Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
14/05/2024, 09:47
Static task
static1
Behavioral task
behavioral1
Sample
410ef45ee1e4c005f44e02d415e9942f_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
410ef45ee1e4c005f44e02d415e9942f_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
410ef45ee1e4c005f44e02d415e9942f_JaffaCakes118.html
-
Size
31KB
-
MD5
410ef45ee1e4c005f44e02d415e9942f
-
SHA1
4c47324d2ccf523b1557bea6f2f5331208ef78dc
-
SHA256
aedaf9a0e3a3c7bbc240f65918a995a2c06c477f009c4aafc186e299ef4c0086
-
SHA512
1bbce8a3737f95b783f741d5c21acb03de3280f49ef8b474e530880fffdd82853cca2be7443c9788717f9171f22d913b8bbdf53f0d2589b91630b5bbd8158462
-
SSDEEP
768:EUUb+T8yZ7AuEuC+kiuUzVXWei99qQ4NCPGui0ZFJ6fWnvZk/MbaL:EUu+T8yZ7AuEuC+kRUzVXWei99qQ4NCM
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a960690000000002000000000010660000000100002000000015c4f02efba465925598072c5c7f20917b006517c9e3ddf961a42683d89afc50000000000e80000000020000200000000bb3ac7bbb4710989e854e015673e98edf4c69393c00baaacb2c807ca164fe9720000000b3c13e4c2cbf1fd08cbb473354275cbfd735b58ca882e6c492772353f9fa24ac40000000b9299f65814a754912ae42ee53b623ab774fca262bb25afd96833fc0fa7c00dd8dd9b55b26f4edb2cafcde88121e66d6c0ee7b13c4e5a981fbce51a3c1ad8d46 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421841903" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10e45ac8e3a5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F298FA01-11D6-11EF-B991-7EEA931DE775} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000000a2e9415fbc1bae3a7f1c56d690e863acd0caa3cd35d3a4fc7d008b4839631fa000000000e80000000020000200000001e1977989be7672f8d29e516f1233505fce3e11f5dbbee3942c63270e16c8511900000008310a49738a6de61dc3336f885a982d775c4dbb44973000673a63b0e7b07889670eded8c24ce1565362c41a0b89a50b68affcf5333eed48dbfc1981945ecb0249884ef07000a3f98bb9a871c23c09ddada14ff77bfb1b895adef9002a773f0160fe168a336bdfc6e32a081cb0ec6af91378e3de76ec493b213c97c42293ba336c4ed9b10dc17fc73ce0e31b7125adc62400000001fdcf3f535733565577e4f232ce08aadebcd9f947d7b49f990487876e6e008212fc4b86a8ae8a478c5ec14bb5ab8a9cbb80eb19e1a45ed710e417238677deab3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2452 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2452 iexplore.exe 2452 iexplore.exe 2892 IEXPLORE.EXE 2892 IEXPLORE.EXE 2892 IEXPLORE.EXE 2892 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2452 wrote to memory of 2892 2452 iexplore.exe 28 PID 2452 wrote to memory of 2892 2452 iexplore.exe 28 PID 2452 wrote to memory of 2892 2452 iexplore.exe 28 PID 2452 wrote to memory of 2892 2452 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\410ef45ee1e4c005f44e02d415e9942f_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2452 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2892
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dbfe79a34301d797b8366d1153792e24
SHA183fe15d394ad4729a48d698983ee783b316ac1a1
SHA256ad63546e0432896ba5bd66d7bdfe9d8e5daf2adde3325b75db42a87cdd57369e
SHA51206f534b7f7c291d5c18837f8373841d9c6d9d644eb30e5af6a15cb9033127b38ac80dc3122635c2ef164e2904522f7024261ca7c70fd5c24c6855091e9480d81
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cbb0c0f9730a81e7da34085e062fed7d
SHA1e6e594d7311c61e07e62d9c24957e72b9ca867e2
SHA256de6790da2b757b3fa0494f944f30598685019f3b70439dc6e5c4c0dec7f4c25e
SHA512a24d04fb883e8ed54437e44f177000b218f60b389bf27aedcedf02690cd28b71ce294ca5f2bf6474f24b3487e87413d535220c539a2455aba52cfe0d7af4737a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ea93ce699cdd47996e32b09ed53f61e1
SHA1bb0a7d04a326aab23e70e58e9b3120897c40cf1a
SHA25604238c7fede1752b734ca22d4da3e5835eec7c1062308770fb4cda7eeadc4e3c
SHA5125a37b179a84054f564a1f8c6c6087311a96e6ec75b102e4c298eb02f162d696eee11c0922184fd44f666e18c343aeb7f3712bc3e9a38b4e8edbf32f8c769a494
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e80cc46b4b9c8f7bbe4ca70dc6ff6445
SHA1637ef458cd2b4b4e9a01cd72aeef398abfb8f359
SHA256de0dccc537fba6201c83a3995a915ac45eb51c7792f1ce000067381ebeddcb3f
SHA512340e4634b17b54412bbf06a014e21414721fb6a95342309ae5e383e1ff2fe4ed19e85423c022e3d03b05ef9c0a148327b6f61da2b581f4af2085f44ab8e8e0f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5167278de53802d40b989336f55383d74
SHA1a852b439c789aa1d7a98a91b40bea8e803e4204c
SHA25641d9d378e153f932e8ce3f6a5ee867e294a2932802836c99e75795cb04867ebc
SHA5127cacf752e0351e4b417c439f2cbb83b976a1ddac7ba8c27726149e43747b95f39a223e175b1f74391e41b8c13ff0e6adaac87ec189689404e0cc0c9920efaa6f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57441585b42a775164e6a4d37325a94ec
SHA1d3f5e682aa9733fcc65b86333dd8ab101a39a7ba
SHA256ff33d96e19ddc784f64e203cbfa7492bb47127f0d7bd16304c74d55c74835300
SHA51297e4eeb954adff28ba9248b97a20551972c34e73a99108e4e14550996f7c70acc832097af6221b540dcf572e0c434440a9a80a660a4be4b9fedce4f09efb8037
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD534f87868cae399bdceb37a7d9566017d
SHA174ec1293f396670c35ae8aa8b60a2938ca7ad16d
SHA256096e4ff2aff701d4076db85f6bb3b3acf3d3652c44fb3761625bb47e031d5b8f
SHA5126eeb10ce0af62a9bd73f8525fa175ed26f6616863538fdd55b7926ba7c15b83a15fa71707d4e30573089c54d5062a78e649f950df0a86e1564e0e78baafbc815
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57fcb0dffd11613476f1ab9f922ccdbed
SHA111ae9d936dd12f3ee9f97dc4424405ee3d7da528
SHA256821e28be33c18fe083678d69b842ced486b4d6e9f3935c00228215b46ac35a6d
SHA512349d73874833356f2ab8ad42d30cebf01d708230c4dc5f67593f66411583ac57ede36a7b5bd54d47c4bea2bb970a96d57fc9f8c0ef2c0228edcd6846552b462b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a31c39d972e0572628322fff337e6356
SHA1a6756feb281de318ddf3100fad16431dbf062784
SHA256abc2d7d94f7b4f098646be159d64f4c5e466949d3fae4c3ae134bdadfdde36ef
SHA512a11bca2aa06282dc183f9eb38e38884a7b9215b924de530e56e2ad47eb0677cc622191fa592955284619faafa128daacb76c707769e28a0ee76fc2af0bb67ddd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cc8880e516027bfe65e2ff61bc05af5d
SHA1f915325f7d7c3a5ba95b737fee723f0e5ede5934
SHA256a13d713e14bf689c7bf39c907289ffde68e4e101a2f74d181fc91467a1c7e45c
SHA5122254e70f74353e3731025a1dc135779c983fe3681587230e7b2fff666971e80d31a5c3ee02f5106ea2aa8303b7095d47e7aa99bc01eca8ad0bb7f070793d27ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56088b92e358de40b8d254f7dc954357d
SHA16209e21588c5aa76d3b3d7dc8817d3d0584c1278
SHA256508535373bab62205ce8945fddf0136f793c79c993d57b9d3704de19f27cf33b
SHA512e8f387ea169744c8afe2fdf2329f4147bd1a9f11ead4ab4c4a347217fbc70152729144def3ae93913b00990fe77cd056230af3b3eaab006ff097228188ccb367
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD529c44bba72642761130fa55388975dc1
SHA1ed8f74d77ff1c7bcad1e8966ef1624750aaeab9c
SHA2563fe18dc2fcd4a7c2d0dc201a51e0daa2c3565c61060d2b0884c5d6269b1cc4ae
SHA512ce91adbf8bf9c6842d0959778b0ccc2d5861f65185d4907c685ba21816c1ff2fcddc8bb87210551635b39b6a81a96fd0dc814effa0baa9312938b7363f179c57
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d7ac3472509fe9837971f9da0c15d097
SHA1fbc4c2016cd46723a62d407b7f443846114d1d5b
SHA256c18e966205d067f1ac445f7a239bf39ebd6e460c709eca4d9334bd74fc13d1bc
SHA5125d1f96b0566e96da8a42ffee8fb445d558469a5b7e17fe435c9f4b2790b3bc80eb24160f556e75fe7e55abdcba874b90e429b6ba8a9b2f13ee38184c65d32f5e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50ca70aacaa7697ba6b345f84e9789740
SHA110a154f5f1454a210bc22f6e8e42b82eaa6b3c9b
SHA256e54625d3686b0dc2bceef4264e5c01077be476a445659f528a8c4bb10a08cf72
SHA5122fa2bb0ae8df220d72564dbee8fa4c978f0b877c6fe5609780e1c1d2d78a874a8f2e39d102ab7f2d041f5e478f9e0ca4b6118307fa2e6ea2ac9fe974f22195fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50b1014379ab23b2b1d62318d410f03ed
SHA1ab85becefb8f478c92d858cc02a6c57fd561c7c3
SHA256fae43543325f81dec830746b05420eea23c0923bc48fefd875eee3157393a17e
SHA512ba97bfce3e51508d9e564f510dc68285942e44c351cbda831116c1eb3afe5484d91d8364286ae3529682550fbf8b3576a961c51bd08fa5fc89c33e6ead2e251c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55c49996aa1c8d5c641195d94512f2e14
SHA1bcf3b7c415db854b85262bb23fd1222b2bbd0886
SHA256c51f0969666961920e7ae1153edf471272863e86fc518e23073e62df7d6c3a6b
SHA512f9c8a00113d5fb20cd836a93b1a7a179ba95aa977cc49d92e2fcac8591b47f291c7be512686ca586ccf4ecc3b43f30db24d9c10a72fe9db7fdae32004699eb35
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e0ef56d99a6108ec971780d5ab0854a9
SHA1d2b316863f862e91449962c60dab3b636803bec6
SHA25667e82cafe58dfdc983d08b54a8f022510edae7dc549c46c68f6a90b9d6669284
SHA512fcc2b5a1ce179e6261447dbefa3d61a724a62c07f912049e7a7f769671ded40fb04811618924e43eab2d43c2ec2e88741e4a485a977277f4e203e5a47a887a40
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a