Analysis
-
max time kernel
119s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
15/05/2024, 22:56
Static task
static1
Behavioral task
behavioral1
Sample
486e380e6825a906593a9f5bfe8e655e_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
486e380e6825a906593a9f5bfe8e655e_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
486e380e6825a906593a9f5bfe8e655e_JaffaCakes118.html
-
Size
463KB
-
MD5
486e380e6825a906593a9f5bfe8e655e
-
SHA1
c5475a7d3e47ae8166594708080fbbc4f869f749
-
SHA256
bf33d192cc44cc589f1914f23b3dbe8e294b1baa393d343ab5813221702e37ac
-
SHA512
a2f41c44b272d385ffdaf7148de47b194559c5301c68fe7386fa5d0019076014228f732cd1428b0547c5b6fdc215736c4d3ba01c9e2d47f5493c2f40f0cc0141
-
SSDEEP
6144:SBsMYod+X3oI+YOsMYod+X3oI+YzsMYod+X3oI+YLsMYod+X3oI+YQ:s5d+X3u5d+X3h5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000901b02b1d75ac2418f57044d0a01876f000000000200000000001066000000010000200000000bfe33ffba734932ce778bf2802abf3868c115e207faab65dc3cdbee557fc461000000000e80000000020000200000009da09dc7a464e0c9804a3f5d8d55cd30a4eb40d49f62554044cbb8e3c4886f2990000000ee0bb796412efbbd2d7ff9250c509bcf023e3731ad82f0f3ca4951da5f2d27a238f97ec1e4c536041a11543c639d55e9b90d58737adf327e36c1da64a9feecf4c8b57d3c24c20bba2df9bb64f576e2e4b1618e782716bdcb23a25e453bf7044d82b47c14d08d284252145a72373e406772f7b776ab721eab0411ef02a590783881c3573adb2c7cdc66aedaa8fb44d3ab400000009bd4fefaa447697044dfc8b009832c2c3e3b2a3c82bc69e7cf902fdd0e3855ca29a4fdd4b42449c125aae148a0390400e59bf617aa2e0cfc75e4eb20a8f46927 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421975667" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 209c1d3c1ba7da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{63AB18D1-130E-11EF-ADBF-FA30248A334C} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000901b02b1d75ac2418f57044d0a01876f0000000002000000000010660000000100002000000057a5ce2e097138762ef8dea6a7f8ab7e05647d9cdee62092ddfb3577cd178762000000000e8000000002000020000000b45e3cf7ad4e2a58efae49248f05fb84d41517222aa70a5f7ba92cb25a7ed8b820000000d990550423014a9686f8ea5dadaa0bd3f3c0dd53d3e20d0fc40632ac55a1b1a0400000006e9b64ff03103e9ae32bebb6ff189b4816d1317c7c8bdb0c2a1dc15272773ca1f3724ac9c0720776ea9193980f79b752d986d275c5fb1a4e18b4dfcafb24da3e iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2388 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2388 iexplore.exe 2388 iexplore.exe 2648 IEXPLORE.EXE 2648 IEXPLORE.EXE 2648 IEXPLORE.EXE 2648 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2388 wrote to memory of 2648 2388 iexplore.exe 28 PID 2388 wrote to memory of 2648 2388 iexplore.exe 28 PID 2388 wrote to memory of 2648 2388 iexplore.exe 28 PID 2388 wrote to memory of 2648 2388 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\486e380e6825a906593a9f5bfe8e655e_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2388 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2648
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD543029fe556f85342bfe499e80196e74a
SHA1df4fdc80ee32b1a53e5ee010d0e5d384c924d7ac
SHA25691b78fa882011e6fe54a831ab9d9231aa193dfc9f4af6278db329c792a3d8a12
SHA512bb92aa7ddc3ba1c60a26881c065f5be28594319fd06d9601746c4e16236af33b5bb40cf7bb09e336ebe8046f6c3223e1818a389a3b04274ea6cf857690e05f6a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54fe4e95b53f6fd3bb06b1ba6015bf4c4
SHA10dcc4fd7c887c17257ec5b7c14f2fa248b853583
SHA25682993561d111522b9f8966bf7fc4fdb213ea3f11b40609f3b09cfc850143e2b3
SHA5125f400abf5c0f2d286eeca0b9e60e24334594733c207cb4650090428bf78097f14deddd2b4253ceb9680d153725d24c70da2af84f3fc394ab1040c64f3dea85d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56d79338d4cbd226469d67e9c09ac6075
SHA1ecb9e579edd58d66b588619c8bc525c9b8e94ba9
SHA256550dcc647d0dba44e6d095be5a3a6e9b681d3475121be46734566007753a1c4c
SHA512466b8716fc95123db0065082b2c355194485c0c0a6a0163d7a20a9b3ae2a4635d6448e3f4ef672ae3c39bb7e582b6fda8ec6ecd75275044c3d3a9af1a14b7307
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD557d85eaadd5b256a060b69a69facb23d
SHA1f98878c86864fd12df9656146a39396620b05ff9
SHA2563d582d98675d8ffc24bc491bee4b242e33b8b4609db6ae0a02d8d53505fe45c5
SHA5122775e6961e594050f56e6da1f7e73acf062ac7712cf5b94f7a709847929ee88639c266fe32103062f078413f19d6a72a65a5fb6263bc4fc82227f75237c79b17
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ffe0b453356f69e3c0e3cf78834764fc
SHA17ba767073b4eb72e2a98c12f6e9ba1cc06f980f6
SHA25699f7adfdfb562ad79bfa0570f8d71ed371b6b9267af34f2c5f13b675d0c23fc9
SHA51281c11365ba472fb0b3cc472ff49be70f1e333b9367f886be596cbcec1026d02d9b4388650933f375fe4a1559b988612a61d33554bde9a5690046f81e93c3d6ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5de9bc08b37a16d384db5cd0d43b926f7
SHA1015e2010e2886d02aef9ba33916df2af0fa76859
SHA256e0de1581ea77968e786d830936bb885e2d6d07ca08e1c5695ab5c28fc723014f
SHA512a39da09577717e633bfa0576aa186dc8c43e7d86c2c2e904588116400310b0814bc3b183082e639aa60a462d41f52b0d29e34198d4b19344bb319c47f42b0e72
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5679501c3009abafbcec6739eaf0a4241
SHA1a426fefc922911cdb5acd1fd5d9110e437ff5fdb
SHA25656583fa4efbed453bbfd2e041e13d77f075275ae75504e22872e29be604dc124
SHA512f52cdfa85cc4fc5b127618a2bc99442a2646015ea70e6ed00609878bc118e58a68075d2972b6071f896c168892ef8372761b86c855bc7c597b0e7d983443e13b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53238d546617316f335b7a910bc89e407
SHA1fc3365c17579a6206f26b7a8439138520a495eeb
SHA25689530da76134b720e5cb6995c4003aaa5ecb7a91e73335e1870d0ff898e45b5a
SHA512d7d2455a37e2d4e4813a4f75731682789111c2953c7ce9ed31b60889d456d33f5b4e09b9d9b5cf1c2253808a4639cff39db8523fd56494447b152b80c372c052
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cec9270fc467c55278cb2aca6ef072f9
SHA1ed9e5cde407ed9ec30d95ec48c5cf832ca60e435
SHA256032ccb99f86a6729103098f960380315c6fc8ec0ce0d0ee1ac77fafc3bb4efa3
SHA512f361faa4f65244f698c079bb007ec98c146bf366608cd1c07f1dd3a660383f21ce5c65a9722894ce74e0ce44bd334457b6cfb8f90957e24bf128c46faf1986f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5191b8bf845e87b2d72273c77e29d2c5a
SHA1cbc76cbfcfc3212d255bdbe563cbcbf81142c966
SHA256549bafce36676be78d3ef5f1bbdfc198385412986fc5a68dc5160252c01f92a0
SHA512eaca2553ae2eaa71f6fb04f96786662ef04d3e18bb19afd25d79629840815f8b98a09f1cbe75905298321d8172012e58f701b57d4af3ddd4703ec5096f1ef1b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5194164c5242245d5aea4decf71204f6b
SHA15958ac67ec3e8e882d84707e9f385714c8c3a182
SHA2567c7e98051b1c0011ceb8832348a245f3a75cf775303afabad2216419c46464b2
SHA5128e8cb02551977abd24f981c6c86e10d82c8fc3d65e12f7ed7322d7e6839d7db806e2bf2b8d255e19adabf190f7d535a525bcb8e8a1b1bb93456de38d74f8f2fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5930e7af74d0766acda04e94acd87074a
SHA1728f188214162bee97a1aaf5e4327590c3235724
SHA256fa1795d13fcaba191241afd925778559b50c669f5d9459113066c9eec72c6e28
SHA51295d7c1f0324832302ef0d07888a5431e903dceb42a52cb9994e1b8e53ac7cb5452b8be1ffe8820ad128569233d9ae1d414955c56faed728e8ad29d24472988af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD514781f123b362bde8be7cf585431031c
SHA17269d9205d239630865fa5ff50898fd958689c9c
SHA2567bba074339d1058e3c78d87a6a7e7d422beca969c4d322e1ab47d87c5a5d7931
SHA512055519c72b11b53a1e2346df667c993d713f2af2a25f2eb86693de0d745f708847be720b1161443505a9282cac484441d93b271ecd0d80a62081c9e788d50a8c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5398e9e3ef50cbf6e2c3a7793e4941521
SHA1666d8567bc90cca7551a920cfdad546d7abe2d21
SHA2563a048c60b83242d98b2c8dfd0eb1e8d64bff432635571dd0f713165ab0451e18
SHA5126a23dae92000f5aa7b431147bd7c473a89b219877fb4f7c0403343cc2127c3ce1a5430e08b49433882ce3bea3dc79e6bccb06126a800397350fa3300fa169a00
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5efe353f1503378fbc72ee90f99969f5f
SHA196f8b824edefd030de95bd714e59375c998b2579
SHA256194a08a8a6e02d22579099ea984de6aedbdb9257cd723f31f3bcecfe85450163
SHA512f6eb11204ddf908c52bc5ea91a671439e415403e57d2c79e9ffb244852563104ffa1d4e80809c273901cce1c43c04535c113a87aeee57578bc8e9c75cff29015
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57f07ef9a3b55f2579c8d739fb3e42d3b
SHA11dafa523eda095af127800f93991079dc51a0f24
SHA2560127264500b8571d46c9c48dd4fe7b4423e8dba6069d6633aa522cdd9dc5c0dd
SHA5120221ce5c569a38f311d938025b61c17f4dcaa870a300d199412b44bd2151fada7ae64f6b09075fa47edd96218a6ca58d7d1f08c60bf514fda82fd6799ce4726c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5512d312c8729a7482e1f522f2d8bee7e
SHA104e2742b807ce39810017c05a4601d54eff634a6
SHA25612809e707847eaec523581ae278e750d1f306f0db2ea6980d4c1354eff85aaa2
SHA5125934c1dc6d5409caf6974d800329265e50ff1f9301ac6aaef0bc7ab9ebedff00c934d98a83a5d39c77602d6ba4d8ab025e505aace4eeb7c14eef05a015734fcc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c1634df02e16599fdfd87b6647f1980b
SHA1a9237654429e268b4f273570d92a68ddd960fd91
SHA256fe379f4d177349ab7c21cde3b8638a6c2faa57880cd04e01e0e384dd03883290
SHA5126c7aad2519da16159fbf8517f5f3b0b7231e158e14dab31a180300ceb05d1050c1458e1266d73ff25113ebae82b5f881ec634d5251ca721f93328efaba83183a
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a