Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
15/05/2024, 16:55
Static task
static1
Behavioral task
behavioral1
Sample
471f122adc8f0a80a5c748f78532ffd8_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
471f122adc8f0a80a5c748f78532ffd8_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
471f122adc8f0a80a5c748f78532ffd8_JaffaCakes118.html
-
Size
226KB
-
MD5
471f122adc8f0a80a5c748f78532ffd8
-
SHA1
9e464221a9acda095f874d3f0f06973df3988c36
-
SHA256
deb9c1a16a062e01d69e4787dd613b9d60a3102f670e0660e9e4a3ce7f2f7523
-
SHA512
159ccc175d6ad8c0ce597ff0539a7cb21eb7b69d94e0e01b5744d4193e72dee6fd67a28af04133e56a59d880903bb9663163fc367a64ce9d41008f97542b05df
-
SSDEEP
3072:ShoyfkMY+BES09JXAnyrZalI+YuyfkMY+BES09JXAnyrZalI+YQ:ShlsMYod+X3oI+YLsMYod+X3oI+YQ
Malware Config
Signatures
-
Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PhishingFilter iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 20c4deade8a6da01 iexplore.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3082c2bfe8a6da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000bcac7c9d52313d01a3b5a4f8548004a5d7191b6a8833468a4c40167aeecce986000000000e800000000200002000000070d406d37c195730f1f157ceddf47491dbde30fc965b71dfc4f056cd09073d8a200000000d49e74b11e8037d3753906cc7b947119a8fdbc9573ce68788d2783f18644bc1400000004ad33cea0e49cd637c47889868d0b7718177da505d76f513f2e1bb79f7adac2192063acf9dcdea32269202cb801b1514ad2f3eec813f01cf5da10f219fb7edbe iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421953989" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EA87F861-12DB-11EF-84D8-C2F93164A635} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000007a8d0aeb916eaf3ee67502b5b769bea4d8f19e0536840b8c17bcdf437e5ef043000000000e800000000200002000000012a4b5a195977e494ee30f26607e46872be3755bacd90448f0ae65be567655ec900000009631ab2e10927c4cd2d84b7a825a6a1eb5a9100292fad3dfce5b850cf46fddb102dd8565c192a9bd796257e74ced1ac856f53ba85abe6183ee9bd733afc0b96db58a729e3cf983a2608effccf78a3aa9854a405faa92307cf8645b5d05d536f070ed6b061711eea72afeaaeaf51c3baeee14e36e1f8d0b765fc80236bf81c4f44a0b083874e21f0c0fe964ffcc9e46ef4000000034a2c4f5a465f262793b65b17484463370f320cdc9219ff4a2cd3fc2b172b0dfed9de99aa32001298f87a6ec2294609cf9a532ffb48d80540422c6e62d69e8c5 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2068 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2068 iexplore.exe 2068 iexplore.exe 3008 IEXPLORE.EXE 3008 IEXPLORE.EXE 3008 IEXPLORE.EXE 3008 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2068 wrote to memory of 3008 2068 iexplore.exe 28 PID 2068 wrote to memory of 3008 2068 iexplore.exe 28 PID 2068 wrote to memory of 3008 2068 iexplore.exe 28 PID 2068 wrote to memory of 3008 2068 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\471f122adc8f0a80a5c748f78532ffd8_JaffaCakes118.html1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2068 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3008
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a2ae48db417d2d5f39f0e0bf413e1d38
SHA1701b85d51a9bbc82927786285b0b1e4e1e8b8fdf
SHA2567fc696a0a9b4420ffdd01e5d1552fd72a936a7b7573acb0f557c8dd15efd4797
SHA512e875261f5e7d44f81dbd41917a57d9274e12998d9a9e8dab32cf6fb13204b6346c496a98cd05278bf5b0e8f7900bb8b77d18e52486b07232ab5e62aa2ac90f8d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b04a1d0c10cd9e55af4374bd5c309fe6
SHA190d79f8421fe6f68718eb2c3fb1c94e665bf6475
SHA2560c7b0770e4699ecc7995476b1dbe48fc19efa87e30bc5f7b0f45952ef0f3e156
SHA5122e1bc2ce5798f082cdec20498dbeda41b8fff48ecd8814ef20acfd635b1eb4c16ae6719c08324bc5f46951bc6b5c235b2a675d992d8897fce41584b7fac71292
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aa6ae9941541600b277c5e36f8fb36a4
SHA19c740715486178078ad0325158f6b8ccdf866085
SHA256bbb3fd9106570a4569aca3a309a6f829727951a1890d5ddff3a414e6a228ce1f
SHA512f2f7a8e67fbeccb53c70cc8003a037a9be011aa1fd3e9a4c2134d7334267fbad03a080c514f7b899c0e0b3e27cbbeaff50e69c2b268aff061a025dd9afa1dd48
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5477762c8c924dffaf163f314ddd9ee0b
SHA1a1a735a4879dd019cdfc877990619af736c78ae7
SHA2567018e2c670f0df8b861f11f40afa6fb997992eff65397d34daaebf06c35a6956
SHA512cbcc5aede7be90f1eb380839f5581e8a5f0be133cfc4e96a8e5e3f1e87df82b1bed1d742b075e8959b5f1cdbdc5069ecd92ba10fa89337a1d176a7507a718ff1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD546102555e0b9ac34681ae8d841421170
SHA18b6d86a77dbf1ae54e752b2c97f19c434529b3ff
SHA256c7a90e576e6a57763a6da29c3e9f6a04dad6b2709e78480d4d731e443ca29b72
SHA5127eee404e112a8a7af19be723314a8a41c72f4fb1e0202d315d0649323eaa333b618d4f436c8aa1de64eacab116324fbb5dd7d8b12c9652b9caed2cfa93b2132f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f14b314608ccd9d56e0da87ee3a9ea92
SHA10d57972b29d7f8a55a32acbb446fc6f7671dcd85
SHA256cc81d48c2cdc3b507a60429ceb9752f52d13419cd10d735cdbcfd145937356f2
SHA51217a72194eb6fb2ee342b6b60d20538a4fd9d3fcf4df6ebb7ee16a9aa4624f471c073467579bfdb7b4213c200bb53acefe28964ae30fb3fff6dac1bf7893c95d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD511414009f621b6264f73a70e67e7224d
SHA12b4f5999eb659355969309b576867de6dfc1ec27
SHA256f462c6ebc8ff68539f4dab02e8177fe629d6d58a2ffa130b8a1ed680d3c03e0f
SHA5121f36c7867121f55b71581c920dc427fe7794c61e401fd0ac4f4c77b1e0d452d175fc231522c7564f9a42344c3f512d45aa013062bd21c51f30975d3927e7c832
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59f2a098c40c1c690c502b129d2353b38
SHA17671a383d2594a813f12a9c82fc82ebb331f8836
SHA256f67ca23844d2e0a0549a876993f648c8a83ab60810fb0e52f96db34542f7d84d
SHA51274a34f9cdfae429e0eb22ef6c7ba6bfa98081f548a231d48dea8828e0bb8805a0b2ca0dd425a136b87bfe56e7768370ccb8d6dcd78900fadae182095ac382be1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD552f36f50635f19fc41c50505010e59c0
SHA1675b54f9c456c14f19b11daa115c5c19f4650f4a
SHA25646a005153c77de057d89dbaf175ddc5b46855d20af5244983f419d69924834dd
SHA512a900d3a3486378d68f788e78e1cdad82e24c76941951c445a79671951ccbc8a3e44d21dc3c66ebc6796e0c509e793e6277f367ed232c69b594d2a21b31f0ab7f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fea5738f64e4ecdf322ecc99b70a9ea7
SHA134a459c7780d728e20210719006f849ca2eafbbd
SHA2568c97e42d6e6fbf3d1e6ccee099269b6688c023ecdcadb6273a04abf3c0c76ab0
SHA512c310493747a9164f4c5313db99217807fff1c9c1b7bde19754ae966307ab98adf9b6533f409f497e83b7af94247f807a7838ae147db56e025992b783aa1d9bbe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52b81c3fea0d7d47979a5c2c2be959c56
SHA16a1d154ac8046fe0f2c370213fb64e5e7f94c141
SHA25616a9fcd9cc180c199f3e958b781f21e240388a6a256cec8c7c9636b09bce61b5
SHA512cb2daae074d9d3d27a7e34661cd363d819110894b9885370ed0b62f80377f5821ebe8980b8c3d8533df794c6e177e668e7d8ea42cdaea8631574b84ec1c23fd2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59ec417ba09dc091bc4560447004e4c49
SHA18b67623bb3fc76e9d718c8504aac32b8de40f61d
SHA256554d4af6b76d68be30366283205684701b9cff1588202e05303bf6d707e5e12e
SHA51292737165fd7907b649159a89cae0028dcf92fbfaab75ef71913fe38102e247e3e95aa91e0fe7f43914333c6ccd0f0f87cd1b83d41d1e1e6f9af02df7581726d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55db027f32d8c4c389021e136032ccfbb
SHA1ff203140d039d16556c722a8a7b2c14ffe713ac1
SHA256d864a1aa985e2ffaf930d04285ff1e965589aa451464223dca26208c59aa3a0c
SHA5126c7652316cc0db1c534e80dafd3167306ea333b8b83ebd998ac17e75888ca076bf4f4a97d7f09bde9613ea467da3118789dcb6ad2311e36a4f0b2d4a7ad177ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50a5837fcd009bbedb37fef248343d8cb
SHA1c79fb6340eecdea758e93f35d5dea4ec7ad41afe
SHA256e0a124f7206b7b04438232a4c7fa5d5424ed48349074977653ced560b342a8e1
SHA5121907f700f20c92230b851d821766e821074d9ea167cef109b811383ddb28154dd5bced0fc71c123fb75a776107a1ec020e3aaa48dab21892cbd3b0f201a67ce4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54a690b1126783f745e4bb0c514cd2677
SHA12a2c451289a3dba1d800c7dfce939d67334cee18
SHA25648c4539a1e7c5bc37f04c753b5d6593f3696c00c4726edeeeaa01a53a46aea9a
SHA512c114268bce0bb1132869ae3df39d7a62ee50a6a52788a21519fad5b951c4b5510cdaaa80a7d3fa44a1d4b2f5248ad78fadea2dfca841b3270009cc5935458533
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a