Analysis
-
max time kernel
120s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15/05/2024, 09:26
Static task
static1
Behavioral task
behavioral1
Sample
4585e7030154e76655b08c4db1ee615a_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
4585e7030154e76655b08c4db1ee615a_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
4585e7030154e76655b08c4db1ee615a_JaffaCakes118.html
-
Size
52KB
-
MD5
4585e7030154e76655b08c4db1ee615a
-
SHA1
fc8c2a03cc4dfca38f93eb58c4ba19e61ad2ded2
-
SHA256
3a65c089933c8d67778d056bd7a64b8cb0f3dc669746dbcae210d3e699995600
-
SHA512
da974319a8769be0fd07191377cb89e98ca337ed08d710916c05c3a8c00d3156c2403c770ada05be97fa5a719138086a6d77bba92b48709c94436b9bea5f42d4
-
SSDEEP
1536:4BaS6+jIcq5RRppqqddiiHH95OFH3LhsotbDdXbLM:iaS6+c4FH3lsotbDdXbLM
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0e47311aaa6da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421927060" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{38229A61-129D-11EF-8A7C-66DD11CD6629} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000e8b4b2c4954f9bda11ba1e7938445fdb277fe2a245a0a20faf296f94f08c2844000000000e8000000002000020000000171c6f9415d87a238863b2effeb9b58de04250ca8854bdba238fdc4c503cc87b90000000e85bd56c6d82646c8655f847a38ecbd1e9eabafa7bf159c6fac37c72ee98b5b377a0b2beea19398be1b50089a3c98a9b4c1ab7ea000d901a5761dc0113074df3defd968a64d3f34db3e16e57020135b280ce35c95a3c40a7659abf6b03c14a1172d016039b15c89f6a578645da3ba9cda4ff26d2d477a37e42c62d5bc59d087e3d356e3da45c18a058017f25e6c923f240000000f567e5e0153c1d29dcb8c3578675f2fd2f2a34ab644a9123a943a49ec40b7e01d68db32405fe44bd3b20c6516b886fcf9de87301e277f3390cf01e1b1b3db8a7 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a960690000000002000000000010660000000100002000000068b1cba4eecf41205c0d530a37a500c4dfc3e506795202dae68d7cc9d5c76bf6000000000e8000000002000020000000e11300b454fd994c6379ba1f2415206698de242b661acf463f5f7d32cc72f40420000000cd4c1a2d9a0dc5233db9fab5ad630a2be5a58156a1f62d36cd090106a9ed3cd240000000e1b3c36252345a95824fec8dd9bfbbb30e2d92808160081853bc447fd69fa834b91ab5692af1f9c405b3e8e4847def08648676e615fb2ea36268846bb8e9b267 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1912 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1912 iexplore.exe 1912 iexplore.exe 2868 IEXPLORE.EXE 2868 IEXPLORE.EXE 2868 IEXPLORE.EXE 2868 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1912 wrote to memory of 2868 1912 iexplore.exe 28 PID 1912 wrote to memory of 2868 1912 iexplore.exe 28 PID 1912 wrote to memory of 2868 1912 iexplore.exe 28 PID 1912 wrote to memory of 2868 1912 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4585e7030154e76655b08c4db1ee615a_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1912 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2868
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5b80fada7161ae63a92acb11b95f66b68
SHA155fbe60aab0d11f37c5204421c6cbf027caf29c2
SHA25655d0dd03d425930dc0dcf4a7077ca9f98daedd8239c575e3cffa933d0ca9d752
SHA512ac7aa1f7c03552845d49899c5235f6c047a5b8364aefbf559576625082305b0f421dee76c566f83c1c260b975e73c9a077891e6e2660c5414f1762aba5975684
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5b0cd483d59cca38c6781d63cf3157c10
SHA13b1ade62b0b9af6b298625db475e9417c35d8a36
SHA25623772ce4b9d57a0401d17f074c86eea69caf619c2f63d7f293fd899de964ead4
SHA512b03a7b60889c730131453ddff2d36c865d9624655572d737dacc1bc5141698ef4d31e83bd56ad00762c080e5a7db982071176b37e8116e9e85436b467d0f4a91
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5976e54f444a006fe1f49d23746685a40
SHA10fcf0142f655f641d1aa3b4701478a169424a2d8
SHA25634f0fb296eb25f0953fdc884225d1d3896c9c71beb2bd399b1a37996d2931305
SHA51236ade86283aac30f1b6f7297247bc275b4b5abf86159d66dd669ad242bf462cc962430b9970ef399325f29e0abdf7999ec7c2bce1c55a44beae680984ed233ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD50b614e2dfbd1fa69505c34f03347513a
SHA187885e0b8bc8d401045b6aa17b8cd1c33189d4b9
SHA256cab1171f8ce88f46e708825d9362045165d7747760ba510c51da27d41bcecb09
SHA512ac87a92b9b8769e5f007dfcd804fc464994f72f22a14842804f4a4cdf0185d89902a42218386e8340dffa783bddc0d91375f638f051665faaeb99d04fc4b3a19
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5ace172d91f96822d3f13f60bbe3624a3
SHA128bf8fec44b2f993968e10d2f4d99e2f57a9dd94
SHA2569ef27831b6e8505c5e5c278511d484cc92a022005311c26195f03471b228bfae
SHA512edb2768af9f0c443aaeb181ce1a92af80da6b9581c681bb65e9a544f298a96e77b3d150f26c41eb8f49861426af7c13469f6a4c1d1b3f92dc2403eaf9c575682
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5e1b41136ebacaf2bc3c4f4fdb86a801e
SHA1cbe4db8ac789fd636930b774d52aa092ae9453d6
SHA256ec62bdcec240ebfb3343adb8936da3994ee2ab40ef2c9961781ff22200303412
SHA512fa5ec7cba50857fc967167739ffaea34e8317f0351fbf0e4af3189274d4547e6b31b6e4d3c9f6644126e04a453cb73383641a6ddd32f6fe91292e1a8ed74d1bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD516bc8d1310ff298663a0a1112be0b351
SHA1dc089ba3493541c43a9c2dbd42261b86ba128e7a
SHA2564dd41267a0dbe6238051a816ad39c3263727905fb402798d3518d40f060f693a
SHA512416497888ea3f458c51dfb7fea1af911bda407bc79986f4e9f4c75873c93f106c6a52b4c224b5f5b885dfef2b5bdc0fee21e7ea184dbe82ee884797bd0881509
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD55f8ed4e18509dc55fe40737dc0e778f7
SHA1352dae7dec5c9b50198fb301e246331dcc71e08d
SHA256fa9100216e20a0f4b59beea11c0e7369dfda6225b01a4e94b7ebc4d8518fd15c
SHA512c572fea3b09f962cd8b56b2a3c40a3124e1fcf9e15c7992446228dd30b7622e63b1834d41a84f2d980e50628fbd06d0eecbc3cd427b61c30b84204469581702b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5f2a13b9589fc74dbf3c68f987dc12533
SHA134e5ae5b7ffb970e4e36a914c43ad942baf8810d
SHA2568c685f3851ad6f6d66d467b02efe9128f2d4edf0ae4d3915d62bfa7f6481366e
SHA512a581167511fcbe0ac9b889389b347d579ed3a02c6bf2f745aeba2623adf063e84aac77ec1c071b4817a432894606c306b869744f557707a71f0a3145e03192c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5cc2c5091b2d7d369813bf031969ce7ac
SHA1d9eee7eef0c370c1941c260f299d69875a40c52a
SHA2568871a3a03de655a0e79a561a9c817624ce020bc211fca3329232eecc075ef28d
SHA5125ded1f3a7181eb879814ea04097aac99d0a1ea873e8ead6db248c60c8f502e48de79f42396f4c475fb3b880b84508f738af9ce9cd562f4ac7a06d7eb1770628f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5bb9b54a31cac98b232b208e0880aadeb
SHA159c9a9bb4c8c2fc1c4dcb63150b49af7e4d52128
SHA2565369daf2b4a671b726c414142a18bc607ce6aafc34e40cd88c6e96f5930341c7
SHA512f6b80bdd5044681cf2059cc914a1b3bc1285f8eeb58fafc646b25d7e12a85e49d63426fb487560f7f5373c88c53ab498f5469442c3cb8c20c0bbdde80b30a0b7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5ec4419b4ae674f5116eb7c346063a553
SHA1ae63f70a96ccf939532fd109b85f9535282014f5
SHA2561272f2e9021cc9da5d8c4e0930aad75d96098acd7a4824f67853648443a6c9d2
SHA512918e01ad40d58ffcd054c7d78a4c66990a9e95b90f399a386050e258c89ec7be4c58fb5e986c364cb4057e98d5eb4cfd564e3c9744e68854b5efcd6a37e7e593
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD55d5bc7a755513816ec936c8865f9eb11
SHA1142983b6ba7a1fe59800e1e863487ef6dbe9e596
SHA256c21138160e6b6f570f0214b2ef05289501bad2ba098ef575655f123b75aeae5a
SHA512c58de1e95d89dd2a2d2cf51ec08daf130d028a960bdda5e06f807448c1f484527b287207e4b5793c0decb404fcd5966d1cfc4fa63093c404b49e2fba87af2a84
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5aa267084d809f3ae5e4f875f320ce66e
SHA1ba706d536726a6b0ab8770774865432940439345
SHA25677b19bbf521e2dde7a07905ff9ce6f9871d80cedb975d7a5fbe6109fed43099f
SHA512d7d6b906ed99488b6e3f26e697bc8365fcdd2d77e2f0dc3fc14df9006a130006bda16d783d7a1270c9d0898e3db96f4c5ac7b3bc45c5272f422a189fe9a23d61
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD59efb2a3e1450eacee0fa1f66079b6444
SHA1a464210a18ac4af7a45abf7c50f55ee098def14d
SHA2562d54c27d707ceec6eca7653c0e72a0ad65210a00a6d912e0c1e96c80c5cb343f
SHA5127aff560da1086b2963f279ca75a916d89169d661753f9939a652d50db56ca193ed0d744b732e3d34c548b170aa442e8465d0f3371fbb7234a1b69d2e15e7d9f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD53cd8437bfe960171a40094d849eb4332
SHA1285c47a5e3eaca105737bd810f6caa8a0bd9aa34
SHA256f2b4a5f981c47f13cb00b5a115107dfa78f0d04d74638956b389777545f36391
SHA512e35c03c06f71dc05710a157defa78b2f7932894a551729185031b406dee33a55ce019e03e6e0b1d42229e144a73dbd8fbc367b1eac00b72bb10871d0b1962e59
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5682a6b0959b0dab143ccaeaa75851558
SHA1e232119c13310690bcda701fe2fe47902a31b4d2
SHA2565b81c2647828f210fc7aaa6b20ca1a216dc1c73dbfbc70aed606594ec8f92452
SHA5125ea5156d072e4ee8c6bc0ebf7ec6c6b67fdd0b24043f5f008aaa87742f1ea450b570bc64c06620a8cc723500f10174313f99b6625d30a08362c9e2b0d9bfd8da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5b2b01a1b9121f3398067ac6c327b73e2
SHA19313cd1d8814d9cd9ab98b50fe76f58967248aa4
SHA2568bc8402e250d174c3e07caa91b281d64bedcee96a671e2cf0f05f68f8735748c
SHA5128ce2e0e748fd71ff6c32dfd55bb172cc00f4b1ff687a6fa3d593543a35876a6d11d95e7e8b82291c6c1f65b9ce8d65561ae5e663ee1831a4c3c8fb838f8ef79f
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a