Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
15/05/2024, 08:09
Static task
static1
Behavioral task
behavioral1
Sample
454009e407ac27ef6a0de726c2b234e2_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
454009e407ac27ef6a0de726c2b234e2_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
454009e407ac27ef6a0de726c2b234e2_JaffaCakes118.html
-
Size
27KB
-
MD5
454009e407ac27ef6a0de726c2b234e2
-
SHA1
e8ca426f6d216cc4905ff191f0fcc04486da54a4
-
SHA256
71ea6a7e37adb5193b9ae9431015ff8dfccb640e616a5c4694454c270bb2d855
-
SHA512
c13f67dcaaf84bb083701785538b3bb5719c3c0557247367307eb4b2a20d7316028d4b54457180dbdece7c557cd41906365ac3c7fd3e9b65671c3b36f7fe5ed2
-
SSDEEP
192:uw7Eb5nTanQjxn5Q/6nQie5NnrnQOkEntaEnQTbn9nQ9eRRm6ujztQl7MBZqnYnN:CQ/7w7CzcSHIM
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421922432" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e07550469fa6da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{71AAD141-1292-11EF-B195-DEECE6B0C1A4} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000006893bd4593b0b7b00827dcd3f900ed49a89a17886f2e189260daaaba9aa94252000000000e8000000002000020000000d342a357b6145160b8e4cd6f84aee8917a87995761d7a0b4a829fddec434797590000000fd658ecd928bdbac2e14fe1ddf10fd3b7961bf887ca68f9bf2499af37e7e6805774b2eec1c5522cece6ba1a6442aacbf80dadca610941ef342f0aff87a2e4b20330a91fdfc8fa806f27e28abb27dadbb314b9db17385a5657f701f152c4098491c263fe8c7bf4c656714f5139c28cf817d4be851267e54ddd81708afa51bae1a7b586dd6d09107be2de13bfff17cda23400000006dc1dd2573c9502f6dd8f700ae58d42dd09bd39273fd60120ce9744855f3381720cc9ffb079fbe124e25ed1fdc09bac0d87289d8a6d9db86ab3264f0f22aba4b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000006795719776afc902b34198ce4412d78df9780e1792e81d92c492a32ef28c0944000000000e80000000020000200000002aea40aa46873135ddb3ee85e475684dee955813ef3d251a0eff4142ab29d30e200000004d17361474dc8c9e94e1c73d1391e345989b6c227ece37005cb423d7e0e9782840000000f7c98f6f0f2b8759c03d83b52d330882da4d4e64a3b3f84afa3e86d826374ad5970f7d608a6ee46dbdfd0fba87c543c9166eaa0fc02830303c0602e5110630c9 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3056 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 620 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 620 iexplore.exe 620 iexplore.exe 3056 IEXPLORE.EXE 3056 IEXPLORE.EXE 3056 IEXPLORE.EXE 3056 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 620 wrote to memory of 3056 620 iexplore.exe 28 PID 620 wrote to memory of 3056 620 iexplore.exe 28 PID 620 wrote to memory of 3056 620 iexplore.exe 28 PID 620 wrote to memory of 3056 620 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\454009e407ac27ef6a0de726c2b234e2_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:620 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3056
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54cab7561558f4b8209526e481495e0ee
SHA11ce9d27d0c14a9cb0a2d9b0bcdde72e5de0785ef
SHA25692cc446ccc25ca3e3c1c1b9ff3f2fe011afa5c2d6ecda5c9219ef337d4845ee9
SHA512ef3df9849d839fbe08f9de437a249f38e2e261e9093d839f267604e73a385d6a8871c5f37de19621d771207f3901742683a216a8548597d4ea6c88590df5128c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d9d1764f836aab45af6e2b66720744d7
SHA1926eafdc13fdc3f48e5a10178c7d9531282ade1f
SHA256f1f7935ecfa65a2e48c8bb62520fca2d797d2296e2f3023f3f611204f1ebe28b
SHA5127cc4744419d0cc39654bbf82b9ae4f8df6975e84741744c605c55af61d9fc2c8c1fba8ba3685ad37b9a95c3416e28576446e448f196ceca87331b36b597cdd15
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58c58c46b495b7900b3386b3ab74cf4b5
SHA1663ec30a2858ce7740382e8e9706d2fead9ad5b7
SHA256efc21323794e98e4e2b18166daecbc7b04e82cfaee0a860a3453e0f68e8e326c
SHA512a7bd73056f86502714c9e6cb50a4d98a575cdc93ed6b74b964b2f4f8ee1f6a1790e58f2af51eb5dc392228024db810ff7449d0b8f520f9e9efb34ad28e5f3a46
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56de6d5316cc5e6461971eb2201cb2148
SHA131bd530e7e165529e30498f47822002628c88fb7
SHA256a58108d237543282f1bb564cac6ec04c5f362e66ef3c017c29c3807b619fa7b0
SHA512c5a42f50294a1e9783d103e5301cd311e9a40200f7d85021e672d6536e6e65157cc520c3fb011c0ca980f443dcd2e494966509d6a60b3ca65d08d31e8ff5e5b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5deb32a87f721476a96293a79ab72ff39
SHA12a14f65cd03669e6c2cd4b6fccbef0898c6b6a2c
SHA256810440de6b52945c249effcccab2e97f1ab6bc4db0cb2f2e45dedc6cf188c073
SHA51208d2dfd03a033aa076e6e9757638db34013f924c3e110f4656ce20d057637923b26eda132bb0273bd90a2c4caa3d27bfe63275aad55a57501df9abf4570c2227
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a4921ff9210cf1c46ca26596eed4c4d6
SHA1b247db5adeb54ee17afb2912e81a738369648acd
SHA25660d574085f4e2d2ee38127ff419194aa63bd9820c830dbbd41c73c1b6e609f8b
SHA512e21a36a0e27aea31121374d8faf7d64ca6c0adbdf1ac2206700060b8fd684467dd29eb284a57fa5c91852953f5aef2c8e4b9ca8fedde3f9da6936c93e8cb3e23
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58d9203bf36d3dc29f3cc34ab3db85d9e
SHA18f0d287e482072e5de94988cfd3203a99b6c2a39
SHA2562fee7f846b49c6857f5f9fa5a7d96cdd04bb0b62a6f72469ed4180b4504d3f00
SHA5120876db2e69f043404e33d23adc2c42ad7a7cba2b7be49ec752edaba8417cb9fd4c411e1c6ad50b55a397e972b19662c972e19caa2dac043e514d55607da8326e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e0ed0db609b00c693e914f82bdcbdd66
SHA1a0180874931ea435dc9bdafe14268756aeb27096
SHA256f3e82fba9fb9b1a395e20e7e68afb145878cbe41f9019ced49dad17a1253f616
SHA512c03b30f40131968fc883b89839d7841e661e1ca20825c59374b1699b94f67a3d8d20b34f6474b12c535026c9ba3378466dbc6eb17dd802590d42f9edc00435aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b47d7aa787a4954284a1cf9f0cdc1b74
SHA182c3872428458c2bd523bd629f244beb375ffc2b
SHA2562195f3fdf7ac95bf2364c568467f7fc02af8c428c117b993dbada31188c9fee6
SHA512902e8cb61ab94aab5da86b012be8b53a610da6fb66bfd9a595f613884482a1f77f5ee1ae24e90a1b1d1ee7f698dea645869a56c9643e6439c1ac21cbf24f0751
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55ecafbdb1e253451b362e476ceb973d3
SHA1c9ed0784ef4cb91e65f67469af0afd5387e08544
SHA256f97d270574ac1a53191fa157c3cbe27166e9af74d2bd78807cb31d250df9c6a9
SHA51225c8959cdd060f689df4a2893040245cd631e0f36e45fe1479ca25e521a499fae8abf85625d04be32f7403ee7d765b72d1acfc3741e6017201f4b07a2d5c08da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d6a0c78a34c7c7482f1dae21a65a30b3
SHA17aa4ae9ad7c982337f20e13586ab67b6a26491d1
SHA256cdc8916d7cd3c521a88cacdcf3a63fc05b1d962efe870b9c2b868666427cedbb
SHA512c24ab1b0e1636c858827cefdd447d55e50f20c0a221871a2ee582d16400bae3c1cd86e61863985c614d09243534e9ca9126b05a0bf51b70a985eb3ec5cf2f2a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5177fe90869934d4a4a44f940d41e2d77
SHA10d27962e94a8e6d72841297e5c80cb8e69cb409a
SHA2565219ca0bde8f23db3b290b8bba27c6e9684aa2dec59795dbc37e4fe4c2e7045d
SHA512a48562a98853fbdc272854dc541e8add9cc9e6b2d7386fc1b506ec477dfbf047688425c81c3f93227da5fd3771ad75a8161597aa687a2fcfb9b9c14d771f231d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55d339009cc8def73db70e7e57699af58
SHA1ee558881f78136fb6bafa71acf930078be21d4f2
SHA256af703889b876814ebcc7dc4ebfe24eb4c2b7c0322909ffff68f1033e168b0203
SHA512fd61bfdfb09c16bd7766055f679c1ab2dc8014dad0001228f6ad88ec694e125078f15a84cf83ce79060a148d74f22ad4880ea4259e5799b6aaf5deb0f7bd8234
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c2d1d4b51869480a9ebbbeb20f992602
SHA1477fd74677f88472eff90a9d8e7255916d5b8d11
SHA2568ccfd006aa96b4e796532ba18fbe20ab71d38335a26b1cdabe53015001f7dbf9
SHA512b325a9d624c11b26dbec6a9225017ed768fb9801048d8093252023e69b9de707e17f11c5425f95e43c2926d3d058e3f05adcec9e21a20bfd842d2faed4f6da7a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57c8d3671b573285259ad080a4cfe7b13
SHA1d67942afb08f1bfa972af7821b53cec92d9c2d76
SHA256d9078f864869cb3605fe143f7e313776ea0449525f4d6bb7988f407c9814c576
SHA51234722069ad14ecb5c7a58558ccd8d0b9f7b24991b4069f35e74e69853a188fc8d9e11139012e2b34dca344622493b5c775bfee4e304fb5891aecf531afb2af7c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57d08e5e9419ecda143ef766d0f10ed9d
SHA1f02617bec18cae1ac2cb114346b900a5c4ffee78
SHA2568f18276f2ec29a2ad1b162505da919de1a61e1b2ba102997d3422c084f4defea
SHA512a9fc9b779772fc882626b65d0dc7a0c98ee9c8e05363ed71e6f9bd46ee7b09b63cc44af8a8db2420a7444f4c03073e0b13e9942c72cd881885ed265ab4d9ab99
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a