Analysis
-
max time kernel
118s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15-05-2024 04:18
Static task
static1
Behavioral task
behavioral1
Sample
4481d0e154f19ed1908afee378e91365_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
4481d0e154f19ed1908afee378e91365_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
4481d0e154f19ed1908afee378e91365_JaffaCakes118.html
-
Size
125KB
-
MD5
4481d0e154f19ed1908afee378e91365
-
SHA1
55447cd9e17c7b0009bc1e3226fdb6c19c4c0aa0
-
SHA256
98831cb4269d458f80e1818a90852041f8f9ac5b85c176d053f337140f3a23de
-
SHA512
76683fd2c26f11e5e59e4620ce41f31c05fc227d1335d9b742f791f024bdee768c404feaf30cb2b9e276e08b832d0877958224a6b0360107f7a0ce81052e432b
-
SSDEEP
768:sdHGMO0KvON6r3qMeKL52CCCai8ihGLGGs4sNDoQgQYbxkNJyCMNWdl:sdHXOpjqMeKjgQYuDdMcdl
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70e4930b7fa6da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b0000000002000000000010660000000100002000000025dce699f1c6f63d4430f3ddab6ca833fb0160c07e3deee4be754de3f3b274e8000000000e80000000020000200000009ba805fe3569ac7896b1692b8e34bd3c3829746eade0c6b737b8b3cf675dac9190000000b8ca899eec64734465094d16d91179d7684a8b1ab4bbffe2438c6fa126b08d7c5a4b57a83a9d3639eba7b122857617f89e7af068d28734ee2b9a6b8059fd00ee0772b0a1e170ac81186ae32489a79c849b8343850bff56dd1e01f45e49ec81b419460d5b4a7d6265d5f518794921f3d2d53ddd5faad4f4e629c637a4fa3f42b56d35f6dd70a5727ca576a3473b45a70040000000ebb8e01baa99c6e1a301483c3a9ad9da03afda609adef2b3f39b4e63eff07ce384dd113584a222cfb78a599e97cf69058ca43c7b7caebe51a97b850b8e7aaa60 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3663F961-1272-11EF-84CA-6E6327E9C5D7} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421908591" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000887af120aff9038b685293cdf4593d86866a2f2138a2e400e07525a1608ad051000000000e8000000002000020000000fe64435ec0db260b41af091d4d03b0a274fb5918cc9c699e804f5881129b8dac200000004fb550c2e5ca53c2a2d22fd54e4878967223b746638bd1205610cfaece2cfdea40000000360a9767e1364b3d5dac16e54007e939455407efed8a87c590a6620bfd60e5cd0be1e5ac4ec338e0c89516215775e7afcefbb4f035d30c9fbccbce3c6c5579ad iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 640 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 640 iexplore.exe 640 iexplore.exe 2700 IEXPLORE.EXE 2700 IEXPLORE.EXE 2700 IEXPLORE.EXE 2700 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 640 wrote to memory of 2700 640 iexplore.exe 28 PID 640 wrote to memory of 2700 640 iexplore.exe 28 PID 640 wrote to memory of 2700 640 iexplore.exe 28 PID 640 wrote to memory of 2700 640 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4481d0e154f19ed1908afee378e91365_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:640 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2700
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD511cfc012beedf046f6f5299bc0108b8e
SHA175a011cf8f70b3a9495a42cd151a54759bd661f7
SHA25694ce5544fc1b525ecee058eaa9678f57ee15a2faad33924e7b9d8cb0020bbcf4
SHA5120dd431bec49ffdf8d1b04cff5a2a5d43233097e653fa7dc51a829f42e16c13a804527486f1ae804777024427af2e2103b7be821df04aeb08aea313e10198b25c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD598d77f168b153c0607cf004fcf7e4587
SHA1430ad5e04b1c25d6d2bf667729613617c2269a1a
SHA2565b85b823ece6292ccc2086b5c3a3a0ff26167fb8f61cda71df8569f066307c95
SHA512b949d0686dbe68f19df27788c480a102fa65c99205fa6bd99d6c674d6187aad35aa30f228f6655d22109d4b1e835d51fb90fcbc06becfec0f85b6b4a7ff21b97
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c7e86e567d5d4b5751f843c431104906
SHA1a55bb921fc98f3cbe32fa1fa83cb979c14d4a23d
SHA25616ade2f92b2c932aba8fe77f0b2b13f78408c878f9e8f94cd92d23dfb0b899fd
SHA512228bf9b1c802800c79ba60ef70b59b9264fb53b0df878fbedc413a7b67fbce5d00748b3db5d67fde9ed9331f62a6b2ab221c420a5165ba2ad7fe3975e2123401
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD526f6ab6f6975872340dccb375b1532ca
SHA18474175cd1b11c5440a6092b78979bc87c8d46aa
SHA2561bdc69c896672663b948f1eaa10569d4196d63d1a8da781f404ec77534fdcd66
SHA5120b31ecaf2beb10f0f068a97b44dcd9ae50093612d015a00281a644a62bb5032446bd6b29b11c07d548569b5e7fc0e5ca8bb3cd8b23f7622049a8c6300e2cfbaf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ed2f585c174ae14de2ad27ea1d705cba
SHA15a8c06f004aa68058bea40fe0bc7ec9e0aba03b7
SHA25625e8ae7768e4b9aa7f8297fd3e286e0c6bbe156cdb1182246c4df42d35d3858b
SHA512aba5719c6bc3da42c60d83c7ad88e7a5640370904465b6102950fea626318e652f502749f3d3fda08a6413084eac27b7b625a6884d1e49c4c4337cc85537f3d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f079f19130be7881bc910bfafbc1e193
SHA1230b1af06d208d7f3d29ca6517d514e46aee277e
SHA256b868029dc5e9466b7d7bc288e1f5a7daf89f07f0f4fee2e9ca87a7268b17981c
SHA5120fb7b817ac89b7d44aeb904614c3728acea45a95dc812bbae077432126632f521995a6688a32cf8949b2bff3ea1ce5111bc4b1bb1649c7c01218299fb4581373
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD554392e4e7ef3747fbd72696c7312670d
SHA10834e30a3060f8f9b0224052ff7b5446c317c84e
SHA256469e7de9a32f35d46c55173e5d85de773d36990a750307e998227f8c3e7984af
SHA51252e42963694c37a8c90e4d67a76e0e9aa6f2ca1216ffca4560fa05510ee0b5c1a10b2e7f11e899e9e73011c04b37a28d10b2ff5de8aa9c75e565b73d8aefb084
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a0bee58e53479e1fffe6ed355288f7ee
SHA1515a059699fc0241d382865bbe4a21949b811332
SHA25658e5707574d163a4ca991e391f09946aac53ee53b7015518f95622c33f202449
SHA512636bb5b76ba5893748a4ff89f2e4177c876478020807ff8f9ce1a69507c1002fff31c8f6abd6e39fa9505757a71aceebb1ad91246c4b6965509163cd02e520dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD509bef89cbd02204fa5f0dea8f8f0e2f7
SHA10ff5207abecaba539411f8f29766a2057d8a0c16
SHA256b110f2627514186b1c0d069fd0ec4c9c04c630358224e635b3aa149c15f0d0d9
SHA5123b8756697e804865d983f5c01d9bd498ca735867c3d8c72cfe37f9532494e6d09da08fea76d2e172bc3bb71207cea3d94904e935cd44eabeca5f7ff691239883
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50e77277225b0f0ef0bd1b2905ea39be3
SHA12843674e7ba2a72cf1cb5200dee2b519786e56c3
SHA25695a14d21e6c6f9b2820742a8beb02e061324610a680543833ff5d59b26f7be3e
SHA51284ec66cc70a20463a336f0f8909f608603c887d0576fdc5725b315ae178d42c4e0646e6aed727ebe675c80bfe7e2f1783869190ff85eb1410063de79b289a345
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56eed5260b0b1aac8844d5c19a56264d9
SHA1072818f1cec4d6967b97d21512e3ebea1a3977e8
SHA256ce9170b2be1bb7bb43164024bf7cf202bbe8232a54e5793014b079422ecef263
SHA51254bab561f8959612969106e8b9c0df1e584b4fc51af488cf65cbfed18b90dd62eab1a0eafa200adeab9f14c775d5ba87d201bc5b78562c84b1ebb5e4e5922ed6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD553371118498888853458aeb6ad61d511
SHA1065d7e58c3133672d08f8e0a74294d87dbfd01ed
SHA256c6f6dfc78a3bcb652946021c862a05c92ac61d488a94427cb2b127763198bec5
SHA5124b3d683a34eb7c5db9f733106fa34a4aea81a2f81638642047b31e6bee57a2f6c1f2e3d575fbbb8990bc9e11361c5acf2385aaf2109a81243f293630ad7e0857
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5872588da97debc1f445c77422bb71690
SHA1fa5a111da0ac665b939b7075b04c31970fa8b058
SHA25692cb26ad6fd5ca9ef62acb1ca0d6f5ec887b5f4f8970e4b98dacc29e54f01ed3
SHA512f2218ac07b175cb0cca14814012a5dab15a9540180fe5e9d96e5c73fcf630c5a8c563b0f7868549aee19ae682a9dc93edb84eb251b4223a0c443bcf9ac6841a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51b7a95b5dba3855d8e4aa5d40fe347ad
SHA173a7b8ff685b48ad998165c1cd9f8c23cc75c833
SHA2568a0f9c464f61f0e6c5ad41d0e7224b73c4c65155e1c3365d1d70bbf99e92b80c
SHA512c771fe187d9a5a08fc1e0373177682947bf480c5bd93808d718bd5494e7fb7c2b34f66203fdee08ccb20d2b48d0fcbd75aa958b1e64a4ba4f6bb9a05665ffeb7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f09b18df1f507c66ff55860d849150de
SHA1f0b95c96d06b55e9e746debf96470495f4673f7c
SHA256631f1df2311f5cb67defe3e8cc53c23f3465eb5339f7745e67f659505a18c425
SHA512352491af5ab689b492ec95c9bbbb56e8a677a8a03da5fdadaceee611705ec91b10924292e6ea7ea73db4c8071ed19c21bdf37bf6364816091744d7d8bfbd9de9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD568fac56c6f07167732e4f1ed73893b3c
SHA1e8b14b337d9964fddb56c6ff1aae80e60dcbdc93
SHA2562577f7e2fa77c4690154feea0bcc45f348ffc6aa6b9ea75a33fb0fc5df59ad3c
SHA512ecfd84d7254c2535691786d57b1fd3b62f299af23868517f50d4625097e2a3d9b47d9375ec985d03017e9346c46f3f0fb09037f6f36145647b34d565353289c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c6767c4b9873304fbc76d2d9db29cc17
SHA17b42c7ec5d7728bccdf9e9ddf95a1cbfb18b95fb
SHA2564fe8127a20d0372be847a2afc42dc902588abccc504f09a6d1d7dd2a7d6b6f11
SHA51246c11d63f2ffe825f635b0f7767ea00efcd4a48e5216039a3d033a17edae3494a35be808fe9b3cb25ec45f6ad84a1bf2d51514025c785bb1bd21ba5519a9be4a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d10cbe47a772d74c79d84f4aa0f5d194
SHA16083e66de9fe45ca904f10aa1420f0045fbdc0c7
SHA256c2fe62b162a43e0e589b0ca3ba3d0e3531f064ff91563f289a412a8cd90098b8
SHA512e0cbbca22a0cac5e32be5d222ff8e8acea9a489afece7397a16b577d296cc301078495da1d1ff87e20b4fb7c7b0d3b2a101db46cc0f29660db6bb508b6efe9e6
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a