Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
20/05/2024, 17:07
Static task
static1
Behavioral task
behavioral1
Sample
603b978a64d60239a030a7eef93dcfd5_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
603b978a64d60239a030a7eef93dcfd5_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
603b978a64d60239a030a7eef93dcfd5_JaffaCakes118.html
-
Size
461KB
-
MD5
603b978a64d60239a030a7eef93dcfd5
-
SHA1
a4786e8500d4eef1c4d11fbdbb2c1108423b07d8
-
SHA256
27eb7e361a195724f6b98844736fac75be8adfe14fc1fc6a96c1cd30d37b98f3
-
SHA512
9579d3966aa8a2c525fc0e3d466c060933cf039fb648686349509b48921274086e8751301f01f2eb5a375a3fd2e2096f929b3220fa589e177d8cc57f9276b30a
-
SSDEEP
6144:SEsMYod+X3oI+Y4sMYod+X3oI+YisMYod+X3oI+YLsMYod+X3oI+YQ:p5d+X3U5d+X3W5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422386735" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000007f214575552561b79ff46c008928cab065bd1b737130ce1b7d23899ec6bd8c4f000000000e8000000002000020000000d26e9853656fe828e196a0d5156ed35f41d80a9007d2357e32592cdd04a588db9000000005a1810a260c92b63ca07673f1691192df1f4dcc7b1125855451d9ecafd9d09989df3540b3b9236e984c3c9185ffbc5941516a45964bac8048c77546a52f84f7138a1ac07a57e127d656072a9c575c6e293368bd7011fdf7864e372b7a5ef2562ca0864dc8110c3dc6abaa8b192d4e208f2cb3d2976f712a968b4069861a1cb00390b7246b3f0644823a3f7006e21c074000000092b1ee1481763f93b9f3ac9791163758a95d761bbe685f6edd36132d5733f041b79407fc9498ce8aac185cc50c0541250094f2268ee84de00a87c113c8e7a31b iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7BD37AE1-16CB-11EF-89B4-66A5A0AB388F} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000014b7121f573a83e37bf28214751d30efb2074f18be8c5fc6b1bb7c993e993934000000000e80000000020000200000000add1f35d26f9b042e19e256389d9ef92edb6f75ef5e9ba3492cfe5f0e54c4f6200000002636f640af39be8540e404019756c5aebf2af2ef22e09f676a5c4486f1a0049440000000d6054b770b13b57f7cd9f55a6558c343c5705b7fa6ed761b3845fe3f5eb11aafebf628a6794c52cf9f3d341893628dae45c47eb98c01a832b31a24a80256c2eb iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0e4ec54d8aada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2972 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2972 iexplore.exe 2972 iexplore.exe 2432 IEXPLORE.EXE 2432 IEXPLORE.EXE 2432 IEXPLORE.EXE 2432 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2972 wrote to memory of 2432 2972 iexplore.exe 28 PID 2972 wrote to memory of 2432 2972 iexplore.exe 28 PID 2972 wrote to memory of 2432 2972 iexplore.exe 28 PID 2972 wrote to memory of 2432 2972 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\603b978a64d60239a030a7eef93dcfd5_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2972 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2432
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD560151e508dde33b2c2c01c2c41cd4d4a
SHA1873672edfa8a3d651e55f04e808a15dbdc1ecbbf
SHA2560785c0a1a170bd30bb3fdff2b1c1e5c51452b42f7bf0eadebd75cf78a742bd0d
SHA5122f16dda9a5e031da66e961ed1c854ca373cfe531d6946112ee2c945cc345a793b8b412f0267f98ce74a32d8a31532822d1f7a4bd84924243de163434854ad627
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD553ab924e78d81ed494ed69bbba15fbb3
SHA13850ff66e26691a7f5963417e6b44732656bcf76
SHA25603f63826b32dd71f085380e2503fe97b63ee550b6dd2097f1689a77e535e1fba
SHA5123cf98419cab7de72a005440f057fa55cc4409bd114c93cbbe0fe729df9d0c2ee94319e1134da4fb920d6de19c6226c3da13057a6001750debd39d6bbffdbb57e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD547d482ff7f8bf24792ecc6201c5fac33
SHA1114a72c7515a6f08552e68ad90579907f6fa2059
SHA25659dfc8eb2d331a46bcd3ae7acc43150837e7e9a5b78202bd18d79b4557d0b7d6
SHA51235a84fc4166ef8affbd201c0d9e6c7ac57853d96e53477cafa5b642b42f0f82e1c7c349d3e6e248fa74e816ff81a8ae674b9646eec76e803f5dffe3fc49c05c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cf6ec335c2409aa8035fa1321f6df8d2
SHA1d2ecc6b3bafc046b305a7fe2b5c6046f2ad50119
SHA25680d37d90eed78a4fb157235c65431a21e6f91653e30fc89585993f75ce31d2da
SHA512560cd4180afa6ad3eca29ec66eabf4e60475ec5e1b68c2f55b41913c960028704dcf79643ad63efa749bd5a35b739ae408702f7ead5469d37ebb561437577805
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55ef76b848e304f1207ec6694ae2525cf
SHA1592ec069903bb66a5b5ce3c31e7dffe52ab319b2
SHA256e747784e3da80f0b2f074754b9d93ba648e95f6704865e1f6ab66a8328fe04b7
SHA5128eee5009b4422e1a6c3cb6ffcc561ddef46593f54d2584572673bddaf2bd572fa44d811740780f4056223f03c031fef0006dcee8e88449eb127b5fdcc3f71510
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD560262e7aca86c65712543d1468bdcbac
SHA19fa6d3f1aa20560868b36eea914572e7ad103b9f
SHA256ea364fc6cccc44b6afe42688e46ca62f20021830a2a3bf08703cbaee451ddf04
SHA512f7f9e0539b9cdec125aabfa5b62fdec240426a8a307c4c2840a6953c34c39e07d09af91b3697d46112e4a530088a48c5d307362a1507e0c8a43b8068e7d36201
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c4eaa1e2664217f7f40b1d5a5078dcaa
SHA187bc4c5464162f1c0595f7f0f86acb200df75d73
SHA2569fd46338cb8880109789667147586a906deabdf82fddbba07e73ae7b5c15af3e
SHA512572bb531654203d0c21590e2307e9760420569f0788593bc78daabe29bcb67344c1667bee3775f462955402ff12b49459aa0d2c6b73e8e2f984be6f3306c8bc0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51ca639bbec98a16b80cd9106d11c76d4
SHA15f193f57b6db4bffe86762e8cdc9d2c0ca367de5
SHA256686614d82f6fd84f82945db6ce4dcd472fcbf5f2cea146c2376be60929db659c
SHA512e24f90a48e11bf3cdd6b6b3171a57e2f7c08733e4fa9c0b37dd9e21b452323cb5af75be432cf81b9db928fffb3eb826b3e205e7450e8b85889dd5dd94ef3b1af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD595c5355cc8b563a30bcf66c815dff6fc
SHA147a894a115cbb176c63261eeb0d9bdab01bce31b
SHA256cf8d5249ebe00a81e8d8a309d9c98f4f23b380787ec74af8131144a8d938eda5
SHA512280f5c6a042e08d2927b0822aa62c90e27325f56e2de18f55be0bbfe8c297e0e1dead3fb0a4cea486f121f7aed397c300872efb3076ebb3973a0d1e80100aa21
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5074d97cca5101a9162c5817b001c5b84
SHA10b9ea379bf66217da2c12388248ff774727c410a
SHA256a6272e237aa0f15c4641934c2bea1a97f04829f1edc8b814ab698ebfe7ada383
SHA512f3f9eb8236a062c7a3ce296fa25341db03558d717e0aa92c645dafa8783f5b6537a69504e2a59dfdddac7b3c6083def49bc69abaef1b02d22c0c690b809a0491
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD524c1968bc9c045b76431cb628bd128f8
SHA1f1dff09723634938e544f12b2f4a357c53b3b463
SHA25677bff1adb74d3afab4b196779f5cda157efcbc79adf5e23a6d19cbcf6ee9c0c6
SHA5124ab37238fdc36b0493caf520f8fcad498cee4df342092005251acb1677e8ddf0fd760d977ec2e0c77cabb17d4d86cebb859a122f3c9813d258462deebb7420af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59adb2f799b934651e4532ba7c4bc2fbb
SHA103cf10faca8a9fba58ee64c7a844a36ec58b9ba0
SHA256df1b17f49a7aa27f458d4eb1da79ba6655cc23ff0d673be2ecde9488f208ee7d
SHA512081c04968e4ca1ee0851ee78e251c4e32859c6391a109fb24f1769adc1cbcedab466d27e40b1ddf69cc95af8d5f1ef49ae42a342e1c30721a02c4c8218719097
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54aef2684e7dc97812b26ec8a417ec41a
SHA1519c092b58b778fecee15cb9c04db5efd4393ec3
SHA2569180fa8a53cb426275e947f2077f23864932236a76fdda3a74c6e2cdf7adfd81
SHA512c88721fe917ed489e9cd76de0ddc768600ee3213b083d726a4648b99664f5152bbbd562075f4c31f129b57b6b5b8add311d03bf6a52a500aa85975710322ed4e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53042df7def97be811561d12897e37c72
SHA106f6d908a7add1f2d9ad92940a7cac47df0873be
SHA2562edc4199dd22b027c74d24f70357a1fb3b39eea83de03679a167166b599ddfe3
SHA51288402cb8c3a6100bd444b52d16e7ff381ae4dfe570aa73511f85b82457e9d38129a612672416ee70c010f53ab7e4c0cb9c477a225b48a6aa3a6c0e408d61dd7b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c1d6eb8fe9ba70b66da3da55f20fa50a
SHA11f8ab63f7c1f5d66f071ae71e26690f7fddc0dcb
SHA2562878e0d463aa832b2af9eafae4f95cb9a308b50dccccf70e4f90cc43e9b8694f
SHA512b111b1c87917fd7c388dc52d90930b89af52e6a740ac141e6bff292f5c06f4e3d7ba688fcf516096de83941a7413dad3893cb3e29169e7790910cc3cd80db362
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD531cd236f6837038410e3ab53fd427975
SHA1e6d0962b01ebd68045ed90892a182f562f82e8d6
SHA256a35fed0660bc78220ec8294f0086ce9b46569dce5324af87b0a010387ad31c7f
SHA5120dd7696ef1be988c642c3694a48594d216e13da8d51f09594740d4c69574026a2a7ad3ea4688b16a0adee00abd29bc7bcf13f1a800e91fcf0b2eda0a1ff464d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ae3a4136f5d5049506eec8febb7df8b5
SHA1291e55430b0b0f1df89c1c9a6c1a66ce236deb63
SHA256d960766c16c8f9923bd6bb80c0e1132df57b01c8498e8bd42a5244be1122d05e
SHA512e20a0875daaa1ff1f3ab07511bf62b51552ce0512e58ca7786551e9477c37c3960e56b9692f04c33a2790895ce39705231df7ddc2e09e0f111212e5160526f39
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e0660f506829745a7782068b6ddaed92
SHA1a19f9e5760d3fc7bb3b09115ebe93f4acd0983aa
SHA2566ad86f6368e136ec056cea56691a3c8db0adfe6a47060952c2de4cd9e69d18c4
SHA5126481f1c3a02a7ea4925c7721c4ed98003f13f33cb7998717fccba93f8fca7ae6cf909e77907fcba1930eda13b7a484c90196eb1a6a0e6f83ebd5d032b2ae923e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5378b1b8cd4423d288ce99ad7ce3c0b0e
SHA1ff61c46a5b7e554b1d0749456483c7880396b005
SHA25677e63ecd9bc14eb69fe7d52fc9983285897a67dce7ea0aaa0049d453057df0a5
SHA5123b6a41f3f5baea858d29860fc06b74e93cb3c8609a6d6113a137cdc1953b6651ed877cfacba80cf97cb0410a472d85ef7cc4385fe32cac20e70b21b465b84086
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a