Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15-05-2024 11:40
Static task
static1
Behavioral task
behavioral1
Sample
4602e4338195cd9086edb966754c538c_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
4602e4338195cd9086edb966754c538c_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
4602e4338195cd9086edb966754c538c_JaffaCakes118.html
-
Size
12KB
-
MD5
4602e4338195cd9086edb966754c538c
-
SHA1
62d873558a75204693aa88d86b92e780ce654cbd
-
SHA256
5769b38f7df2ead94a19f76753eaab8678ad58a59411fe3bf55b1e0285087d31
-
SHA512
1c9a3f02af683ab4befff13f130173c5c8e657fcf4f670cd4a19867800cc8784aedab6e56b78abb3fc80ab2ccecf36475b8dc2fce27f14397dc400fc300b0d1f
-
SSDEEP
192:QdRXgX9+Ec4lHyQsQ+bZU4rDDG+MlZbuUTdZZDN23/6nv:Qdk+Dfv5lGTdZN2/6v
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000d2e18708303a8b505faf85dcc4ca5194f03e2af95c082c2c294f992d437f4492000000000e800000000200002000000064bd0ad84dbf7e7724f5a6d08565cc8cee10696970a6dec877671aeacac76a5890000000f3fd29fb89128554f079c49dfc5aa0e69bf3f92acb22ba2d77562c75dfcfc5d87d34708376d33cadcf566d05a889a61b9020e22780c27dea82c5c5ecdee3dce6e4d1f6bd5025188c1ad5bf408cc029dc0befc21a3aafb1ac683482dffdb47b35a0c78af5e69f6c4be9bbc030de6762c69a83cc9c54cc361e9ec7eae1d0dc591e2e0f7275801fbf4af682174743d16e0440000000fa66d2607365f3e63e4514a3b880caa10b8e8bf83d74a41a33400b98cab3f337d34a7cbe65e156ca1dc85d3751d0b9ba2bc36fba79dc97529ac679a4eaa33d3e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E2AF70E1-12AF-11EF-8E71-FA8378BF1C4A} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421935077" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000008155c90641ddc520c573c380c89e40fa1dc281191209d5eef4c2f8dd790293b1000000000e800000000200002000000030d5d8cf43b21da773a4f903a79f1801173f3ecf559423e52198d5966073097c20000000999908bf6f9ea2016d47e13beb7dbc028aa48b244d4fdf4919437ca28754eb8b400000005b8977dfcdebdf26f25aa7cddf4e6c43027cccdb8afccd1182bbb6681a21345439c21a7c346038dd100e9da61dca108ddefdbf8ce16aeae96371538f70a43275 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e07e2cb7bca6da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 384 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 384 iexplore.exe 384 iexplore.exe 2004 IEXPLORE.EXE 2004 IEXPLORE.EXE 2004 IEXPLORE.EXE 2004 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 384 wrote to memory of 2004 384 iexplore.exe 28 PID 384 wrote to memory of 2004 384 iexplore.exe 28 PID 384 wrote to memory of 2004 384 iexplore.exe 28 PID 384 wrote to memory of 2004 384 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4602e4338195cd9086edb966754c538c_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:384 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:384 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2004
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD542e1e0ac406430dd6cd752d017ddf4c7
SHA1ae24485c3991858273c9aec7b7cc6d4c1c3d8215
SHA256426d85b34541c8b86d5a02065f56a865e5641418ea6188f022158bbd00830f92
SHA512865ae09c9e8c4217d1c85bc02ca4ad7a252355725c0dafc3d83268fed485ecfeb851e7d6e08cd5cc4ab4a409d05f086a0048feaa00a10200fef76730d8b67028
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50c401d8c8658f900766e26d2e5d3b623
SHA1d6462b3c59f48d0884210c1a85ee8c488a98aa40
SHA256263c7eb8845cd7ec18b0725ba0b1e5f818ab784fbc22c3c42fd29f3a08411d90
SHA512556a09f7d50869d1fe5bdbd73604d95a7a46ac3d1d3872e9ab7760e139c8d7c9891bf71f7bb107356ef4fe59323efb8a7d3c0522576bf7dd00967df3e9f0a84d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54b2d67e7011cc3f16211968a8e87354a
SHA1469054175c382f87f023a400d2fabf805bdcbe03
SHA2568690ceb5e37084a2c9074d631d11fb6a592dfe5ff65a67a9cab8be8dadc985b9
SHA5126509fd675c7ff6cf707bf618f8648a3d563ec9999aaeb842176323165773d3a02441a6fc2ce59402acf3587c03fdc8f6c7831bbf3e9a7d7a1a88b783fe9229c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5442fc5349cfa6947b1b452910be9ec8a
SHA137f89a96d503df8aa931d51317bf1ba41c973f7a
SHA2567584ce9e93246520857ce7b314ee99ec241566db0333eecc232a827c26845d43
SHA5128b1f545998fa2bce1cfee6347d36e15c12082a03e5a46cb17f1d707d632d1e95d85ba8bee529c69b181150203f6628e6324ed92b66754a86be32faaec1980b93
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fa46c5a3ca855393877613bf29924e91
SHA12b46c8ad3f8851ee844c6f69f0cc28d8bb032fa6
SHA25674829a00656898e9d0409b6b66533a3cfec5e685cfc0c027c6acf2d53236077a
SHA5129f00c4c41ce1ac6cf5670aa0bd305fd44a7cde41b11041d444999308cb4c55b9d43de98e78a41f7df4c59801f41f15f02d1a61e32a3c78d70d4decd5f9f9bf02
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d97044bd42e760fccec66e86245e1171
SHA15e3fa0276b8d9741fadee844ca3a86cdeae7e525
SHA25604dc8c30138c331e6fb3aa8f6ac7541d7261beb57623a3a3135ea23112e088e4
SHA51205a87525747844780016245febd93ce7618c085f8675ffddf26755bc423bbf03927f5aec501a5370096a4d761240595c1e0b33a329004ac167bc47e001c4e7ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ca2a2b2ec651e878e864b5098ac4de9e
SHA1c9bc816d850ece49ca5d8ccf57b52ec8d2cc747f
SHA2566ec97d7cc1a8db8bc0abb80d2c635ecd55a7929caddc21e48450a78e79808d36
SHA5129579e7ccb2d13cbb1a6784c49d11c26016c1c7d875e38cb33139bb8e8a1bf7044aed06a2969ed8ed65525b127b397babefa332eac9acc2e84a67ceef9d4961d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a5d3bbba9b10abc80d353b8a24b98188
SHA16135ec48e40ffe834edc17535a473436077dde87
SHA2567e9a5f62f4a316a424f2af0d953b0e9066bddb6dced759ec2245236cf644f265
SHA51250d65d836df6ee3a1147cbb161a01e08327fbb0c1e0fbd154eb9e9259194d7bd860ada50d52e711199062180ad972f95296dd70805d06dde2dda46d981c5e97b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e13b69e92402d3b16a68e774d86e9ab6
SHA1b3215af2e939b2dc42f7223cac69cfaeaeb79f4e
SHA2567b0e23d4e81f1157bfad18c030c18a93f7e111b9875d070cd7dff0707f95b532
SHA512132fe24064c9b5921d1736d08501966e545fad4b66a273a272a1ea29047b7bec1326f203a81619a1f14418d1a7da45f5a290900053302ff2b141b6f8f1337ec5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57978eca7cc93828057fbe364553ef391
SHA1acd5cd29bf7bd04cc0d19ecf20866565340889d3
SHA256d3f1b882101cd17c47073e1f5d40f1eb4d64e4d67e02154835e85a7322c7a914
SHA51293819482434efe1d9dc18fc165471c14c2dc4624c0c2122b08385b43dfecb9dd8c0c8c206c31f5663923843738606748c0ba4e657435331a90c7774428505eff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5226d1f46f47b356311ec43ea6b42dbe7
SHA10d03ad5892502541129f056de471ec9afc50d461
SHA256cffe970acfd4f6449fb42bbb572b645070d7e648a79266423ca7260cc507f9fe
SHA5126ccb962e06601bd78bc5627c35d57f4434cec3121e635cd91a9d41f04d2876c1d8d14073cd1f28cc79246f7fa4e24bb07cbc0c39a72428b9629d4ff60b93407b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD513c0ec982a1cb436883c85ceb47b5b20
SHA164f772ade8698c0a9d1e25f422ed8673d6cbd5e7
SHA25655c8448644851a1630659d8829f0ce8a22e6ea6120dbe16023cf0750a56109e5
SHA5120b40cf4900976b2619705abe484cb8898466d55a5d6ac7456ffb6455ef6fc8f294d31c9ed44294a9d09ff6971961b051941f07721109e8eb27bdf9fe43b6d155
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5efc63cea6b07060f4fb8c6c6858da034
SHA19f5d80f3994139368b1f30d433c923daba11ec40
SHA25616e66f6a11b2415cf9810816079067c81250234f351bf2568c1c5beeb5e7a0be
SHA512d0da756c2836d3447d89ed010d2215b1aa5bb7c8994559619fa656a3f1142219bf4d0813e98c7ff851e8fbd4e6c522b26836e1c279eb55768c61b51a74c6918f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5660212478276478067782c9ffac97350
SHA1f79eca633547f42a9462d4da8422567b7c03eec7
SHA256ac2093eafbd30410cc4598ad64239690276ee656afea9b4503d6f5bd671de963
SHA5122d8e2c0e0fcd5f5263f56e7f5764d2eb97e248f89e99be3068ba52986f62998cdc81e88156e09af1c040ddb2de2590f843c304e9d2cd7443676354185ef0631c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b2188bf38c4a704fb8799e3a6ab6e1ab
SHA1d3b8ab19b8f562e0f27f29fc727b96fe83754e14
SHA25613d3404cc3d2ee860ba9bd5bba366e675377092cdea55caae5ab314aec56c109
SHA512bf2531d71bb83906ac6718974c2711c55c981b88202bd1701393cf78870b2188816b7c97e5c72207520de92565fd64d3a25b84d35547e3dd9b7aabbe0ab287ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58dd2fc579eabd255b55781d9e640ab1a
SHA1a3dd228b0d61402c57313cfc708f8c1ce97043e2
SHA256da36ecbc47f60331570e2122db25f06c6801eefec2e48688c9f9b535897d71cb
SHA512b9af2e2780300a9adfdd2eb319c3f59eb74f5f57727df1dfbc8bff972045f60eae80cd033f9227ec543e61c96da5b80d9ad16dfab57e36eac8a3ca229aea1353
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a01bc8078799af2e742d75554c0a5f82
SHA15d37ca41c4566706fcd9623e317ac6674e35fe28
SHA2566b3d27c2d8610e08eeff9f890722e4b7592db5032622a8b4cfdcf037228bf1a8
SHA51218cc353fe18c02453cf1736a758c33195d230c861149842b0490beb0e2ba953690e3d193404e06af825143be85802c0ada7976fc565960ff75d2f2ec753c8b31
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56a8e5b661f8977d6f2224d81b647eb64
SHA1d3154e23cd133db5a91ab0201a8e49580409cbd0
SHA256224b76db13174fbcf05d526e38ee37ed90e31d104eacf5ad68eefc512b161520
SHA51234c218250d7cd97702aaf2675358792b5fde614c6a7bb097e54bbbc7038f7387541e47ca723196f6f888d85cea28cb66c728a6592fe9c0ffc268f3c81608602d
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a