Analysis
-
max time kernel
120s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15/05/2024, 15:00
Static task
static1
Behavioral task
behavioral1
Sample
46b2485994416611a560db1edbd02b2d_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
46b2485994416611a560db1edbd02b2d_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
46b2485994416611a560db1edbd02b2d_JaffaCakes118.html
-
Size
460KB
-
MD5
46b2485994416611a560db1edbd02b2d
-
SHA1
119df1c6a33bc65eaeb15b9cb3b013785474c7c5
-
SHA256
136801a8cb3add8a37f76a5170e798b8f4d75629936d431ad4f52e1c925d52c9
-
SHA512
e48df4eab981af62e04ecf91d66d4ac90ebdcd4bd41bf551d2297f2e7af1f1b5e5ccd1a5e265e4fbb9e5934655470dae6ceb3f1ca431d289605089055a9825e2
-
SSDEEP
6144:SDsMYod+X3oI+YdBsMYod+X3oI+YssMYod+X3oI+YLsMYod+X3oI+YQ:A5d+X3x5d+X3c5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D59130D1-12CB-11EF-9A09-E25BC60B6402} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421947083" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000000d5fa5a45d078571ed3565ab6db0b94c9495e9e1610fa03fcca1a135e6e91af5000000000e80000000020000200000002064ad8f64d200a936157cbb7910e7b591e35a9a29c40175a2b9bf1934ec531790000000d43df08ec8c3d5909457996e51853d35669d350a9d967bef2d2665624b69e2f20750af65641522ba18fa991d7a6905b0e16bbbe15cf4fba940da11e6775dd9666e6a99b80aa088f5dc24e8f72c9e5710686da242a34b643a1177a44dd29a605dc9505802a4d121e395026027611258986171498bc3cdd6c8839d96aca384fd2954792dbfd61fe110acf5212442594c4f40000000648f56d95453bd82d3aa0ac3e8565d537817e9e321fadff1553b665c2abcfed45d9104ccd60f104e32d032ef9195878454cf56343b10ed6d6c40a3cc628f5f76 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 907e78aed8a6da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b0000000002000000000010660000000100002000000049423cb81792abed196b437813d1a1c54b86a82f4829df9bedd119019702ff7d000000000e800000000200002000000012a32d70fc8ba5ed7371ad8f59b130e3731b6c5935486a71b16d83df4f846c152000000077647ccfd967f1c951a09978852224538128eff727f3c69a44e545b043575e9d4000000089f43db0d84e18f01ab4753f226f8b218cb559e248c28c2778c839ebb7db788177741b2bd3567b27a3df666e516010250e864b4ef4d1613c2e3d00f1df3c0b0c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2884 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2884 iexplore.exe 2884 iexplore.exe 2560 IEXPLORE.EXE 2560 IEXPLORE.EXE 2560 IEXPLORE.EXE 2560 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2884 wrote to memory of 2560 2884 iexplore.exe 28 PID 2884 wrote to memory of 2560 2884 iexplore.exe 28 PID 2884 wrote to memory of 2560 2884 iexplore.exe 28 PID 2884 wrote to memory of 2560 2884 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\46b2485994416611a560db1edbd02b2d_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2884 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2560
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e50e592380a8a704c8d10ec44bef5568
SHA1e1b403e9c2a31d881ab9e0c55c853165d42717b6
SHA2565e9afcd9839224270fbeacd38d10e3c25fe161cfcb2108b15cc37721a100cf40
SHA51241b6dd8645a3afe6ec828cea6204ba17c565fd2a9b41327d67dd9327c13a55f9924568322b7f13d9dfe93a918fec790fcb8647d81c4fd8315c186c518f2fb9da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD508c8b5d762ae519e7e6d2fc926db9b68
SHA153ee0526ef885bf49c396055f5ed6f1ba7eb5713
SHA256cab89d2ea63e3c41f1e591271b6debba6209071238cfaa7145803e8bf416eb9c
SHA512499d11ab398744d60f6e451a331f31a56f8452aa98b452ecc56d4032124218e4aea8278e356158496a332a81d3bc83469ed966fe261bd64df59b2581c9626bfb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5319810b12ad576035026ced6c8e8f989
SHA1aa9217eca882c284119fa560e15bab93493395c8
SHA25694f5e2a13324e79fe87d5ce1c02ed005da4bdb573a2a230948ab743a6baf37f3
SHA5124e7cc61a580c72968c484031e0cb7b4e11a34b814d6685a14f7ef4638effe637697be7f92351a68f32d202f7242c90e6217816de0a46ef0d84c3469c7e17e193
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52beaf7046ad6a177a5b9a8d5d3c36ca3
SHA1defa534b2d87465c4af85ef0746ef5138cbcbab8
SHA25642efd50d2b5de749074d04de59e9c9eb47b798b971919d02c1c0ddb07930f765
SHA512db00cf064bc374b35e7ee777457e10454cc6f46fab7e5dd5b4219fe6129ee96e320829d4cbd2ec95754cb91e1f0e482fa7bbbf4eac3a08be3e772bda7a71a800
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56e7a0953b23da0788b478b09ce517f39
SHA17315d033d461937c8c0daee04117a6d974678e6d
SHA25646a6f61e57ea3234c7d05e782c1ceec66622cc505cc51ba6a8f1f4f6010dbcae
SHA512540b828065bb282e90afb607bb353637d4557ca31b05db67272ea86d91e073388c30f26d4c0f6ad0814fb14c17db95a8b4f81f38572f7c1513cb03c4e3f621e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bbf941cfd63edce4620ea08fce965240
SHA1f1ff34a56990fd3ce17e6371f694156d68414367
SHA256f3b6deb24e0b0291b3248458cfb9de2d414de693cb11cabcc1259d85221a5fdf
SHA51203da4920327fa5c9208a6e1ca06a8b83d97907716c7d4e10e7872c7f8ffcf2e449617e2b930d0fce212adc77468b4c7c666cb6941c6d1f642767122f05af7d9c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e6b9dbf813cb8346a7eb1296a91cc9a8
SHA16903e4a1a644eb75ceb75fb18fe58a5ab11fe6b7
SHA256175354774e6308d9361c5b30dba6b047cd9ac7e03878b45d1d6d6b4a1e5c2ff5
SHA512aa00a7ab34d0a4daa54625aff1702433445e436aef8d78f2879d121cd515d1f201ac81336925ac4d2eafeb18b7131bca6eafdffec1967c82b0dad6f9c5695c32
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59d2df7d6991dbb2d0b533a32cdbdecc8
SHA14c7250b7a05a3e47186db740a57abbda25d6b064
SHA25623c4e345721d86255a17829a8dac2fecc6753295f4fd72c67092e87eb1cb23f8
SHA5126a6a15a65d90f73eb86a73ed7df7f43342aed340ed77ce00a9194253edff24b254eefb37be3d7da5a7d364d8117e2d2c2bb5c2ca207327ec46226ba15b18c358
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f4b2a24748f7fafdbacb00449bc345b6
SHA1b76870cb9723ee2d850150d0c05406703284c4c6
SHA256fa2ea48150979933e5a104e369306e0ba6c5296f0ef9f49ef2915d10c280c186
SHA512ae2b169feb8ea2a56d45bfad8ba02bd985c85ce5c6c5536d083f19e163a79b5a730e3b9c2baa9a39998b79ff8a2dc9dd567091f4fadb21c1a9bcbfb34b13cf60
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD570783695d2c83318106130b731dc8be7
SHA151543dbb4e491118432b086f130f3a779254cce8
SHA25616f7052f37c82213cd65a005f99f0e37e937fee4588cbcc5ffc452ee759d0b16
SHA5120ae08740df7e5247a9b7dd1f7c50424747471a57e3078c015dc9ddd40a63e2b6ff226ce06ffc1e94ba06b4dba0aca9461c5de90fb830c0e4856ff37496112797
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ea6eec92b3a0fbbc0e2999996be7fba5
SHA1c50e180fd5008c8e2ed8c82bd94b2d800bf05564
SHA2561300062f5c2ed226f413a70308073d33f2995adbfc3244f60b5cbb360454198c
SHA512015fdaba5a97b8cb4ec461a041d78604a2aa545ecbffc4b93c980acafc5340ac19f8ad722c425359cf8a4e16fc2094b17779b6ab8957aebae13143e995e20b60
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56951ad7798b4165a9eeb9c96a24c9609
SHA10170b3c084cd40089afa0a942c453910f5f460fb
SHA25678c6f947f3ecbda48f126762d21dd3c1b4ad13f3388549a4dea49e4d74892ba1
SHA512f1749ff7d198f8a546e28c235bc7441173b099291590dd190ef7e69b3f2a44bf9b6f0d0da3f304069866999bf292e3e8151fcfa8bcf1a0a72b1eee6dd492ffc5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d5b2612f2914c09b3a578802be4c4f14
SHA18041d2ac2e0eee12dfcb6dbc5ae81582a787ea0b
SHA256dd9c4221717eb2a81bc067b307a53c2fb9b847f4c9399dea79898ce4f2c49ed9
SHA5123a385615771dc004b0540b77fdf500c803589092eabbab24bca43aa3c938b19656dd5206ccb9bb9b13b6c72bb77d4fe6ee9174a28c3d8436561163aeff492a09
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d73269ec63280135b23a78a1e5b3f569
SHA15ebcbddcb7d59e07324103ab690668a3783df476
SHA256ca920ecbc146ff6b7a50913c46051348cdcb7246dd08ca456f5f92910d0fd659
SHA51213d92d3f19b9fedf6fac21552a47a4894acc4148b07a5eb8806294147a6376b60e364f6e4fa80048a56b6138de54127476d9d00f1b2cacb3406c906f82a29491
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD529626bcf3061fca45e3848d5069d0c37
SHA165ce2b82d932cf746a4da50e72c6fb47ec75a9da
SHA256e067f7d96f663ee7daeae5895da6e739109e81d2f8e712fe76219b87de8e13e0
SHA512a88f67c6a88856ca6f563a1f32707b2a65f8689dee01820ab778e62f5b0d9d5db2212c649643acd952a4dac9083ebea59026138b2810a55527b70ba51a16ae5d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58e8f2d71f0d05d66af9f72ff6d5c5ec5
SHA1f631b4514a4b0ca22c07a10900c97b6d2f561189
SHA25638269308546675d7337c7edcfe1c737efdf685b5db0b319748e2e7bc7b9f2419
SHA512a177a2b0bc0b929b3394d8e9b13848f3eacae90ed8859bcab213fb58745ba3fcc71daed1ef3a68cd353ecbc038821ec7136eda17144aeab9d6163d10dffe0a75
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a04d5c0cc9651c353532cc699cc1692a
SHA1b21bce644fbdc924725fa83bc17d1cd46ec58ae9
SHA2564e67ce25e348ffb38fa49811a89a17d08e85f3b23c11ec535880354e58551da8
SHA5123667e7ecc72282037e44f580364ef23ccb5d1ca69f4b75899349074a3061d041236caa5fd69f0a6d76b07a5e731aee1f7e7ed6e1d0680873dc4614cdae72cf7f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56f38f5f3b2ef82e4a1cdfc7e05807375
SHA1f7c37f2be52b80f777868dc5ef187e96efdfcd54
SHA2568d657285397309a616a17e1ebd9f9debe515967f2cfa8ec5c590a423cef74f10
SHA512b7bd6472c86bef33af3d6f5830a187ebfdde94ca3a551620804f722613fa4906ca5324381a5169e83bc33faa1acdc8683e7ce76d70008b4ade088507ea5e389e
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a