Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 05:38
Static task
static1
Behavioral task
behavioral1
Sample
5d717e6a1350c52454bd824ebdae0724_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
5d717e6a1350c52454bd824ebdae0724_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
5d717e6a1350c52454bd824ebdae0724_JaffaCakes118.html
-
Size
31KB
-
MD5
5d717e6a1350c52454bd824ebdae0724
-
SHA1
9d5e83c5b558d498186c9c24da391eb6b588b040
-
SHA256
d3c968753c7170107f7746f21a4e8170287727306ecf863b92824770c4af441e
-
SHA512
fb1a94699bf461c7b6ebdf4f086973b0860526bc398eb003494fa26988327ae1f505b947f6929fbc50342831febbf7017fd08560a227c07eff303326200ee848
-
SSDEEP
192:uwXqb5n8d8nQjxn5Q/onQiebNn2J6nQOkEntM6nQTbn1nQmSExvEMv9735tcBPZb:fxQ/IJfnxPd5sQUgGIQP
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422345374" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2EC029C1-166B-11EF-81DB-4E87F544447C} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000c634f79be2da8e2eb0f746cc09c70921f92ff4f172a6f2889fdde444d0c72abd000000000e8000000002000020000000712345f21c255e9953a887ac48b98e7b6b50ea3b3d05960892713947178c42fd9000000028f01bbf7843497330ac5976dc18ad163b4ce7978fbaa30376d0ecf5dcb55d0d6c0de2b6a23bf5010fe29d0190d05c95c62a8c93331b9d76d9b61d4bc0aeeeac7f9e76fed9b12427277117487437fb7e713c375de812368e495dceb86bdbb4fb704c86f34932711a7b5d1d7a33b54cec820f9b3d04cc9d07fc020f0fd04a3f7d21c88665cea0332ddb2da6154ed91d9640000000f37485a6846971206ea96cb4832108569d58c139f9e959e2badbdf7da7b18c5450f0a68590b2a19d34797d1003783e316daa7e34fdfc799c216d9b53cf6a5a93 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 705a6a0378aada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000026ca002cc27a6cf2cbeb03bba448592304dd463e9813574fbb406db6bfbcab5a000000000e8000000002000020000000e428704ac7dafdd8a14fc9791d47253027804d188a406139b7825455def54f74200000008342db25c5288f6459ad08359ef5e8da80aab722b6082e61f8bfb377304dd703400000001282303b72ff0a0c0271aba6d257c373bd45dcedc9873d86b4de71bde2506cc82519e0ae4755363a7c450e275e705c9d25a2de0ca09303fc1ca30eb02c6cda15 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2188 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2188 iexplore.exe 2188 iexplore.exe 2896 IEXPLORE.EXE 2896 IEXPLORE.EXE 2896 IEXPLORE.EXE 2896 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2188 wrote to memory of 2896 2188 iexplore.exe 28 PID 2188 wrote to memory of 2896 2188 iexplore.exe 28 PID 2188 wrote to memory of 2896 2188 iexplore.exe 28 PID 2188 wrote to memory of 2896 2188 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5d717e6a1350c52454bd824ebdae0724_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2188 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2896
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a7e7bc8a827936ad9093c32c66308b04
SHA1f6e850325940b9f6216d8b84827f3aacbf489fe8
SHA25686c0224a15341ebdff44decf6e94d75482f42766b9b14563894b7d340a92aeec
SHA51223f830058247fb638438a70eb39fb812c768abad68cbe83bf55299bca053dc3e72b68da38a44463017ae10d1c8abfb61a0060c80ec6d5097ee2585fcc16eafb0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cf25e15c6996b19b981bebbd555ddc36
SHA1ea677518efa5ec921da5e3fc9bdee27dafcf44d6
SHA256f2e50a6f562b78aac97ccec821d0a3cae49dce020128d48dbc900b0be7581419
SHA51287fac74c9d86d07003d59beb993b14dd43404f02118c1687b80f33edc47a9e3f557423e03c6599dfb191e2c3be0b1d02f2a7803a2db12d3e58f612d098688e7c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD592a3d4729d3d73c29e002aa7e1c4bffb
SHA1674e7791ebb69566a5789fce86a4dafc3f73849f
SHA256dbfd7b10de23d7a81500263e1b180dc26644430af21603afb9a76bdfad8f9f98
SHA512965d83b29abd4ea398a3f0ab980c394877ae167e6058b8f5947e6230f1349ce7adf2b4f8de09292d3ac172b7f53686231c612e26e13131e39fc121942b8490e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a2e9a676d4f3de07125545dd45cfc09b
SHA18a696b96d2f33dbe7bd79043fee589aa77031a25
SHA256519c39b2f6a03fce9808c01ef635f02237ad086ee6b8f1b672ea07d55d1efa1d
SHA512b5310196aac54b208be81cf09dce840bd51ea0d3e0e483b025d477b3902a19d7a3521e03d06947b3fb6d1bcd852a6a364dbe421ce458c12ca390da8e3fc00c3b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dadbfca02d553d1eaf0e252ff61d9ffb
SHA16e8f87cef2227be4bd2806354a99a5a8106c34ef
SHA256857370dad3838d494281cd69e5883048bb00073a8a07964f80bbe33670b97e9a
SHA512d220a500b56f519ac647389e83518863531ca5c5b8dd77eb54fff1797988883aec1d2c13e705eb32465c6b036f68452b20324a4e69e5afdc0ddef97f8e434400
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51c7e254a192ff80bbd962d550fad2d32
SHA145eb3120a2b33d326d7a439ec2254f37dc6eacdb
SHA256280967163033dfc1fd9c05e29df33ba4b6eaa7cf47057968f7cfbf53764595ec
SHA5121a5b722aa26970b4714c00a466916032be1ff7aa12e20dc042d7a09930a51527f8e479d2055943dafd774421620eb04ce05fce188b62c177b49bcb9e23e660e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD509fe45c2256d05ff0bbb3ace3072e6ba
SHA103c2db60532b543a5359bf4beffaab8df8aff758
SHA2568b4fa22f9e4eed184ff4e1927e9b872c9bafc8e1a46904f1f24eda243b926941
SHA51256d04515924b1b45b513a958e87116db59bfdf64cc42bb11486f06596971196959d5dfdff45a445a487ef15bed6d9e9fb121499ab1e235bdf67366951dafd4d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5620b4674c424b10396fa6ceef10e7c56
SHA185aa724c52dc400cca4ceb87af182fdb81835808
SHA2565bdfe4617aaebe2e91e2bf33ae966ac47916bb40e61bec8209e628a7d40a4d88
SHA51294db1dbeaf10168ea51666746817eab07efc7070e0b8e7682a09a8bc0f6751ab6877e2072ddc82c8fdc0b26356f9af8fc1222e1eaf42000670c0f02917687504
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52c97d1c3c75e6614d59cef8d2b76bdcb
SHA1abee7c68adb220eb13bac9b9335b5241e9428889
SHA256cec99dc788f822c8ea1bea69ae0269f0a0aa2412053a175c156b88e31b640815
SHA5129ffd4f67523b7fa3bd60e9fccc37de06ce795092c92ef9775633594b7df9a80e06bcd8479159bb80191e60a7e30e031f1451edeef87fe1b8f545e9d1a4e2c6a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5595188f57f2970cc68ca99db93204366
SHA1473f78f68ab4796afd1d625c8e535ab4a033b27b
SHA256f24ca50ed2a41c36925029c4d665be06b7b787ee5c76d90d1fbe8c5138a5b17f
SHA512c8b9b4a1c7b41c75c7ff8d13b6f6802df7d3f78d8520983026548b90f72d896a9b63e9f2aec36534d2cadcfa4a0f98f2eacdfd50bae4a2c9df2ca3b926800fd0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5816536c0b2077fd403e766a81a8d17af
SHA1133a0b6626065d32fefc3842f9b74d16faba70c3
SHA256d757dce0a972925d340f31a84cc9a3dea809b59e090a431e5de240c0a087d3b4
SHA5129a608ad3f10dfd06f31555512f673b5b6c01d1f96d2230d8e94d3d594c738e6982d02f7bdc9e52e666ac757e1010ba2a4b710ac9774385ffcbcb4933419c3075
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD507a3f66f7f4ab4e899bf9c9988df4362
SHA1db1a99bad793c26995938a801f10cbbf61e8e198
SHA256a1d5e20315e8b03082a6d529e34fd2c826509a7972ec6c2608cfa6d846a4edac
SHA512708568c689d9ae19e84e5602948d48d8b2a7ee49f23f5f35349b992d029a3871363d24b8e26ac6bbbc0ed326ff7b53a9d0527c16b20556284cba28de6da353e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b1eea177e84a984303e776381afead0a
SHA1e62ed487aafb139f7a33376a403fb0703f4ce5ce
SHA256281f3a057b9193db1a894763009ad8c1ee82e0789494654688d0e15604a0ad11
SHA512d59ec21c3601f5583ff818956f545301cc7d2d866a1141b14e9e8ff6f68b75c5d05b1356a385907800671ad0c74e440311504d4b2ca8ef691d334cf852dda44a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56247304968edffae735175f755cb2bb4
SHA1f3191f3d701e2c9ae3ed146517f6e99015a4afa4
SHA256b2a5ed87bc50a4e6da7e927689074ae877bb7489d66d0bc58ad77771db94d053
SHA5124eb97648520896ff6ed24b788a2fa26476af2889e3a25955504982f5ffa8ed5388cb5919e55b37a4e34aa5c42a66da6e9d4b8d5b7b53bd2ef7123f02424ab40b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD541c3bc0eddbefc0eef041ed65b67c2ab
SHA1ee2abaa82b87ff4d9a7dd4745c5fd1e860be6bf8
SHA256e9a2d53efa9e78acd534ce39aa6ec822e2a5b19562d45e9c53acaa9b2d55a552
SHA5125dc1ae5fb7aee85fe9496983d8d21c4f457fa7363d76487fb090d20c9ad9d72e47339505b99917b6f9806447ceb36b345a34c1b23dbb2617413d559d9b2855e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5507859ecf29061f90b8a0518a23346e9
SHA1cbac539296b0160aa891cd129b750a7d07c03b82
SHA2561e2c5d06ebf34cf8aa88eb6598fc8d80fa706f8f4a3c81c19b7ac94ed8d1ef78
SHA512ae1b9f1fd03c1742dcdcc130d379763e6d2d6e102c68a667b74b3bfab7c6c46e1d227d4c075937796b00761d50f0ed9ea22a9911bbeda5bb075de6418eee5cf1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c1d3bcd1a5bd06e25cb10ee6fc7d110f
SHA1054364fcfaa9348ce502410b331d469d7fdb3d4e
SHA256ac70ad6dd3aa3df90673876e95b2afbf42756ffbf470e3b087c5758d3e189585
SHA51237030012985e0e043ab71087a296dd4e843cd103fe7608f1953cf1f1a46c329d424e9684a8ded84bb9fa3114dd9b0ccb13a9db100f19f2722f5f0ca32ac5797c
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a