Analysis
-
max time kernel
117s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
12-05-2024 04:52
Static task
static1
Behavioral task
behavioral1
Sample
385ab2390bfeb8512496cdfedfa229aa_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
385ab2390bfeb8512496cdfedfa229aa_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
385ab2390bfeb8512496cdfedfa229aa_JaffaCakes118.html
-
Size
461KB
-
MD5
385ab2390bfeb8512496cdfedfa229aa
-
SHA1
5a2693ad9dd6fbf3f20f6e46513ffd7b3c32c347
-
SHA256
d18368773e23601c2cb96c71ee5970eaa5aede20a7c61b7a47e30543f9999adc
-
SHA512
a85731b1076156ea6f56163079624d1fc51f1ce866d26e171b3de897e738d5397c72f7a539fcbc747629984e8a5619e8e92361e18eabb8f88d88a1d6a3ccfd43
-
SSDEEP
6144:SOsMYod+X3oI+YfsMYod+X3oI+YQsMYod+X3oI+YLsMYod+X3oI+YQ:d5d+X395d+X3k5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421651440" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7C9362D1-101B-11EF-8C27-FA5112F1BCBF} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0e86e5528a4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000f3eaefe56c9db79e1702a9ff8f40f3954c328bcf4aa15740ddae4b28233fb8a7000000000e800000000200002000000042e04eb3c21952db1af2146b053038c37d001524caae1d5fa6b7fa68cc3a6fe190000000eec395e4ddf30f498e7fa47cac194836ad175ff063391464683bef53434ffd58f2a81b7a692aa34764493ac0caf830517128552ca0a1931771439e95d3e2ddbfe602b40956ac4f86709c64c1bbf9e50de0c1ce4482e3a607ec8b1963fd7b18d02860479c4dab17ef544602f24ee57ef3c4bc48c262dcdc493915db353978b14376dff1ed63bce15c4aada2a6e8a04c164000000025dfbeee04bdb08f45524e043279c92343e969935af457e3c9839ee33e164e38a815438ac43d4b8a10c76795db961e7c21968f0fa3896995a29d001b05c0cc8e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b0000000002000000000010660000000100002000000088e41e17190d49ac6d968534028c2baa0db17f3cd5da690d85d8af1692592f76000000000e8000000002000020000000c9af42a687cf0c111acd12b496fc573cd4b1b018dd4b7b7dd5e612b2df4a14f720000000120d1ae69934fe0ce1994de8cd1fdabed92a657c894612a5a44cdf189d8209b840000000270d265867b4fdff2c341c7f3c8b183808886f40bcd4668c0c1cb938f465e8952d42a15c8ac16c19928a16dd2d6288f820cca3b944ce8b01d5f8325ca1d896c6 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1760 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1760 iexplore.exe 1760 iexplore.exe 1296 IEXPLORE.EXE 1296 IEXPLORE.EXE 1296 IEXPLORE.EXE 1296 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1760 wrote to memory of 1296 1760 iexplore.exe 28 PID 1760 wrote to memory of 1296 1760 iexplore.exe 28 PID 1760 wrote to memory of 1296 1760 iexplore.exe 28 PID 1760 wrote to memory of 1296 1760 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\385ab2390bfeb8512496cdfedfa229aa_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1760 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1296
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f4a3ee539bef7ae959aad5889063f847
SHA1f2ae600c5d187d66f92db379bb0a5243702459d9
SHA2564bc76bac9debc1f40dfa368bdfda88cccf14c46c8cf6e8d125acd284a58875e1
SHA512b3da7c306389d028b6505d78da767a417fa3fc2730aa6a5f2e2909d253c7916b6e5356907a26667fbf2d3b88ca14aef06154a3ec1a2cc034071d0cac1f43bbf2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD509c8d0f4a213bf4c8ac5078cfb84fa87
SHA1bec185fd93d26a93ef234424310b203f55cd8621
SHA256a145171fdbc6d57760e51fdb08bf44f130fa264ee074283379846415faf2b608
SHA512c59ab6e4bef1da181acba116fdf380f0862103d3d17b7a0d45859d36cc7c4775be756bf13eaaa36b341e0c80b6aa0fb2d07160df94a08520f0a7ac8de7275a20
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54e5af6ef0a2af87bfbfda9294d92f14e
SHA18d5f687b233e6a4b6b602bf5cbfa1b5fadbc8770
SHA256de5666fd03a6bec8ecde88ee016f37af822684f449f17fe594789de67f19a816
SHA5125b6e738bec861d3a3d16ad94e3ff488a0f83352ff5205fed1560f1a2a6774437f0a0a9ebe8f1cfa782f893f4334faa4d745995bc66fd0a3afa188dddf8bced61
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD528de1a812f0d810d44bc1dcb64f88612
SHA149ed9a32eebc238373717ec51fca39480a4990f0
SHA256778224461dbe82f714986bc019307b3d432960e384cc11d69f2702a54b7762d2
SHA5125695b34f8762ca4a0f44e37d8adf07f944523f62021582670cf7b120dd6ef55e66e3a9b5c8945e26aba4d9f8e2989bef2c9debd5a0b2f4525739857b2e1d375a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5427311e53df8d8f6a4c667a850c0c67e
SHA1eeb40d0a43f3ea05fa5cfe484f65bedd533e9580
SHA256c4e7200b2a75a8c837ace990ccf55cf7972ddf7eb1e920f2c4cffa4852db7336
SHA5125cb19217105db8d4cd602e9df85e5b73a542a9af047e382f184f63b62befd7478294aa629f0f47812e39a5e70d39011a1607293a7c944a8703f8e35a411465a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a782b7c31e791394aa3fd9d82c8a7629
SHA1453c4414a7d4fd818fdafa925a549b2fdf9a10cc
SHA256461c12e5f6c0999d55e7d3625eb6f818a5ea40b06324c9d7008ea21b42b8f270
SHA5127c3609936d54a2adbf9694f5e4bbd64f750ee1bce9ac6740136844b841f2efb8a340e2efb66db78751cd0ecbd7ba276c264feb80ea95f5221c981b5b858df3ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a847030f50fa6247312b69ad8c6540d6
SHA1b3f6b61b036856fbb441c7bf0ad900a625b26fb4
SHA256b4d0886c4f0fb4a6078b5ad355441e1d401fd185539a579e89bc266e87301b72
SHA512004c8d1894bda9eb828e0fbbddb79763b5518081b4a7032dc09348b7b6a3381455d64d3dadf974bf5616db56b52fd5466ea6e24fbc9ef8065c4a7841b153bbd2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f5618ec4e2ce1b53729e8bfcf613266c
SHA1b692dfe7a0f2e4d9530c9cd5ef616ce2f0eef635
SHA256bffe75ceb9cd93d27c3c4ff4cd9b5ea3e45c923a109f206804a42f716fa382cc
SHA51294d942df808c7663d6ab233cebce7e4720445fcd99287a3cf1a240628b09b9b9c90bdfa49ff09976427ac89b5c3839ba3de35febb9040a1b0fe023363b3166a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD545c77f98cdffe736ea232663acd2b3ac
SHA1282d78d91098d599a608f5e596240d05e8a08450
SHA256351d151f99e16828bd1deb0ca4d1a5df095755b3793c8048af089a08361dfaae
SHA512da7978eb61b5eecae71f34997174fed2c1d2edffdda0c02396327324193ae70e7934d01b45a0c6d9788fbe6bc39dcaba57c585aadaad4432784eda17076e30e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5875fbbd9225af5f5888a1dcc8a3f4990
SHA11e22af52c9b111cb6d206f964bdae3e32b802c78
SHA256648546ef0e43ed724fe49ccdfab6d027c02b709b42c620dfe219467039721182
SHA5128544526751c09b44c5ff81afe11931758a6d4abf6c8d7dd9997559ca0bc7e9820f60f865e80154e2bb2e845425dccd4d892f13e3e41f0f5242cba321fc864d2e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56bdb271565c5655cc775a5ecf9630193
SHA13d533b1b9e269f9451fe2eaa7eba58303eab6395
SHA2566dbb406eb04bc62e3de6664ae33d960f1405e3c70b4f2a9e2e00b435a98e3385
SHA512446f846ffa29b37e2811f7acd8b839e7484307ecfaeea01e4a176a02092636745482798c5ad7b80dbd9ad57e0db24e0104ac1526b202a3bf4ad8f397daf58c9c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5986db6399fa42ba2c8e8c85d54d6657d
SHA1305e8d02afe3191b4e373d048ace54a05e035474
SHA256e4c99731afc392cf7cf1ff47279d1a5ca2d7cc90e1ba5e247fd9ec461b0855f1
SHA512f901fcaffe4ebf36d0d844f2894785522d808938f327105bb5771bba78358dff188b2467929c38bcf1c4b074ccebeb0ae9835db408f467e566e3a94188021f67
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f70bd4568509d7af87b7730208bd397e
SHA1ba75aed82d8bce35a666032f889d98041ae55843
SHA256663e8d232a1ec16cdf913685af9faea256c0d991a64c3afe6bfba962fe94aa71
SHA5129144225b3b9699b531eaf2e8ad477350ac7d00c36826d48a64f214faa939cb233b72e3a87fd81066faa71acdea76c59608da11e3b9337ff2d0349eab49a0eab8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52d150f690a3c061f24012e4ac5284198
SHA13de2821aa51d92387a5d0ab8df2596696ae0cd0f
SHA256fe6c3497fee4085b39ffe0c2b82ac4bd9ef37980ae718c941b31e2d2bbd2660f
SHA512ff3be53add0e786d51307953602e90887b76bd0232657cdad41b3a6c419d1dc2d466b7b9960bf00d180619c1526130d819c9391c389c43e0315967a0fbd4eb23
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59413319eb02eeaaae28052b9d418478e
SHA1bbe3849a8c69ca5096bde3ec7ee0af5cfb9d5f23
SHA2562dfe37dde91d4fec252a1d9cbb64c354e83600a4d01c423d396abb225177aa91
SHA5126f728e2f7e30572624173e475b48d7ae0e00dc497c8aa40483c908a654ec4d99d1e07fad1c684541c19897f47131aae2fc9a13aeaaa5594af902a5cdb4d0cf97
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c58034de4d950c3f7b527590716ecdf5
SHA1a6f31ffa44aef395abb40831132c78e54ac9844d
SHA25699b4af047003d70ee7c761beb60b50833465217ae91406613b3b71c4813a3b79
SHA5124a0abf98f0f1ae2cd363e1056b2ef26f3ed1435be5acd7fba487e935a23cd0e61dc47b8df8b1339696104bb1f588bbd143cc4834b9949e41654a147f3d1c3520
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e07176279daca5414628e8c5db907931
SHA17b6f023c75a5e92938a5a471843b18d490babfeb
SHA256678d067571b093d31d438c7eaad42c05db9461a3f5ac0421224709531668f7d3
SHA512c9a5d594abc3d92c48a088b5a4c79a141d88b4684247e09fcac0af1d777448b734615c43ef1ae726565fb654da5c6804d0d0c87092c67d5cf043fc8a38134c67
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59c9308bf3a1cbe52bedd6e2b31be6c26
SHA1ee60436fc55313f4e4d91bd846d998fba98fe3cf
SHA256213e1d96275762a201de41ab4bec10553daa25ed7da7e6fe90202e275330d840
SHA512dafbf84c882b4161a2d1e083e64ff5c503d9a70675a71c64693d97909de58414cce3a9547873cce997c7192dbf8070d8e7d7e38d3906207e53ef56d11e806db7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aa1bcbff9c6805c5b9e57a1955734c30
SHA18cc17006626b1271ed7a20716f9d8dabaf5db669
SHA25695e2347b9ebccf07ba5bf8336ef3c558326dbc0c87cf4478cbc2094a6e62b171
SHA5124a3a160310081fbed2c48a7701c39dc63af7dd8696bbd8e6908803b6186b1d1372fbf0f8d5fa3de8660d4cd3b475db3af848da657c28033e33e72ea7be21c4e8
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a