Analysis
-
max time kernel
120s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
13/05/2024, 15:25
Static task
static1
Behavioral task
behavioral1
Sample
402523ba00adde29ba6af387ec330266_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
402523ba00adde29ba6af387ec330266_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
402523ba00adde29ba6af387ec330266_JaffaCakes118.html
-
Size
16KB
-
MD5
402523ba00adde29ba6af387ec330266
-
SHA1
70fe3da782e498fb52133bbd50689274ce702e41
-
SHA256
5cf57bd418813e72d528e6827c06351e23cfbc589ce5fe57f6c06da709f65ff8
-
SHA512
18ea1f969830d716430869c91c27627c20dc652c8f9297ac2d89931c08e9b12391a0f5a057440f1fe4e0005c2998b7f3ee6b31929cb0e96a94680afc5a93fb8f
-
SSDEEP
384:3lO5SCKCqDhjinvj79IAGZzomaQ/vTrD7HuT3Qjc:Y5SFnDhjinvj79IAGF7rD7HuT3Q4
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421775820" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{161949C1-113D-11EF-9BF1-5630532AF2EE} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000e315c59d2e42bfdfc1d5ea64c25e5a1067f90826c65332c73bf144a06345e9c0000000000e8000000002000020000000ea12a725ad69e7c8060fa4ff53b0c15d2ab644662e2c2dafbb8b3702004de19f20000000fa818cc3cc87e264750761f7130ed2e25777b1ac7d1e166fc810a06a3f344a49400000001f8c89efe52362aa0bc94781f6e3a59652b5547f203a55468264b351fc95b19441262fa1d799e308d6ee7c607bb8278de605ec0d83bdf6ed61e2e1056d5a4fb5 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000ebd3f1f91a2654d07c53d0506fa3c4a235849f5b7c0d66562ce68ba72afa014c000000000e8000000002000020000000cef2c16338cdb004e030f9cb4933935705457eb9248ac1bead6d9305f3425984900000003ac743fd26a160b2463d70010d224876370f66dcca169c83ffbf98f2d6cffc72db353cac17e08b48f8ba61d7e68ca2df02ad04cb0389ef67236beedee1f770c669bb673e15a22a50752d99392bb1d9b663bd1ea1db18d1e38acc96e8c1c20bd383f02c391aa012af53c242bd0848c5ca19b61c31f2e155b368112d790dfad7d4748d3b7625105383d5e2d194af46087240000000728cf62eb5b1cecc558a323cfd22f899f8a8635db7daf5c814b9240777736b96451fc42b8f5210ee09dd2c0f2636339f6844a582c3e453c9f841db02f68c4f70 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0e946164aa5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 492 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 492 iexplore.exe 492 iexplore.exe 2140 IEXPLORE.EXE 2140 IEXPLORE.EXE 2140 IEXPLORE.EXE 2140 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 492 wrote to memory of 2140 492 iexplore.exe 29 PID 492 wrote to memory of 2140 492 iexplore.exe 29 PID 492 wrote to memory of 2140 492 iexplore.exe 29 PID 492 wrote to memory of 2140 492 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\402523ba00adde29ba6af387ec330266_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:492 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:492 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2140
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5689518495a56f274fda7a0e96c3c9c31
SHA14f7c0986321d04f808314baf3ce9acbee92694a9
SHA2563ada4741c2a63cb70d1a927d56d03a181180f9a9c7ad0a0386efbbdcc2be5a2e
SHA512356954b90e7e4058389ea3f9dc28a8d15a0d6672d1b7fbbaad95572176e62b28945cbbc0fe0e7ec8da6d0b6ce6b7f8a43f4e7d0f6a094311998eaae74d46d499
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d7a2fd6c555b6681c31cbc897e77e7ce
SHA1ffb3e2a0c1c034669b816dabb0918e9a2f1f3073
SHA256cbe3112801329540e088764988a646caedb2ef749e97f8e1a2b5480280bb0099
SHA512e15d83f6a27b65fcc51fbed97735e1faf292866a6a23fb2f4fbad6cde3ae304004f3acdbb47a3f2dde4f935e6410e46d73a0d84468be09e3eef7c49e9f0e1d18
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f5a9cca335600bdd3e2757156f396e85
SHA1ef7c0815f00596b529b07984cb31278132f0535e
SHA2564d3a019d5c1dd0dbc9299a5bd506c264e5c094c1a48b38b26eb8071e7983d2aa
SHA5122632beb052d3a537adae4118271650a2eeffe0912f29630d52b24c0b349c5f4ee6f79bc2f63a6476c383b7798f741d88ab6ad9d1033a59d8e094a8510e6ec049
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e351e912ddde52bf5d79938f4cf17b49
SHA126c7564d2e3596dd1437d2e2a14ff5268e280daa
SHA2565e21136782a13d9dfd3fbb766432ed7da5fb265e673509889a0283c67b8b078c
SHA512fc96e58e61fabcbe8d8ad67c4b2304218769c8f84703f0cbe1576fb18a700b423050bfce45e33164a637e7008e42048b23a2a4ed828ceff79ad10389706fa72b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5041d871d32333588affd64e59140053e
SHA133e0a16f4dbd54b4b3167dda188c8f3a4018ffbb
SHA256eec0166530e9fed9ab61285271236a68d42538453cbc2ca5737ea3e2e90ef56f
SHA512a1dc281e48a58eba3a3bdd6346c34928c36e0db79d6d0869b2a88b6fdc07d10b70ab3dfc425d5ce44c76c7216c53a09f3e5e2e299ecb5cf6d06d79ead51353c0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56c8a82347660c8cf8c8a5012e04c3e5d
SHA130de135fd5892612e9af9ea30083f976fa22038f
SHA2564926a8e6141747e322f4b0e9a3fc113674c3aa0bfcb8f921bf35403c155fc72f
SHA512d7062611930e49ae0a3fa1570212dbb1fe0f338fcc94876c65f2fc8f016eabd4cb5e189f395c1a804d93a1bb7195e4d693a187c785212bcdbc5f4e344bc7aa3a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD581fbab7885042083f17f3a866bc430c6
SHA10e6ae87ef7c0f3167f261e17a77001c2ce2db34f
SHA256f8303cf76a9a4c75126a115407323e24bdd03e758a4c4ef0011e6834a09587aa
SHA5127d7b2d8a252cdf22d5b7542aef51fef293e5e3b102305d8ebb343e088dc400dcde1defb7a29e2c2a527ac9e30a6a4309779a4a2240a305bdc5f8a4e076fb9817
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b2f95bdd94d5c709d8ef6d0e1931340f
SHA12ade2187bd6715587528789155d444f5c76a545c
SHA256d4129cd505672c4a157fcfb645e3feaae657b693598675c55493aa1e670353f5
SHA512bf2dfd310eafa779c7b5fd98b5bfb326ee7e13ae8c17343523195deaa8b9292e5382d345567409228d6a98e75f9f95d13aebbb29574a9830d346df98f763690a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD551d9b7b3f04176aac97c2dd368af17e3
SHA18e579dca2e83bb2a1a3f2828902ee0c8adf85617
SHA256b510dcee22afa2adfd9b7777aca4fff7f575e0a7cbfb862da8ccc4f3b6d0b530
SHA512592b6373304189711d5796ade8f30fd2e0e701ec794055439ee9197077f108cd38361581b14e7f7971befc9a3746c6dbcb813cd7b237b6756080fe2dffe21cd5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59debfc3f451b7293506fe283d9656faa
SHA10ba5c048f3d534bf38df9b02cec28c90e5c4133f
SHA2566574b772b5e4b9cf84b78131b4f27196c68f5fa6dbf017ddf40abc0828e530d5
SHA51275e7153dd21be3ad57634e37aff7fae06fb577f02dbe369e2137aa12695915832660c7b2b3fa56d45c5c23a39ff42ad46fb6c92ec05217f744d4e1c9214bfa50
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c1c04ca662b9d1d97d28b003ff841f6e
SHA15558156b42123f96f8e1faf5fab6e82528bb74f4
SHA256be05af5bb6bcdc9f6822616edfd483eee457efdf3a872e669a161c58889ccf73
SHA512ffa1de61e3e39818a881ddaaa02eb920ad71b6a245234691dc94112c68c5e6b05c57a1dd18f47d4768cdf8cc4139f30e3487d31de5bf21dc61779cfc2bcaf3ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5548adbf1e7f885012f03ef5fe5c58971
SHA1dc6e287f3618433da5cffefd9eda8827b6e65ccf
SHA2568d80a991d8177c47820ae06a27dc71d6db596268c32707617237b777c5847d4f
SHA5127600500a703a06a7288c63bed56f32769bd426863f48109773428f0e9de46efc7fa7ae94a597520fc98cd1638f14f46e881d97081d4457e727c90e9aa220715b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a15554a3608430911f937a9a86a28d9d
SHA145d3291cac5053451724af79ec560079d4976276
SHA256b69662ed6565fc0586fb96eb20271264f7ec3b7f38c2efe303970722087433f6
SHA5128704ce2e43d28fa56992aba8f7abc0f89bef4dfda799a6e3b9ee690328d9a0a9347883325ca9f7af19d3ffbab36a685daffccbbe899eef9a1ee4e934c75aaeb4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59e9d5d836a7140b9a92e21e9ab3a21e7
SHA1561867048545d9fb4e286869fa7894bcfd52cb78
SHA256b197b8e19dcd9d5234b73af8bbaa7ae867a1a6256dc993a9e365530601452ea4
SHA512bbd75ef05c89f83d2dfc7cddd8d0ace91e77ead6ea0ddb02fa7184dd12ea57429786baaaffd2dba9ce929703f04abe4a98a3d2138258e19fbcd2b25439fa8f6c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dd45b0289098c4d3122df9eccfe39f1f
SHA1c6dce12cca0970a7fbced714a1c59637caa27c40
SHA256f5ceb4d5ef20e45e35d659edfa98c4dc8bc030542ac80d3cfe73fbee7664b083
SHA512ea9f422077ee5939fabceb8d788c1f6f650f27169c38bdd8b426346da495d973b6d0da4e5a3b38406b987d5c923c104ac8eaedc70c0487aad7d4318e4dd45a45
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58b1aaf4043368ed30842dea80bb12aa0
SHA1ca33e2420edcd73e2919b3d4096cf1da4ad092f4
SHA2567f47335e869a6ec89624eaa2c859a7949525215d888dd2660d62777a0cc340e2
SHA512801abd0306f1832135b9a88d406778f9bec86864d75d4a22cb9da165ff6f9cfa72c5c314f12c94a348689df6844a45afa313419d0e6df15f23bb2fd391ff17ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ac9f3677113d667c21740f5d86a2a2a7
SHA1fd893f7771ee41ebf07f4401afedab4b273a7506
SHA25680c27b5bbcd4238439468b41310cf478a2580636ee1a76a5203e90a12f1adf19
SHA512090481919567039a10e921c5a4cf255a566ac02dbbfe8e2d7e3d6cf3b189de6f066360eefff2364e248ed52fd75d6a88f798410bc245ed89e66fa5c94981c3fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5824f3439b79352465b20fe2cfa2f1511
SHA1aad83e96f8317369978d6138c331d440b3a69b9c
SHA2564050d30ba5810f79ff55a29e1fb29ad676c673efab75dbfdf6e37575c0911b1f
SHA5123db899d1986f10d2ff33704771fc227e3db54dec1c556b80caad68881f1f7a34f6dff2eb57cb47ac662dbc24ef7d413bba768a07799cb394013967edc0af1d18
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51a0b8e828e3747d8738c69cc091fa4a3
SHA13b700fa39c7af6fbc3ac4b433847ddc0ea77129c
SHA256cec5abef9badfe886e9c6eae69593443cfe0b8286b0db706b213a830757a1874
SHA51205abc71f4219b6ffaff296cd9c520be2b2e171191f04b66632663087672b829ec8bda1196ee0b12ecec05356c82e524a2a206ce823109baa5ac37e547f5a6494
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a