326ac962c08222a62da1c1ef7ef671c53a2287b1bf2e42c76f35e9b8c1af40523820af0ff24029a8af845c1ed0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57ce96f7fe9be9ebd2ed5d12ac9a04bdc
SHA13c3aafbfa5969652d0619c9ac9132f50410baf34
SHA2569052bdd90e29cb8598ef377073885de024c495feb329eda261d1ef86780330a6
SHA512b1575dda54e5c0ee37b48a764e271d23f6c9cc49fda6ba893599eb138c989847b60738dac0516ab3773a36ae0849d5a9fcb113be965f0173e07098ef2ff6cc65
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5617333de0cd742ad76a5b9b53b66c9fa
SHA183e83ad9ee3e92053a4d19b591ff75f025d1f6ad
SHA256f1f3bbc60fcea407666ac87265e5d55e25ed2e1c057d888a770b384519fa8840
SHA512e631a6e00ac4ceff067127d2094253497209bc159b3c689e168932ef41917604363bee90e0e20378c7a00cbccfbbe9f406a34f808ee17e0fa30543e76f24dd40
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5afa1e961d149e033f2e78b24cd05e618
SHA1a29d2b478e45be9739466570c1f72f071c730ca9
SHA256bb6066cbc639ac9e19ac6a56c836ea3627e1ea47bccbaa86f0e6131b6f317755
SHA512d4a93bffef4395f374f3c54a41c7b74f4cac4ebf8ec96ba306c2f588def72ce33e372f1e387451d79f7e7dad98bd5326fccbf01fa7f771ca3b91a0e97081f34b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ceb21830da51b7859ac3ce1007704c79
SHA11d2f025952dbbd91f64f8cd020cd109f949c4ac7
SHA256d3d76124e6f87a99cb5002765038f1c4f076d303c6cda3800e8051edfe1769b8
SHA5123c728024daa50a2705a1e0566e134324da50a9ff8b5312f0f0245aaf7fe7e0fb6cf778d8a9dc608b331a2f7c5183622dbd2088f1e509810a60d049a9ee81a9eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f7f360b79af3fc9ae7b52765ea8f3420
SHA1cb8433ff1d721d638068709064eac121bd37de6f
SHA25649975578dccf317c14eb9a82f46a2198dbaddbdf912fd89714e73f051da059ad
SHA512e4f1d50eb69d86ab7dc827b8b561f3729054c29043c37ed0b4a4f9499235261ea7af5c9569cd1e08a4103050d513a9321f01a7c9e1eaea170ece1bc0804add29
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ea7c7e308d8bc8a20ef8e10417538e91
SHA1b6dfd9156b042faa8c1910252807564f5e46b81e
SHA256ad994ba7a04803348b24662d6ba6c4a85c3160be25521fa79a82a1966a31ed98
SHA512ecf4f0b65626b6e74c7919d787ffb4d68ab64cea4f4f2d9f9d4e9af10bb10952a3b1f598b17601c70da52b2266f9ebbeebb0df4ebeede0141aefe263a99b7963
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5488603bbeed7523560d3612e356c909d
SHA1e1ca2e7ac6f7e3d59c481678b7d00d5c174fff76
SHA25642b1d175d1cc5e4b255afb14deebba1c270e2072de6491d3344a596c09c9c9ca
SHA5129850d3b355d99eea512f118ed1b228929a454def505343e2399e4203d7b19e0e1e6d2d74d86a000d059b929672e9aac88fe5f1653f034de20088737a1f5944bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ce141f6fe742d2946ba814ac2043ff4a
SHA1ddc185b8d49246ce91833eb2663e3ba65b3743ff
SHA256fa7d2f03ed56bc322ac6af45b72f1f9da8fa7a24cfb9ab2953d008a96393a94d
SHA512d9c8affb66833fd2388302526b6cd9a9fafbec2105f09117dc437ee5d5400b3c5cfae63d5c4f3424672eee30db822f8b150b853c2b698f2c80c5d06d8e4c0245
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ea9b82f7520a0c9b1e5c48b5f5bfee62
SHA1a3e7f173edd40358bbeac7c1d0b300d194a4a56b
SHA2566f4f830874990dc6b39aa1a137761e12c9b2074a1e963444d4a29d90aa5b2893
SHA5123c64da8926a8b6f5521c6807b08a7c3958a6de8d5687852d960db99f44146d0d24f09621c18cd4b24cb731ba5d4afa1f442207aca651feaa6b970275ab051725
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57e8f4f02f5892096a013e6f341c1e593
SHA12891eba7b44e372570d08c3e783d4379d89a5f64
SHA256e843486e64454f20b7516c4a35146913553002cf3a71a184b380ba53063b1baf
SHA512ea1b5c2989e7e7c47ffa50eb011f5cc6312ff78afd4fc470911e09caf35adf4509d4e71de23faf7c24e3f52e566d43a7411d75e555cda5e0ca6a022d0b4f47d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD590a4c812e0e2482d4ef3b6d74b039e3a
SHA17908c7a7da49d34d65f1e8ca2842c7bb68c855d0
SHA2562af046efe2cff620dc4725b2bbf3711488631c79b0ca5e93ced909aacaa1f32d
SHA512e7241a28161820c0873ed1e4afec5271416f2085fc684d9631b1c66fbb4f400431f01d1d4fdfd7f2d13642a955ae7171f51521fa16921f1ffa3a8d153bbc2b29
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5800d61ef6c8d851a8be406eb48d9819f
SHA17705ca6c90b1cce7b0d275fdce38a9d2ceca65d3
SHA2561fc2b2e96db0e9814e5470cd0c89b04cdf79408c29dec417eb8dfd203f096257
SHA5124177a06230009efa0e38e0885b4aba2b8438d2f5d48104763de9f72287302f8ac413cf11abf11ab03acacd3a935a318c828bbf4c04f2b5075cbf81880fa702cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59202792255fe8401e7b90e3f7263c03a
SHA1f6aac9fa40498ffb85fee7d4da9d7be82b5119b0
SHA256827998c38914b6c75ae0da3d2848fb01d8ca844a4baf81b70973c98817291d4a
SHA5129bfaee4c022501a9d4ff4b92f074924bf227e76bd906ecc68ce1c3cd045222eeb12e690ff21bd578e6816096e36327a68776de40a97e8998cac440808c89ebae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cf7d8057939bffd844d7fe908008cde0
SHA141bef1409a7b7426db7c760e040eef45d4654fdb
SHA2569435eefa0e11840a48115479e7b5c9d9bac75cbdb831d03aa9b28bfc8febfb2b
SHA512c86b72aa49fdc0ae3b51ea6fc3bd30445bfca9e9e66e5ba2f560434cce34877ad9f21ea4a38684655e9cf8f9cdb7d13332ff77200a63fcd55b14334be79e5d2d
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a