Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
14/05/2024, 21:53
Static task
static1
Behavioral task
behavioral1
Sample
433683c2bad269afd9e4bc7fe1208853_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
433683c2bad269afd9e4bc7fe1208853_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
433683c2bad269afd9e4bc7fe1208853_JaffaCakes118.html
-
Size
4KB
-
MD5
433683c2bad269afd9e4bc7fe1208853
-
SHA1
0d99ec5384283c4ba2b64d29a72c1b0bfa62cc65
-
SHA256
650622aab3a9d05e181df0148c1fe9d4de726de831eb57888c1be0369be70147
-
SHA512
c54ddf6fc649d808ba9ea3e5147e087b62f878608de9918fab15680863f9aff55e150e5d3c09ad3112e669464d09f892e59797c8fbb1d486bc307170b9852a11
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8o5Er/LBd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDx
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421885457" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5AD8D441-123C-11EF-B04F-52AF0AAB4D51} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000002c782ce2e781931fc2826cf7121130a15c55698367896333b97d8ee9bc9407de000000000e80000000020000200000009caa1b0e8f88c9439894effbadb3f7cb0b9700cdeb0614537fcbfe120e5ddf6f200000006301dacff7933d468c5f35b344d9cf84b2e921bdae0e621b867baf1147afd31840000000e5f3552a430d081337f1d0228a5331ba5d9abe8e158d42d1c2cd14a1a5beb61c0a788f3ded3060d1df72f4b7e7acb9d97c3cdc5cf7188f8a915781cb0d24723c iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 506e5a2f49a6da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000df4cf8b9959f2e61c94ad55b327e3f64ecb22b74169da2d710d46519ec8e46d1000000000e800000000200002000000073da7e59800efde977b65c97c8c0cee7742e0efdfac2674589dfbabe9c214b6090000000ef35c53da4d9b7f70b5a5f3451ed427beda6a0d198047270a91960087bb29e65adcb2889b0c87c350f137c90381ee5d8316a64ad1aad006604a9844a00cb7287f0b4141846fec51cfd0bc4c99b235891f23835baa23ad58e1477c0c6f16a833fbcfc21cd1d10804eeb72a823116382d568b5c65ab320bfff1324a32a9026a81ecd30827c323535ab0b8aaf3f94ea5c3d400000000d94cc753b55820400d77853d685ff30f15be15ad0747b98e08ad7792b25812e663e949dd79f643144bfebdd0b809cad257cdefb01e9d0e92be8e4f45686dcc7 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1904 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1904 iexplore.exe 1904 iexplore.exe 3052 IEXPLORE.EXE 3052 IEXPLORE.EXE 3052 IEXPLORE.EXE 3052 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1904 wrote to memory of 3052 1904 iexplore.exe 28 PID 1904 wrote to memory of 3052 1904 iexplore.exe 28 PID 1904 wrote to memory of 3052 1904 iexplore.exe 28 PID 1904 wrote to memory of 3052 1904 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\433683c2bad269afd9e4bc7fe1208853_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1904 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3052
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a2fa6c2a0478d269f0cadffea1e094ff
SHA14bd769fb8c9e478b360a499ea27a55824b71793d
SHA256673c930204b51aac3cf61f227e828d963dc86deba32787dd08bf3553ffafbab1
SHA51278e9572cfe1e11953a02706578fd3242ec5cb5d544b8541d35d1cf104b140a09b9e8b9f4412e43eec6950301ab4eb180bb10aec9f766aba8c64bdefa0f9d15c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54559b278a6c2f9e47668029383531291
SHA19d89406abce187b94fa67d8679ec2f105fb68408
SHA256783ba393f64e939180813e9571be1a52a47dd0d12302d69e0ff506fca0b1ca0b
SHA51268e463192b1421cf4e12f462da935c1678a91a4730a555691b8495c36f93c1ace63393dc7b987853fa8146577feec976c2fc65275528dbaf2c4eb0f20a909421
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c354b19a332f4a7a19809b536068abc5
SHA1fc6a7fba83107d0d05acbd7ef35cfd0c290728c4
SHA2561e8cbe6a29622cfe7fe81989f84f5d129131d68439689ff1fe45a2f4b36d6c6b
SHA512e2a89e979e4546c35f4991a0a460e4a880dc07f2fe5327b9de1864a5c54a3fcfe74f8631dd7b6c8d30b6452b671d507ae77a1c049d6e6990938e1b9fa62dcd55
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e71b656ea7a92e23a956af864c0b90bc
SHA1a682c1a1c516d6c26d70ca155b127c31d33064ec
SHA256d2da7f80b4e6efe1a1df254cb5d144f89bbe8fc77a568705ead177a841f4f063
SHA51258e2f6829fe31ad7c55d412cbf4caa401186d37f9b4a14aa352e220f01c1fd772b7c0843c545f03e8d648f75ef46835728216b45020272faf9bede22ddf17ad9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bcefa7a16d790e696277b6469d153ea9
SHA18c6f65098b15c514fef224ab8ad1423ffb428cab
SHA256507188ab6694624aad8278dbcbb3a44c1cc5effb2e2f5e6d3c342dc565f7632a
SHA512537ed7f36b68f4e411539baba80a6156120e551800f8a67f2afe1c2d07abc98789da3c9e3fcee3d97b6bb1ec51d72cd42dfef0a5e39dae2a592446d8e0ef1996
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5889e3477ba5da1d1b5c1c4ad3050b942
SHA1c5d5f88e80d782779bf56b03f29bdc897e510967
SHA256a68f1f894bfe3fccbc90fffb4fcf52b366e360846e8440af38c09136116fd72c
SHA512a2aa261af9b73414f6ffe1f8351092e65b8206b48965c451c246c035645877cf18c098ade42dc9eca0956432163eaa64e5853d9f622e1de594ad762472b0cee5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54257a31583d4c9d505e3d545b989ab86
SHA11ed130b64ff1b5829046b30f2b75e260c9717027
SHA256c2b2c4d521f36ef683631fa8bb8d9aae4f724fdc2a7f1f5ab59127fa349b33fd
SHA51252bbca8daa31bc24c8fa915eea436815214718e70622d21850351c2e53f5a67fe285745ccfd6062867e996acbe34b0ced4c8a51193dcae0e362c8601793eec24
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bc92a4c8acf679feed0d29c336436722
SHA1803399fbde2248cb003a846cbedc68f319998cf1
SHA256adb6458321e924e27af75a5511fd2031658ac886e91f6f75495b03a2aa421964
SHA512f095bd3db66f79cf72cba2638ba0c641acb4fadcd0cacbe70f542cb5ce25d711287f0565b464102e1e691aca514821a38acacff6a1d8f5b2394e3b702e78e8e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c6d29a65cdb09a4a096b56a1225ee103
SHA15ce97e176c32fede66f57ec6264b1f39ff7f7951
SHA2568afbee0454c2d8f33b15ab7857dd0cbfa118fb1416ca1f6dbc29ac148bcfcd44
SHA5123e11718bc2cf86d7590a99ae5bdb7e8f47f2ced7509f785514d0bfcd68c45005ecd068a0449cc325d0c19e73f5281cae12f1e5fdf78ecbaa1daf45867e533257
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ecb59e09c61faca87f915483eee8a7f3
SHA1ba9fca00ec082815e61722fce5797f2b6bc3fb51
SHA256a031d11e11d13afcdea60de1d9db933efd8f7412ce558dd958a8694faaeac779
SHA512e378a82bb8b8a4641cd154f64dc35ab1eba0558453f657f4c275f62f9d7a4f9e17ed216e9d0e52524216fbbf1eeec05ce4e9ba319833b41e25d1b9eb62f2677a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58449c350dcba416cce0ddfafa3deb092
SHA11ff161de1e94dd41ec907b132a902d19f879c12c
SHA256e6a8b2c3a63b1e59e8c6f61cccbe20783420aa4da23f36dc34a3f5cf8bb2482d
SHA5126fbb3965ab3567eea8106804ce790d25781bba4784f2e142e1c3134ad9b2f50183bb066e5279b1dfbaf5056fd6132ffffdf701ba068cb374acb5a05a895e45ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f60ff504d361014a3d2b337902c37ec3
SHA1dabbc426d3b193b2697a0d4f198f236172282d53
SHA25697df437d3cd10064cce8123b846ead7d9a7fc0de174fb3209a6b2ed75fd36f1b
SHA51288be88e659d17b75ee192273c884b6da1a0997016c7e10130afc34cb381dae3f2982ec21df0ab2251157ddb968078a983201a650da58521f66ef33eaeadb711f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51466a7d2fcbbe1aff17724d4b2f65c31
SHA1d8f9d183c94aefd90f74b39725d13a8d00d91163
SHA256450d965def86ff60dbe1a6aea184af355f8050f3a06b8a4ec7fffd1300681c2c
SHA512f816ab21bbedd5c746d9de39658385e387aafb2cfbf3cd31a765e462e65999caffc2d8e0b888476a59960e2f259a4bd4ee3c957322054b3ec9402192b757869e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5790ed630e5a531c22fed1259ce9072c7
SHA1657de8c319ce9bef86e29cd1ec2bc068d198ab09
SHA25612204ebcd8bd5c3fb2e1f620694d3c0f7ff0d13f20dcbc7d217b6a597a6d15a8
SHA512eac318da9d916629a8f95dee52a40a8d6623007a40ba4d8a422319d0ace68760a63e967ae5ddb4599fe2b3baf6937ba9a544a7c98359bfa532cd3008300b7de1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD583805facb9ad40de9dadd63bc027bf96
SHA14e3e5d748878748aa6266e9f7b75df9209a243c5
SHA256aff6ed406ef256639189dc565ca44cd5c986caff94265024f2f768ff15292513
SHA5126795c0ab939dfd02aab0da4c0787fe3ec1edcf951fdf61c3d6d4f5fc738ed0ec8a8365ea352d828a5d57e0b03f7d483816daf27701dbb65ffeaa705dcc416e2d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bded3b8ebacd400af3248277f2cb56e2
SHA17ff72ad6b029d52a46a26d5ab250ef4e184b18e7
SHA256c360e682e42a6bbf855a43803c53c7e1eec84196e7123891570522fbdab475d3
SHA5123bf06a635c8031b9d712794bdebd315ae5c7937262a25a7a941c966080903c7799561db62303f51f36ebfa673795b3c2a3e04162c41a78e7e1dbe18058593b25
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD511b87230561c9d7f9cf9afcb4932aaf1
SHA1ce337f10730c3def74636daec4b96498625cd0c5
SHA256c70c213f4029b6b2f295c6f5a73b277e2e98ca9d6fcc92c36a768e9f02dfe49b
SHA512175eed684ccfee4bf6777d5543d0e609996b427276963f08a78935d62684a7f61d4dc385426403cab7b579965f54b55c12a0a9d2684bee557134c928451805cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57d7933feee3a0e19624ed69b11d4afb0
SHA16e7f6a8d29ae18603b7a1d5db81f89b660269905
SHA2566e6f6c5920c793fe590315c1ee8ae1e17d6a609288f5a249220493f9483d9f00
SHA51242daf52e193b08fbd592f52df12f46cae9df1d758048f7fa3c50e6625a33fc60d1a231aec8af8a31df9e29923b7d34cbb6a6f590280795d9ddff1ee2cefb49ef
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a