Analysis
-
max time kernel
117s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 23:26
Static task
static1
Behavioral task
behavioral1
Sample
614af499b51a768b12458a29e25ccb3c_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
614af499b51a768b12458a29e25ccb3c_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
614af499b51a768b12458a29e25ccb3c_JaffaCakes118.html
-
Size
32KB
-
MD5
614af499b51a768b12458a29e25ccb3c
-
SHA1
44de78f79da23f927fca0bd7bae8de60a006e3a2
-
SHA256
b8987715fac37ae65db51971dcaa976f0782e99fa9e93ac59ed24bfc4c2ac5ce
-
SHA512
4e51fff823b78ea3f32381429accdd84beab638c216df559e581f53a40731abcca579a5ed1fbfcf4c923382a637d2ba5a58f5ab8e1c25740f2db49f51e59960a
-
SSDEEP
192:uWfNb5nvXnQjxn5Q/mnQietNnLnQOkEntaInQTbnBnQXMCaAUYLWPY6NJoky9t/Y:YQ/Jsk6P9NQt3j5OF
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000fc7a7248184c3ecd9a5b6527f0753a89929fdcf1cac3f5412ed71b286354f845000000000e8000000002000020000000d4d802bd9f1867039998c1d71b643772ec067a346bd1b7c9b6962bd152c8393790000000c297cf3fb5bd06ad5c1a8a39cdaad42121d87dbd0bfbd494dbdcb0809e9bfcf34ec9e4168f26c86a7529e1e10e9a14b541ec37614a571932c698c9be0c5e090e578fa00d2112fafceb4ae947b061bf981a08810cc6c53575385b941f106e9b218792209e51b09c527f8b72762550d1bd99585a66b2478c84d13a074857e5f3e0d8c30a369713be7d0de5b7368f3b71e840000000f23e7c1029406183ef4fb8b9aef862294dfe41ad27d00f06629abe69dc6fc2ef283609e6a7d4d44f2144746c099da67fbcc95fdcfbeb713f821a6fe1816fb919 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{60CA1531-1700-11EF-9F86-7EEA931DE775} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f08f83350dabda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422409454" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e0000000002000000000010660000000100002000000093b7b6a98c442c58fa35b4d8aaf89e267df507d70dfc69b41b0a2122e03f82f0000000000e8000000002000020000000c95ef808d1b3bdf676694f1903f7bafa7600bcc37a259d55ae063a2d5653d799200000001abc6e55d80ca82f27822e205415a39e5c4aac5b7c3b3775af84da41b9829981400000003b801d356fdb7ac91ea01ca12b49f9f197ec5d6d5ecf0d27dcf8d1e85edfed31676c0c1c180859a25670dee0da3ad6143004156bd70d0a67e3d7c0c300059fae iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2176 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2176 iexplore.exe 2176 iexplore.exe 3012 IEXPLORE.EXE 3012 IEXPLORE.EXE 3012 IEXPLORE.EXE 3012 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2176 wrote to memory of 3012 2176 iexplore.exe 28 PID 2176 wrote to memory of 3012 2176 iexplore.exe 28 PID 2176 wrote to memory of 3012 2176 iexplore.exe 28 PID 2176 wrote to memory of 3012 2176 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\614af499b51a768b12458a29e25ccb3c_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2176 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3012
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD547c6b2e44252fa71d3b9b167e2b47966
SHA14e0e2c5998ccd2d3a7047c2e44659e47d71b927e
SHA2568095b07b024e6e3b24207d25a2c39506e845b39d0c2aa3531ae6dee4424a5e41
SHA512a132847219afc143255e5cc810209fb466e76167581ceb8d9efcb40ec0b5244e8b6e58f93bb4aa4eb3f033523aa90e472289d73d199e7d580162085ed49051ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c443a515460204ceb2b81e0c44d2a27d
SHA109b9bc9e3056b23c27a9e2cfe0a1ce7086348c04
SHA2569f3f46e1da0c46306dd2b078bbd8763b80fa5d059184e0a1cf5e94823ec5238b
SHA512a0d485c5b992d107c9fd2c7fc74e0d9976a3015ad3975adabb579bc20288b6ab55127918c40179c280454f1dbcaa3fbd7d9735f8453dbecafa2d5f37e36899bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b6aa0209b97072a26369d5bef2139d7f
SHA12b50861ea9a91e46c4c16d37561386e9fac75c51
SHA256579b13c1c44def61a328411574e2d9c427ecc3481c11837dd4a021c59a7d51ac
SHA512b8d81ffe0f286404ffb6be6c6edaea82158f7ea3cdc9f4dd7deadfa21507e945e03e9ca5ff2cdd0c427bf7e91dd7c4a081a7a025a420f72ac4f5e1aa9ae48af8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a63baa9bedb5ab3a49595f23e4a42e76
SHA135cce08b61299572e0e155b5422afa99ca18541b
SHA2560b3860f997f3d4cb66adfcbc04f6dc6b6b1168b1529cf09056f1f60cc62d9d5e
SHA51214c9d256123897781dd6ec3b67cec57d6d9f972db0da213b9f8fca61c7e390b0c6d3d33767dcbbcf63e45dbfe3c43cceaef1314b3161289c048b8f282ec8700f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5582d67adc8b014fecd4df3aadf1b36e1
SHA1474e06ba4ce3e9cd7f3b1b6c98d46fba842a7265
SHA2564613f6561e2488dc8be74e0f48c91fdfa26b94abe2f23ca9d2e7ab76fd4f22e3
SHA5124d5e5ac25cd36f7fcfaf255d07b7d6606fcd59a20cd7457ce831e1c5355add6d17c70a3fb6d3e4e017958820f79756ba87953bb9e0fe9acaff766586e0001ecb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d3aea545b1c2033ddb6d509ed25fc406
SHA15ef370785b12640331a4636fd841e5fd4d33976e
SHA2560d93af1444aaae3859f8d016177c110e4a0bf06769dec33ec6c75155ebac8007
SHA5128d3027e1900ab9ca98be03c7924e6614990575769ec560425e0c5528ff2b49d628f34be1c4ef3ef4aa58cbdb895d8fe615f7345b13fccaf855e057b6d9e76c10
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f88d8dca74596e2c019614debacd0ee8
SHA1dd7df2b704578406b532def7fdb64236d4edb261
SHA2563937a8dffa664ba8270cc551d56227c3502efe11849fd95e917446efa8f02c7b
SHA512877929943f41044a93355f781fc34a97524b4e17ebc1e38a5ab9dc39b6af75cfcb5761de6105c6da7d3575a233e4204c39e225e14d120149b704c1f5ba6ea555
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50b51494da718c2464f35503b11a9d7a2
SHA1022a201da158a5c70a1071dfae08fdd0413efcd2
SHA256f7a1e50e49e1cfee6d14e2cce33699a24c1cfce3aec0468eb6b043b4b190c8cf
SHA512e30caf4cc1eef9b6ee0a41b0b026e21c8d1b0214d8f61119e7121db4f0c566dc446694ddfce474c5f45d3bfdd01768d7335af5ea01500dc0d240f0af082d1298
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56be540c58a73d7580b0556dc734e0bcc
SHA14a09366d57353b87d8a5dd9b174fbb8bca05ff82
SHA256b52f7a4e7e2fc3e2f9ff68db4ee31235abd619762ae418dbdb8824d0239c43a9
SHA5120c00672060e8f293ba4f786570d34a97b013014ab6599bfa078c01d1d5153ae569966541c50d58e85433ae28f0116d235c453db3a9c7b4f25786c4b43a08b702
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD590522f67008cc2ecc33da9490a140bb1
SHA10956d18e4e6b4d42d4a14f33af37751f0730dd23
SHA256158e92d91626e6fd016d5a8471db4d328c15bd140bb850fbc56f6eae68148fc2
SHA51222fd7ecb610319395ca716508e28826ee56ef2afbc0eee952c50bb56e84e3692a2351cf2703b7c16c11c08a40b242d4ff977b7f7b59de39b3b924e8dbf2dc344
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ffa5d9f43b548861c3fa42bcf2160f7e
SHA169545b3b53eb7b51f61ad7c0cdf67b1088e80669
SHA25647b4c36b36175030c22352f6c896b31bf63022a17e1b276bd6415a0398c12fa4
SHA512249463c76746d1e0d3102b44caf9321214152c20105ab0b3f5f3557cb6ed7e19f39097fcfaf3f7a9531ce68ccd5b127e3ea946033b5b2363accc6e5c85c7fead
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fde031e370e1b52a0d0045c684a30808
SHA1d0f7e3e7d83eab77dbe4ae4a26feb51f2a9c7adc
SHA256fa18784865f28823f085ad5283bff8e954a2b825640288564005bcaf61508a58
SHA512d6d3bf995a15bef96e729aaa64da7b9ac384d7d7cbc02c02303b7b53529a2d1a3c1434a32ca197313c29649902f4b6a627531bc34abc090cfaab7083331c2e1c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f060816f0ac63d605785da6326444499
SHA135f235897e6ac77ab4c97a7b236c735649ec4057
SHA25617626e05fd9ca5cd4522aa8d9549c816e44b7f63345235e3aa6b4cd8c7d43a91
SHA512a610c63db8f88ff7f46d7bf1915c2eb0f953e31f0d97f1335608f3f6f583a3061cac7f17c784caf98ab26e268ce82f8b8eb3c348d4976cf5754a8c76513280cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD564998a7e284419b3b5c8ab62e33972e5
SHA11d0889c4be9b867c0c6c44065cd2a129273bab0a
SHA25684c08d3a09a823f3974d8c0922da4bdb7c34a2293188ce3646fa8f45b9a0980f
SHA51221f9f41ad8f62bde957f49d7a5e1bd072c11f9f65e32f42ab10fb75a7091acaf619d417db109239e935c21f0f2ecf79854b8b37282027a3bbc62425b92427f58
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d126440fe2933a3c40335aefa5f1dbcf
SHA1032b0415dc7a95f9c0c9999eaecbb383b77a5ed0
SHA25667227f229a7d5601971d954b8fb84081fb23f49cec1160ce5e3e1ec743e100b7
SHA512e6c29a0854735c51fe581aa8ee045c9a54ec9a7baba192908167286e37e9d734970c7e4eecc4ce5619152d7638af30040eee595da812d37bacb63a468f0f4436
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD559a2d8018fbc89ea30253d14b22027a3
SHA176fad37b1732d2acb5f1e28a090aac383bd15c51
SHA256f12ba823c78b1dc9ac9bc892c2eb78ca1aebd8705aa0f051e3557c240cb3112a
SHA5128fef2dbedeaad9d4316d5523052cac7be9a35bfc8faf38ff82a27afce0c4ca399df16fd53a6e1c8285f68541ed0023f5d44a0338f7c3f5aa52805155fd36c255
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a