Analysis
-
max time kernel
135s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
14/05/2024, 06:53
Static task
static1
Behavioral task
behavioral1
Sample
4095f94b33884523ee13374de5c458ce_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
4095f94b33884523ee13374de5c458ce_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
4095f94b33884523ee13374de5c458ce_JaffaCakes118.html
-
Size
4KB
-
MD5
4095f94b33884523ee13374de5c458ce
-
SHA1
6ac1f85ebba53c5a8aa3463101aae3927b7b004d
-
SHA256
cabe13e6a1bb4cdf5a5488c0fa30659cfc3b44acbc2741a7539b9c88b1ad016a
-
SHA512
36f49da7a8c5cfe79299e4e507200687ada6c8cf2ae9764997e4a56fa9ee296e2cf1c590c5168d825416bc58011974c6e6741ca4e012889dce034998dd00ca4b
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oYAd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDC
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000f6e62e9c688c10f36aa60546c6565e5a37862960aac1d66caa75c17af223cb23000000000e8000000002000020000000000994e7706366c922f82928ef1c7bdd264f3a63bd4c3667f90cf6ad1e2054e720000000047fd46a98a8f88000f72810f27a205851ecfa8a7e5cdea2d9bf7c77fe454b5e40000000583e46574daf3f817a9f12b6197b7d49c41b0e4604aa1a722b829e831c1472ebaf06360879061beb26afc9435d4c4f202d1e5962d1f6036f20841fc3bb1c1021 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B16DCBE1-11BE-11EF-B35F-5267BFD3BAD1} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421831487" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0ee6a86cba5da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000004d3c405f59e53fd8dbc15579ee6bc30a4a4d6b2a1e987d87bd0c705a09b85f67000000000e8000000002000020000000b5b6b3aa2f6f6ddc5305725c44abbe25a5944894b818232bf7041c4434c16a4190000000330e5aaaae94f0b1fe59e508c7fc729bf1656374f5e87cb1ac965de94cb4d2c6f738509e2a1a11f2fe8db8683d58ea141833de42cc01853eddd6e2c9b097c6b3547ded084c4e1f8b95d58732c5a0455068dfa7f28868cba723efbc6fa75d7223b7a88f46c8a0eba4970b2ca23c5432a53598d847a93ab1d71c54e81b15794ce4f733717546e5a17ce85ab25588814d2f4000000037d6c50c5f732763a067bf48a2073f0c0898b64ac2a388d079638e696a87fa25e20ff02b76ad2def9683fb0f7a5336970cc17bce067176b968c4f356e9f1e9ca iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2912 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2912 iexplore.exe 2912 iexplore.exe 2956 IEXPLORE.EXE 2956 IEXPLORE.EXE 2956 IEXPLORE.EXE 2956 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2912 wrote to memory of 2956 2912 iexplore.exe 28 PID 2912 wrote to memory of 2956 2912 iexplore.exe 28 PID 2912 wrote to memory of 2956 2912 iexplore.exe 28 PID 2912 wrote to memory of 2956 2912 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4095f94b33884523ee13374de5c458ce_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2912 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2956
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD511d0083e69a745a5f6993aab0e39f250
SHA144cf72e352f83c336e99bce920fd39f0018edc36
SHA25602ae38e40b38cff7ca8b78c9bf506af35e0a2830eee03a91cf01826124e0db9a
SHA5129ae9215b7cce62dfb71724db338e858ddd167ae0e6c9bfbad62248ed494ce60f2ba839fb3c086e9c2773cc4f9cea9c32c3c5fd879f824b00e05b31545fc5fc0a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5dd433ed2412535d6be4da2ce7b55d4c3
SHA1a55253bfe6cbab13ff08c01b2534fed0fb1adadb
SHA256f44345bdf4a0bfca9942aa32e418ad163ed69d86e02c09b5d1e7d0c7ae3eb8a4
SHA51281143d961d42b0b082a290974f4a65435dfd5f018926072b90b62c3654b8cb9dd98e31e67dea3786601fc2749f82392f23cb1840e00b3f91baff94ea0040f1d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD548854475350e214b84a759a6b135f9a4
SHA153346d5ce77e94cecb0b1d3a0eb4e62d83eb1b6c
SHA256dd9ee8e95fd313664254f12616d633847f76589a6b36ebe3e94e350a5819fb36
SHA512f9fb4a72ac55d84db96869635e977312547b2957f053d6b35b23fdfd4fc8ae5e40852891b147581277236a8b6909dce47c2d56cec72f15fdb0a4472118217617
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5ba14acca35eab8ee2a549460416cb20c
SHA1c076216b4c0a0588cf630feb2cb3b6e2754aac27
SHA25676ed70d889dc86b5dfaa49e56deb9d215e0ba768a78440738fc805bcc6cc3c5d
SHA512086a2a501fc33dc5011aea07be13a946fa25619efd7f1e92e0e47b15e28b9ce19b9100ff76d5041ebfb9dd10791abf1338252b687b4054ef9ee678b0ac4fc19e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5ef600340ef7686c76023c02f9fafb158
SHA177a7a39733679b61ced28480b20053a7b7bd644e
SHA256e5610c6edc0b6a86cf8c290bd7b5cdd7eeb2bb80a37362006125ecb49ee4c7ad
SHA51231e103108bc757bab8e805e9e4dd6227d3e3fc07208b9d63057c93948fcbb4665fc9dd9066dc58eff58104f46a4e220d1c543ecf77f161e497e7fce1228fc311
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5077fffa8a20588836979dd3310a1c66b
SHA107023ac7a35ec99c9a3aa5626a2d41451dd0c8f6
SHA256a78c4e7497816a88466114aff76474183d2d70efd84b07361be6197325765647
SHA5125fe6c96dc93f52f0aa33485904a41a0c644c3fbf35c1b48bde73e89dada8a07556916be356014dd47b1237997cf63537f68e10c77440a5f1270db50cc0b0764a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD553d18cc98d0df0f66e086ea8a6dfc5cb
SHA1cdd33a8825195054bcb2831ff01658449d3173e1
SHA256e05d173ff2580a4ec546c8e5e4bb28d8cc3d195a3c4d19ad2249771c2918b5c7
SHA512caa9319d3f4de8b42038f200fc7d754e2aaae76063a4b56ee82cef70865548690ca361e5e096b94a8295c54ab7072687cc258613dead5f7d333416ff04c7c8ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD51c31a272624cbbb492a4e2b710d033e6
SHA1ecfd0f083da56232c4837d20703be0fef7a0dfe6
SHA2567132a4e76390fae3a2eed25b9cbcd482983eaa7fd70b49a18677b99e39a5650e
SHA512276855ae09fc37a1b314e5bc7351246d7414df5d73ba9faffa1a2c67da498c8225feba920fce72382a05ce0d3c5cd75cc67adddc6f21a2ab14221bfb4d21f684
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD56993bf766273887b778deeef6d9d2fda
SHA19851eb94a34485c86d8fdca1c6cde93788b1ef34
SHA256e9d798152aeddba8de92c74a8c747f9fab2924433735a73c10566fbeabf52617
SHA512a147a67e7688f00600cf86d573ff93628be7331307f881c72fc03a97b163b8b12df34b6a69d75325f7a9dab5f2e913e172e61778100136967ea7353ffc7b439e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5e4a407e94ea0bc57464d98a2a7076675
SHA1917cb62ee99f14aa2dfd89535748f73e2d628b7c
SHA2562b7ef76f62f112470052a2a1bb5cab83d8bea8574f5f7c88a91625bf23ec4d9a
SHA5129ac740c0b5344bd02d5c368532ed5af300ea0eb9f9782ff97f7ff14982976f0ff9411761f65f4e6fea634504f99990bc24ee643bbaf5fd93b82d2d866357595b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5906689fec0e910f2763d79e0d6aeac18
SHA142ca294210dd83adc91c9892f50fec7ba276f40f
SHA256b24f84ac091d706724711799bdb4fdde77d65e380383a3aeb5800dcc1eda4c71
SHA51255cdcac1e9ee57146936abe744d591241971a1e9fd46b391911e06eb66c4a06600302e3f1f51248413f0ae114eff130438f5de5f605b70c4e36a71283385e5d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5ee4c6d4af2bca2c02107d17f4f1cb8ef
SHA16c26caee4df3cddeb82e4b2e5f2f6cf0a3da94ec
SHA256902fca31f011529fdabf4bf1fb6a478b94f3e04d8fcf21030ae4c62a9bd08e63
SHA51230341224916db3ae006b1c9e5fbf0a9b385b4d51df0ac3305152cd4c594cc08dda62cb9ae58b9d79a7cd2ef87e205b98a7d9295b641ccf10832676ed93aac1c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5dfd294bc6677744cd78a39abb92d1016
SHA1037f480e016e0e57a2c0806b365e43648b3f0ecd
SHA256af452c7f818b30b973cc95fd79814f88060f38ddc476c533eb435ca9b9c3794b
SHA5128f6d81711411c9fcb0052f88d0ac53bcba3800419b8c7cc628d7f31d523e10137e9821f8f0d8dbad2766b41ae86aeb0f10f76aef0ecdea7712787fe0e67e6c1a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD596ea9639bacf496b10f90af606a626e3
SHA120290c7374e9f9edce95cbbb1e141bc7d2313c34
SHA25649772c477bc42240a1a9460b691a597fa72dae5029623681dacd9c6e4667d8a5
SHA512cb8f25ba37d38cf41dd58616e8cbdf9507a100c000e2acca72080eed024cc6a8bbb1f4b150222cefdac2f2a4cfeade9d4f8a16f874c97d22a16fc713ffd8abbf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD59aa2316f9b4289df5afbcee7d371b6c8
SHA13d83395c10a64f28e498e35db8182220beb27b8d
SHA25653d58cd7310d7de07df2ece106b67b75eaeade11de4063682c9fa04db8ee7f3e
SHA512101a66f2068fbd18c57249f979e32f799dedbee16a310bdfa10dc0c04d74385bed9a6dc08c8421ae9e5aee40c9238ece4f9dcfeb565670c22d0bc6f3e525f9c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5fb7e72091ad37e339349f0795ac434dd
SHA1c0c266215a7890eea76af5238109164a3000bf62
SHA25616574b3aabb9d019de8b11564c76a93fd4c4b9c7768f4e5ac465912444bef736
SHA512f84b75474aa4c80f75618f821dc308aef0aee1c1dee3c4e9db436297879fc946391cd9d63e08a4147663456912e7d2bd6f91113347342509c1794205a56006d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5d4681b90a9a2a53734682dd8f7fc9a37
SHA123d7312ced9137f79fecab358945cfae7af9f689
SHA256157495b7b4e1983917a09f237b41b233eb46062743fa394930846fd68a29e3af
SHA51252e273d0544c9e88c430de39c231a86a68201866f998efe683be9c22f5b125f6a0faa261e9256e4aa175cfacb70b8e2287112b664631a1e5b565e84d6e9f0658
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a