Analysis
-
max time kernel
118s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
20/05/2024, 00:32
Static task
static1
Behavioral task
behavioral1
Sample
5c479a1fc0ac589146528164cee4f068_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
5c479a1fc0ac589146528164cee4f068_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
5c479a1fc0ac589146528164cee4f068_JaffaCakes118.html
-
Size
460KB
-
MD5
5c479a1fc0ac589146528164cee4f068
-
SHA1
e5f04d771f8bde0f25ad634824997779826da462
-
SHA256
9fa4f67f97b7010fdd9cb3eaf0dec2461dcc8b18ffb91b79fcb909d4dc925d20
-
SHA512
82f38b2b30342a0b64fc08cd84f4bdbe7ec9ebd58979a547a67beb051ca8e1e05ec43b73c11d9f570de91a714177d924ecbcc0402ce8ae39342f89cf3630fe95
-
SSDEEP
6144:SdsMYod+X3oI+Y7sMYod+X3oI+YjsMYod+X3oI+YLsMYod+X3oI+YQ:O5d+X315d+X395d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422327007" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000456fb4f19d1f000cc2491723d38aff0b8f40e23b550303f27f7580b26bb2e5dc000000000e8000000002000020000000cabc2bf65a2552d7c1a5f08307784f902847f068df76a93b140b402cf0f436f8900000001e6a72a52f9855f939ea2dad163ed7107c6dd4d16758cd96d22196f24df60e1a3025145818ba919c437a92479aae8199b6cc73bf1b7e20c7da68b08cbca0a25ac4756410c78c3e82b696b00ec3370ae16b9c9d1045f0a48177a328464a14a693cddd8fb5d96e810c6730349e95880145f51a72de4d165a738ddcfa8968994318c54eb06cefc04cc75f3512193604995b40000000a961af460872cb90ea16fc9d1e25c70963ba7e59af8a4d90878914320fa4105d9e05e1b44b181a193586f09b3099c2d9272cd7dc130862f4aa13f84fa9047f1a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6A92D361-1640-11EF-AB95-422D877631E1} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000b66b4c0915b27af92b14596f8ce4c170c41f01b302121634d26124debec6f575000000000e8000000002000020000000bc8b40f481535d7f1f9f315d3765d22a4526413c678e0a723fd80a98e450287020000000c5f5d01ffddf5ea230c2199823831c0ef72c17d417360b17cfd4fe6186bd5b22400000009f1111f07b280ee077b8203cf22d44d7e8c1ed6e0545f948685924aaab14d9f5afb26592f00a4297bb4dd68d5d5f8595784dc7fd14b9b79dceb35c52e80a3d61 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20de1c434daada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1784 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1784 iexplore.exe 1784 iexplore.exe 2100 IEXPLORE.EXE 2100 IEXPLORE.EXE 2100 IEXPLORE.EXE 2100 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1784 wrote to memory of 2100 1784 iexplore.exe 28 PID 1784 wrote to memory of 2100 1784 iexplore.exe 28 PID 1784 wrote to memory of 2100 1784 iexplore.exe 28 PID 1784 wrote to memory of 2100 1784 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5c479a1fc0ac589146528164cee4f068_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1784 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2100
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dbc4f5657786fa6f31c46493f2d7f0fc
SHA198c0a9b20d6608d04a21319f9c34912b1a9c2d3a
SHA2561439ccdbc3358500505eeac47220b76b77cb927e3a3d715cf39011d77de14070
SHA512c9582b2d2e38cd15e1b6ce867e451c91521288b7187114a3883ced45e1dda66ab9f8bd82d302cf411923b2f1eb75950e11e47720a019a70066a7f8eaa4e23d83
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a2c906d8bf0d0791aa41a00d11e07a14
SHA1f79ce3ef44fe1bf38a48012892ddc9a029ca0a0d
SHA25607c56ad6668a98f9486c52ea814a5f1abe78bb003e844d5b9b8ebc1b80db4ce4
SHA5122449a8701caa8863fdd228310a76959c1b7e0a4f6df8901623a0335c0f5e09901bed88e870ce6c3fd65a6029f859aa2d5849f86c5af1ea5fd8bcca0c73ba33b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5167bb2dd201c977dec78d29ba23b9e82
SHA1bed91920dfaf0dcb9108e322f313f5c181649877
SHA25684b2de0b1e83e1bc4f9781ab0a3c36780f47564b1f9584f3dc41029d3337ab00
SHA5123410d39532f18871d9e2ca9d0999f9d8a57544b7447ca84c485332a76de333751cd77b0220eaa73e954124d6df2e3dca0872d1533b2e344bc14c501218988c25
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e7c0ec74700310c4beee06246afb4eae
SHA1e542dec2f522a987f3e3120f30126022c32c9dd7
SHA2560342d506a0709c35aaee99ab1d1765d86eafde7d8693a04483ff0543ec66fd75
SHA512a107c0a4c182ab7d8a969d14e8b81c420541bd68ccb6b89e680f4ebb5b21e7c8d6655c59e7f1a6530918978c94b5002faef3a07b161b76a9617a44b5c4d2b2ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b84c40d8556ae368206a31b803a659af
SHA1d18d552f2c54e368c176d3777d1742daf50f6bc7
SHA25643cbce9939d27059194f3b8faa09d9e6848b36f3afac9a307ea30f9e56c2147c
SHA51264dbed547931ece8139996d170f9ca34018494eb09e713bbd3e16e5fa4075f46c6737c245839452cf4bc21899843cc54ee2fa5d895bcbd191f5496eee98ec6fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54fd0fdd75a33d50ba5cac0073543c0ea
SHA101e8ca036d1819e87e7fa9b0021466edcbab5f3c
SHA25605b72d459e453fe5348420e23eae45be33d45f5d74af4fc24c662a8ce4f05985
SHA512bfa5146fae9d498e7ce68a0c6914688ff5601a3f3853ed81ab24acf8cd2e7d8457595c5f8017c475348457faa9567fdf52259e816916185f8f73a746bb7af182
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52fd5093afb94c46dfeb7cd0e6388a64e
SHA1c5545234d15430f2ffb7ecfc021d84a062cf2323
SHA2569560ebf35039b9dea9cd0d7925d194b5a49d8c9152cb04e5bd4116997bd0174a
SHA5122b15cc9721f6098ddf45eec7ab6b90e5719be6172be0dfde9ef2d373433bd92049f82244863948cbf5f977ec9edb543d0f89cb4d7f23ff6c5dd8e0746336f955
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58b2dd0437e91769995fb0503d51b98bf
SHA14676b2ab7357a0020b7ce1d6189553c38e2e4bcd
SHA25678377bd146de687d25905262cbe9767a6e772506382b198ec78304b5d33c9856
SHA5120cab735154c74adceb6fb91f566dee0a5b3d23636e3e9c9d660b875f971a77db78b8984d284e92848dec4c8439e71631dbe9ef85f1582eb8058e69e0b542aa2e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD555eab318781762da118fcf9b7d07e2ef
SHA1d1749d02435dc7dcc6870932896d73cc910f0d85
SHA25641c31ca9e71ffe8c9d23f692fb8cb5f22e6feb2ee4980492005b55c1f7c0b5d9
SHA51292ab90490d80ab82bc1384a418ea5549ea7169e39dafc772f69f7cc48c3696943a33cafc69011b9bcc0cc4db2d1d9cccdaf18efa7e6a141a6b1bef00c6caa30e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD577ca91c00bb3b6b58c1ca8e84157cd51
SHA108915726bc881fe7b088b613760d88554323301e
SHA2563173d83750b153020d0e25c689a54ae665ea0e0a3f38cc0259ed68c26fedd03c
SHA512a810ffd5fcb96b36a5a7946ad50d8631bf010ec0549c40a6d492adce9dc15ef18b89dee6dcec6b60623489bdaf0b2e4c1311307aeacb44a1af3ce7f5824d086f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5762000eee5b2d06df6922f462ed0f06b
SHA1a05c3de79414b57ad725445fa04eb34e431fe9fa
SHA25614bc25953123abcbc9368aea12e64e2a1512b134c551d304af68d7d2a3882910
SHA512e83dbd81ee55cedde2accfb012132397b68f932e5d9183c88b02b449a8bd74b30a551364869ccd19054ea8d29355f262b9479249b41e13d5ffbf0ed565a6d41b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52e03c49a03e85709b6e83bbeaf8fb026
SHA199d069c3a449143c87b86fb39023cec230b3c208
SHA256b75d307f002ae6a2fb73c24fce9ba0089d8fc9e21872d85dbf5c17c9a5c1f5e3
SHA5125dbe4ccc4afb1757d43c323f7f964d378e346a5338f2d7eddf4b70fb2eb7548dc482632ff9ba6c7c139f2147e949bdf2dd7a6a5f31d4a5c8125e1aa99d614368
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD541de05578e6f9c06a69ff2df54ff031f
SHA1ee9a6cba9f8d649116da8513aede5981878546c5
SHA256d23ada9294b185687924eb9118e4c76fbd42cb21a0879a9e77afd0602f30fabe
SHA5128f40eda59ab7b62cde25e5b8367570e1f45ef63abf4bfc18eeec1d529b63b7bc2fb6a7cae193b2566a1a4f11c3aa83d44739359214e6ae7d9ed0bdee2ebbcd27
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5247e4689eff1281252a142621747576b
SHA1890e348b75280f752a2e9e33ce30a49d172de162
SHA256251516747ca46e458b4e77b261365c0b5dcfbbaf5de143d36d93d8c05f2cdc3b
SHA5122f17cb99eae1fd2774c6176467a6fa33b122ae8000c8b4d070d678d14f99f35b93612af257100c5721c3a014425692eb91451e5fcce8a793c6bd597d8142c3a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59688360b05cfc7f14653fd90abea5315
SHA18126660711b4f4ec0c7b5a0374467b8f69d344fd
SHA256190c130ab8c7a86b237213c6deca1c0249a8c3bdd870ae966ca699aed74f1bc4
SHA5120dfb8000c9e81490e0d0bc88df2b0feb2208b655a908ac476212affdd326547d58828e2159d806b188ab8db3a66c3ade025ec5b6e0d718dca5729f37afba1d50
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c083712a4f9571968c7bef90df3d8ec7
SHA17fafd1deb87ca39a841189c2f85951e98ba06ac0
SHA25647e795abaac5b04fe288f71f8d931eb6781488c240353e91a2c4bf69cd27f12b
SHA512eaf149d689ab9a24a8df85da31c54be51aa3852f98458bc098c790ef5f0952cf1fa9fedebc59c6f917f1e63c1daf972a10ae03310283e97411c2bb8502f57305
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5940a59be950d970ac469f96856ed75c2
SHA1424cca1d3d3d9426c1985eb014eeb2cc9a1a3989
SHA25604bc8497ef3a3edad7acee77c061cd1b8fe031a4b12c3a3a2f3d6836eaf87fa0
SHA512850000714e9a3715417aa95ed1c683d9f96d160400be07b347351d09c4fdf13f48d254acace3c91d26ad32a28d090ee0058634f3faef2b9da90c19f35cd75596
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cf7fb58161a13244f845c15453d07d88
SHA14ee7bac37627100c53972dfe030452ceefa01aab
SHA256056f5a7a7d583167b9d09302acee55651d314f4f249b4b3a4bcd0c9043d56b03
SHA512186a21fd621152b971d28304607c0cdfad018ebb32087c9d991d9a0dcaafe05fdd0c1cd1d425783a07952d4bd802592cce8d2b28cb19a7e47ae6da0c6994e3f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50234073b5a2a9bfefce11046552d5862
SHA1cb0356cf289853fbb0930f539c92dfb17dece54c
SHA25696f9b1c2ee65d88aee838fdb4af5e8a2520ef7c7a25f6a04474da588881f36b2
SHA512e99e6da676244e922a152b1d9c5d3069cf48ce3eb15d1a504d61c07449f8fc052d5dde9d683a3712ff06fc46060517321ee3c5ca54e1938f77e4d75e1be3c8fd
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a