Analysis
-
max time kernel
139s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
15-05-2024 23:31
Static task
static1
Behavioral task
behavioral1
Sample
488f7975b40773b22bb3c09598cbfa06_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
488f7975b40773b22bb3c09598cbfa06_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
488f7975b40773b22bb3c09598cbfa06_JaffaCakes118.html
-
Size
26KB
-
MD5
488f7975b40773b22bb3c09598cbfa06
-
SHA1
d169982b98a77ca562a59aafc3e12b5418fa76ae
-
SHA256
c3d62983f130760d25f3b74a18443633b1ff7ddf49e68c8c558dbf01cc1fb251
-
SHA512
28d23ae3376b05593244447cc1a21ced879fd8de2be8c4dd22c2373615c16c04c5c5e23c95eedaf964bb3444723a398ac5b3f2995d8bfd1dfd3766dc3f621146
-
SSDEEP
384:BOydfwICUKoo+FNjWOqtmHePDQ+tT85DVAyOexiwGyRh6+pOYOXiYiOKM:AydfwICU5vhxx9rZOD
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421977767" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000007e6a90622144bafebba95080ce0579c9849164d3cabb35add8d053a7b477b5d2000000000e800000000200002000000055a108c28e14e5f13fccbd5ad59fec73e8fdc189ca86f0194515e8596ef9192e90000000a6b29f8128bae1f4c2cdede4f960ca490133f37d79559dbcc1506368bf5cb00b0d47bdaa654d580598b3f638b0682684bcf9c1a00e2d7548dd8c91829f841406874103deb7fca084e6d267310f1bd5f767a33af80aa7e2096fd8719d0936bac5481cdcfd0a981262da7e26995c77f8febebc4959263c6047a1ce89747a022a15462c3ab8346a371482bf8a058f28a7d040000000648113a6fefa8df529d4cf97d9c4121ddd584672fc6a68a1913f7ec66ef5fc4a46b9f6b36564f728d603af7a791fb6336a6dd06423ae8568b2c794f5f4e858be iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{475371A1-1313-11EF-A9A6-4658C477BD5D} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000000ea1bf2db12121ff9b8653258af659911ea74d68c23eb9a2f7582569c9a23bd9000000000e80000000020000200000008bd4f1a848b310e9e29ecf98569203c4e8d420edcedc0b5e0b317c5cf493aa332000000094499e9e14922a14f33a027b1c29e4ef434886a40031cc19cf245d2fa6876fdb40000000cede85ae71c24bf7f7840358cfe5e96d0349baeaf08eaa78562b6713199c4ed19684db91fc874d51464b8026250d5a95046f33b90dba52a17b2612a50ca9151d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40c0301c20a7da01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1728 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1728 iexplore.exe 1728 iexplore.exe 2284 IEXPLORE.EXE 2284 IEXPLORE.EXE 2284 IEXPLORE.EXE 2284 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1728 wrote to memory of 2284 1728 iexplore.exe 28 PID 1728 wrote to memory of 2284 1728 iexplore.exe 28 PID 1728 wrote to memory of 2284 1728 iexplore.exe 28 PID 1728 wrote to memory of 2284 1728 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\488f7975b40773b22bb3c09598cbfa06_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1728 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2284
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58fc00993f82d07ab7779da9c8342da36
SHA1155fa923fdd9648a28ee97448c6615f4f0a4415b
SHA256914f64e29c7165261cd0509bb20575637410404cbdd11744ddfb7d9ff710d7a0
SHA5122b6c31d3a09ffb722c6c3c8985ec151396996453b30a8060d5da89dffdeeb377899a6577f8a9dfabffe93089d5518924d695bd918552d3b3032dfc41f20bcdd3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD531279f75190bdd439312d4b678e8e893
SHA1e7855ffd0079b0a6d2f8318eba44449b3ee59c6b
SHA25663778d5bfdff48c298c60c8c768925d1786ea9d95dbcab79daa9e92f2664b0e6
SHA512e914631d2514dfccd2ad1f05a254013a8555e25a0dfd5e930aeb3902d18f14f0fdd3b7a61ec21d40c1dc715e1dc425b0f815c990d2ae473b19893c5897d01726
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53469439a113237c9f82c8b93c376046c
SHA1927488ad36cc2f0514fd619d5287870bb086bc12
SHA2561c07e3bcffd2cfa2aef81f3cd30201287fe1ce4be8fa4a400f8573fc268e1a6c
SHA5122fc7447502ef29d6713ddbf670c9ee560f9611b53b20a013f47a3ad2502b6fe6a7f6c6fe1d5de145119b1c2edafa6dddb74e17219312c7e698f1022d483fc1e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a1aa37e554a27947691d54c008c4b10e
SHA1ac01f8dfced07282a78443465928fa5c940e9456
SHA2562cce347b39b047e9bd2223ceccf9fc013f982b9f19064a4e25c783ed85300609
SHA5124efe50b08411217c049faef588972c3d35d258dc819d35692596217db9d9c1fd8f0f1fca48b0b6aa39a71eb73f376c08519ae2d31148472312b1c5ad6ccc1e33
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57312261488b3223bfaf2a8041c88a57b
SHA11e347f4bb1441142a9cc6bed1e1a6863a4eb04d2
SHA25608361f3eaace38810fa94208807dfe0627da7751a33644d3bda12ea00bc48c70
SHA5128e95ebc7de84fc49bfd87965f9d4a5960ef7196424d316ba55a552292939aa30cf7e462391bfe0805d8a1234d4446d9464a2a79524377442c047231627e89780
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a005037b0ded8c94316aab8665fd6eb0
SHA17d62f2f30ff2599beacb45d5d1f75d5f5cd8bb19
SHA2564787db3dcc8382848798ff425b73d89c5709dca0127ddab0336c207520609a51
SHA512c065383d7ba73340e4851a5e34d842cd2e56bd2af52981dc7b726e4febe7712e080e9192289aef4f45197fdc896a415698104ea3f274d2b19334b6e287a0e9d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58b6160199299cf8b41e88ed60a5bbe08
SHA18aff04be36f4ba4043c9caa15931cdd09dc2c5fd
SHA256ca2918f0a8e8b6bb0e75be13fa987810a29f2171e09bb3fedeab1b1ec378cc9f
SHA512b656c6f9c98a5b37e074b436e021f878441a71eba6abf6f9a3a7c299933db90aa42bb562ef275bda7f305091e80dff7e1eb277bcb5d82e11dc8a89116af237ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD536edbae884a4d0a4f83fcd4d900b841f
SHA1b1a270c4bf68251c1e044da23b563d86de41589e
SHA256553c13c5e57c60105d1c5569ff42e414c649e9b07a8e9838f5d41e2752e71d06
SHA5123f9ab544aee050a7794be1ed16db6cbd91ad971ed2990d8ce491606012f356c2643f6e57ac4a5e1e4244ed69e41b33872b3ff2069b41a3ee0d03c11dce552291
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a81450b6d299fb294868e6b452c32a7e
SHA12ba5065c3ed744bbbd829d2dffb735c81d41534c
SHA2563e071266ea9c27601ab16d1a51d8b959f8ec74da8f478e742f75ffb086f86350
SHA512c2ad41c4d5f3c752b1eec2c97eb4bc6c44db7bd1024b528f62b5d78f0246881174175be3612c0dd54d970586506069d20085c1d486077df3796fdc85f622d987
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56ae9b6c0eed3eac7afaca351d005c97d
SHA10d2afd523be815e3dca9db0207b81a5e9cea9fd0
SHA2560437c2db657331477c8a8430e05e2cf413ab8fd28c4e08b0cc6eb45aa6d2dfb7
SHA512536233108d54d97a62b83b6c926593246387d9c6e21f25e5afa4c2c5deb4b091ff6dda5aaddbdeb03fbd194b3b8c690993991982de3995cb73d22d6b84baa0e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dd1b39027a663c293ae70c83f10e2a2c
SHA138a6c00ca861c388a261a75bab7f498699983f84
SHA2565a20800c917af814f250e76b094b3be1db5af97e7c797c6282ac2ae9d09db468
SHA51293906203e82057fb6ffd9fa9fa5c832bf17f640bcd834f22a89a3866c3ed60536bea17988c2b45b35bcc7bdb3ce865b88f898322fa1cb8428e413bfe76aba784
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55b657cd4a13052d263b8c850802244ea
SHA14cd757ab5734a720f171b02135d921964a39d242
SHA256a7ddfe833f0e87d355bfd04ca502052fcf8a7535f375ce75161174eb770dcb6d
SHA51233caf7f329720d2bea631cae94a442096836bbbeca70a96c74591e8019fcfd36f11a537e7ddd650054db4dc9f0afc93bac5700b600d16cffadba718aeb61c481
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ec542b519beb61c06a346527cea65128
SHA1c1ca5babf57d0a479d7be857c5bdf5860b049cda
SHA25674a6f73839d4734a547d5e8c873dd5e9bc165c54b5ec079ee76758624bb15bb5
SHA51208e07d46d9053be6747ebfb64d30af91c2fa33f16176051e056456584e8d08674c7f59e073764a9c13f7142a4e429dd27ef0c73c195473f1ba6d079f0e8ab37a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55d81ea18c494af73aa368ba4942f7215
SHA1f8e55c2c337184bd9c70aa160cf3635c63dbe2e1
SHA25639e7c959327d211bff513db08fef1dc58ff0b2e12a3410e9996cda8007461461
SHA51218808e13a7cec709321381b7a67ede06258c7552b087dc8c04181408c4294a28d85cf7c1136706765d2f41e82baafd122763d90dfab94390c587c41da5c89cf6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ff2a01898bb7b7d31d298a990b596469
SHA1630428066842194736af91f423dec277f87c78ec
SHA256b307a9aeb14eedd1f9b01c084632dba213c0c74b937d1173af3decb0104cb580
SHA512123d97166969f32729ea976000aba223011fa88da7804a2015a4697fcaf0a168e43d5be39ad67eeb2ec5999f9fe6b4e6edf09a5cb7e0f2ebc4fdd8338a1d6234
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51c11ab14c13cc9ea00216d0c64ff3b77
SHA1f57ee344a2b3cebcaf3a27557c8d48d75dfe31a9
SHA256514249d75cbe41e615acb9d65c0c5bde9d5f8bba2e6b3e217f5229f5ade7f5d7
SHA512c986f8f1f8178fc7f3dbe1ee536f4a8d749f5e42f45446ae5346690ae384c814a9a3473399ae8af5c30e83a41ab5ba12e8c7428825c079519856cc5596ce6e6d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58d0c7db0770a5bb73086c0e0d416999c
SHA1283b902a76aa58a557ce2eb607cc37da9c5e7d30
SHA2567471625f1e87fe5446b6512ade1b1da89f950cf5c1770e9ed1502c4273ffb85d
SHA512d6c1e1c5e57a2f9b919ec64970630c6a6693ded301cfda6b8dc88c0de0bfe0b97e4d133f35250fd31bc17106093b2ee80ce494b53b6ebc69fcaf64c8f1a6c60b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c4bd03989cf6ced773fc00fe86e76edd
SHA1cbc790dfefc1200b91613a1c3430db2154856a55
SHA25643b8a7e26907d5730f42378d7b293b7c440a13388311fb552e45baf5d37c9a32
SHA512686795cf2d32c1d0ca065f0686e4f5daf2fe76b7f4313cbcd96f38f18ea52384c9d010ad96af08fdb0085d8630e1c20cd1f88e3ae25b40406cf3a9b0c76a01a0
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a