Analysis
-
max time kernel
118s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
14/05/2024, 21:10
Static task
static1
Behavioral task
behavioral1
Sample
43168324777e4d6d5be4c78236826cfc_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
43168324777e4d6d5be4c78236826cfc_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
43168324777e4d6d5be4c78236826cfc_JaffaCakes118.html
-
Size
21KB
-
MD5
43168324777e4d6d5be4c78236826cfc
-
SHA1
7169a06016408c9fced5e46ef237d1ccc1629c8b
-
SHA256
bcba5cfa6848a3e5d1e2d50e156c4d16e9990d3b695de3556b5e544b2bf7abe4
-
SHA512
5bb17fb0a651f1c1ac893bf4f9988337dd1330182f5a29991c5405be1c3b6dd8935b79e045a0f135ad47392566ba029bccb811d71a2f1d07f0c1b94684f2e3e2
-
SSDEEP
384:A9NJH38jW9qSMF6F/GiZ9w1PoODcodr/4DkFkqkLdklh3Wp3eeBWjv:WNF/vZ9wTDB4lG34ueQjv
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00ee763443a6da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000e8a43098ca8e081655efafdb139c62175c8105418c384cd27ea09e823cb7d1f1000000000e800000000200002000000029c778b2996e50745f4b28e7473e0838a079746e2a22a9ef2adea63d25d49ae1200000008a2016852794e77aed03f4ad4e62f09fb33ef18a9466f9a3bb9d81e85c1bb6cb400000005fc0eea8a478ae57e37a81ce8e83bb862bc4e70c8fe6a12d54e3bd61c606f57d94b0334a54e816003f707993ac5b663a618cd23ece548cd862ab19bbd3c31b35 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421882889" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000093a3c6955f5b5daa782614d68190e2178a0beda13e39b4ae5b2154f43b739619000000000e800000000200002000000048fbc2e5bd07750598f63a725bc055856f18534da3b8dc93e1a7fab293fb8ef690000000bc603a5739563afda915731d8f7ea55458376a69f4add6176f721d837e1badebe743a6c26423b5de3c0a0f462da55d329fb1ef482d572b8b08428589efed5bc539a4e2c5fa1b338866f1142a655f8ce01154aeff047af0213cde6ce905bb2d95c3f1736809642539055d021ed599b515fe68be074d1476adadb2221dc958695bfeb7ee7ace16621e9dfca03c3cd4257740000000d222c7eaa1720fce50f3cb2692f5a9ccc8cc2d3545acaec92f429cad662e204e706067d5af7fe8e02977cee33d5420421be3e35367bb3c187654b0178976690e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5FAD8521-1236-11EF-B27D-6A387CD8C53E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2968 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2968 iexplore.exe 2968 iexplore.exe 2136 IEXPLORE.EXE 2136 IEXPLORE.EXE 2136 IEXPLORE.EXE 2136 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2968 wrote to memory of 2136 2968 iexplore.exe 28 PID 2968 wrote to memory of 2136 2968 iexplore.exe 28 PID 2968 wrote to memory of 2136 2968 iexplore.exe 28 PID 2968 wrote to memory of 2136 2968 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\43168324777e4d6d5be4c78236826cfc_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2968 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2136
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f5725120639ad941d9a248f183a140ac
SHA190804307a263b082b924b123f30419d9703ad4f4
SHA256851f6d632925b88873b62c3edfe536f07425647f41db53b15718ffd2207dd976
SHA512e2727f1a15373a087de7db8ff3186dae863590ab49ff0b18f6c63351c360ddd5a2db19b131e8232a1286df2e37922b9b665186bc801b611425d59981aebb7bfa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54b334dceaf0e931b09031ea4178b164c
SHA14ccff99a3f992148baa08b83a88445aae38ae20f
SHA25698765b0fba119c31dd2b139ec140ef53c2bfbf14f3b64e343b44b4c9bed4439f
SHA51232858f0462252f7d0e6c2a2634880295800280d7945b653e1c200a65b2237acf85201cc29b412084d186301b1a8f36e4d05c8d1322e09b2bfb848d1e8a62db4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a024ac0249f12d437a8bfd32ccd11191
SHA12c42958e4f307384ab0574aa82e237cc72adee4b
SHA25640195d077e0f211717e8ae052809af93740fbcc8e04fdbff64ba3e2fe7533d6e
SHA512a8d86c1f936bd3c196c470b40f9bb6bfa35d3c2c7a548ac76da256d571b3162b047c31e52e736a7f0f137ba1c87e034c48d39fed22a689b4b1df69366204e69e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55fde9c88f581da075f7f352f367d08a7
SHA1e44dca612bb539fb04e7ffb62105068f0ff97c41
SHA25693a49d52538525bc2e99e9eba098e3f465feba70ff53ce4ab39fb687f8239c44
SHA51221a0eb46b1ce67b77dd7d923b9df32189be0c9b1674d18afca654c0ab4cb4c0585f012890138d0d891d83de45ed4129e4377f0b3373444c06833420e6c0cc833
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD540dd1cbb5f7b34228119aa80a0a42710
SHA16a49cda13568f6ab582b7e3b92e7fcdf01ff48a0
SHA256aad79884fc77daf1a35b14bcff36331e7a4d58eb2ff3493daff38fe1714b87c0
SHA5120762a128ba2eb838bf5894f6e3359251e719ee4f443ea961dcd0f32769c01a9f2fb499f2b8c51f16607256eea4dd74df8d2fb8bea7b294858e797dd125485593
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f907e60ea435d563d60330b3892e1e56
SHA1733579c7acd022046a2dc96087132a454b75406e
SHA2560d0292221257fb4412f7bc891a49efa0715ce7b075fc8c343e8e51bebc4467af
SHA5123b585257c64fb17fd42dfc02bf7a8aede006c26a2fa7a854d725da1a20eab7c5d67129d3df705977e97ca7121d5fa866cb9d06ca6c23c76079208f10f0f3e8fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50931a565c1bd66f467f94831eaf4e272
SHA16795945b250de2e9128c4a7e58dd7987a7fefaed
SHA256e4ff01303630242cc51d0369faa5b33ae252f843102c601a9109eb1afb7e1b12
SHA512bd0ffdd3058b76ab97fc6906d9c7acdaf61ba15f352116639247de9a23313927a8ca452c939ce72c3f02b55ed3cc47a99782509947664a09c11d2bc787ad0672
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57e13b1c7782c71a1a3ff9ad0e5629dcf
SHA1369246d96b9fc10991887f3314f1049f87fe3ad8
SHA25685fd7193b1be41562508a28b253e1539c26ef0a38d9305244ff414463381bb03
SHA512233a53ab4790e297ec117b0dded6f83ae82ed9be99ad4b9374f31d273c5b8a1e107cfbdc522d8c8cc9988cc79ccb1c87d2e4f6f56746541e595568bdcab1bd33
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cf1683264c6af11da0dfd1cb2092e584
SHA1e03a7dbef39c05bacd16754ca3f18d77ca909fa8
SHA256ae8049f8c73a9012056d44d6e48630ff25d2ea6f548f297a823fb115ca923bab
SHA51244e4d0439d81bbf20b8038867c1f5edbadfcb15324b374df8460181921e9a57c0f228060204426463037d0dde2dd670b88cae2d389c262b7fca1cb49d8432361
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51079f4eafa35f2176daab2c2ec2fb2d2
SHA1195093baee21cf9de83ccd4f65dec73cd654124c
SHA256e54858b5c384346aeab2bfa21e0ab5cee914ddeac54f7d42cc31f5b7b32e7b40
SHA512fd6a83316729659ada3d806abbc7f254260e8168c522bdb28653ef52d047faf0316af5f1ead72a9bd3b73a0f91902a077a8e803e330206c1b4e8756b50185289
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD572e488b8760c5475d387e11c4c5d4e77
SHA12a5efea85a022f518e9fdce9a26fad8ddeae7089
SHA256c9e77562cf41d81d3709bb5818e5767cfa7c93d03eec3627639d32065bde31fb
SHA5127eebe47ea4aede81163a6e57f2f2f86edaf6fd4bb0d6d7b603930207de2023b98c66810981d146bf64bbd24a0964a13a6bd2acafdd52adddaae3254b236494b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD584b32d6d715e1813b73937a482df686b
SHA1861524ac8a8b0afc8d72983fc461d16e5b427b11
SHA25698d8f6801cbb24c9afac3da65c9d58dcdf33b4986e48d265cca9fb45972b5493
SHA512bb0b1bea4912dc5fdc8c84098c7a81a978633a9ba6fa95a0dd012ccb898dc824ff8b425786b71a08e5c52a1e7536703f06e62d491dbe2ee0b8e65e8d14799973
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54433da1886d7d9d18892fd9c84f8f0f7
SHA1f49531bc63933bf3c89df97d35fa29ebcabba52f
SHA256069a9f792643f30b62acdc5623a5cbdc4a8f5d14aa887f94de2a1ef0fd7e5424
SHA512a3273179cac130c0176aa8faf904d65dc001557f0d81e17c97d1c5360861495a9b43112ed4d424fb6889926c332f626c6f37366994849b0f5404dadc383f256e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e4458faaad78ca9f1b565971a88dbf64
SHA122edf4c513d4fcd8bcc024e0028c87964df2a40d
SHA256256a11f0368b87bfef92990ab67951db30c47e90a5eae1c200aa085d8c45b544
SHA512b7d3d18a0d4505ccd865b1ff819b9cc624369f5958b2d8feb10c01783e2883633e86e89e9546e19a5d8a74fb9b828526547492c50b771d7dc9dbd3158ad22a05
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53a4811c6e397d573265ed22939ac4524
SHA1d05d3317345fd9c53eb7427d396e241c89876745
SHA256fdb60ef6c80ab22b5749eb3e37bc9740d75209295ae28c9137ffdedc84e30478
SHA5120b7b8609c802b95b2b4d563ab14533756c5121ab6124cb1d224534814654178497171948dbf86bf426504a9a0b10b7d62609f4b455848bc44060fd1b3078965e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52442a5ae6b4ae4b6c2f6df0ca5ffb4c2
SHA184dfe50627f66b46702db4f89722238fe7ff03f1
SHA256f21d05e2ed77277905f214e4fb3e970faa374cbd595bdb4797d3430f06f51a0d
SHA512dcd9d74ba218ea0abc0bbe5df2cfec3e89a15a40e0ecc7a0119871f33cacbbeb80e73428aafa273129fe840d49d46991e6978cb4cbfa6c78012089c573aca74b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f7cf48b9a819d0a033f60921732983cd
SHA1c681ae9f755490250df43c4430267279d3ef553b
SHA256b77fbdcd58a46e9894bd9588dcfb5cd306d74a90d1bfbfcc181658b7ebcb94fe
SHA512972696f706656969e65f62df4d3896a07b6ebf9122e36909dc643cbb8acdf76398077a285ec90a33f43e7fd24b9f8e091dc2ea7385599139ae8aff804897461d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5649b6981047a6f533c747ea2a6adc7f6
SHA11ab8affbc0da59d74c5ae520ae149b202cc6319d
SHA2563d3898814f85355f7ed69b2d4bc495c63e943fc0b09afd593a626d83d1eb1e16
SHA5127c599d992890bf8c2aa1e29aa2136aaee7623c781f98e96ccfd82f23788bc269d1d62da324b7b05d916ac9759f9231761c27c2abc5f963854378a5ee4e1456ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d0d5fdfbfd14170a6b95608dd5d1a1df
SHA18d47f00fb8501f3c6073114ade1a58a4550c7067
SHA25611e170f01767df21851b1109c9eef7fbdbc56a27b07eee23010ff082b92bf46a
SHA512a8e3188c231582291e2c85cd5a7fde3c211e8d9f8f318317b99c8943954408ff305040682dd1ea382cf03dedf881f48e311602f89f9e32ca377997803dc5959b
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a