Analysis
-
max time kernel
119s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 17:18
Static task
static1
Behavioral task
behavioral1
Sample
60467eed7b9b1137e6c5c015be428ae7_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
60467eed7b9b1137e6c5c015be428ae7_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
60467eed7b9b1137e6c5c015be428ae7_JaffaCakes118.html
-
Size
461KB
-
MD5
60467eed7b9b1137e6c5c015be428ae7
-
SHA1
7a1f9fd70b9217efb2d66861c1d1a4cab9e7e193
-
SHA256
262c10cb92d4ce4e14d7316d7e23741202acfe9f977b570a6c999ecee602519d
-
SHA512
36c4d800aeaaf73a2d333219cbff074f83ae73f5a9bc24a2154285d0a25f49de7575d374f8a4f30e518f827e2f3f910352fc6ed3677cb5585282cb8477c4423e
-
SSDEEP
6144:SEsMYod+X3oI+YFZsMYod+X3oI+Y6sMYod+X3oI+YLsMYod+X3oI+YQ:p5d+X3Pl5d+X3O5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F0568C31-16CC-11EF-ACD5-DECBF2EBC4E5} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422387360" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000002ff173d8a0c033426fbf3a959838665545670070f0071b959eb3ebfca83bb15c000000000e8000000002000020000000760b6045a65deeee8974ffe5e52f06d82bb7599aa55afbb4a1f1cf4e78b13e2a200000006ad9f6a5a19e2b750aed63dbc77858e373156e67463267cdfdd4c6547724eaf7400000007ff4861d700134de1d791734629a267e8742624e50e015074de4186a7a4dcc0b0aca5f163337512eea69d84b806a67bc3727d2c7d6f654d42d6a8686d3af45e5 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1044e6c8d9aada01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000041ff74eac023652bdd1c6137ce30b6f3352c2402a756fac86abceeac01f7db9d000000000e80000000020000200000002a208413b59be2fcb0da0247720ab041b688123a4a0c2335b8bde33c4373f9649000000018bd61ca752f0875f9ded6f0acb7775440ccc39d8adb4376d4911449834fe58634984c753761cfd5ab50d3e191cf28bdefe966e7d76a1d0f462c34a63a7bf726e5298ce17ae936106250ca3d3964ea642781b82b38afb05fb2fd9444d5b0c4101be6b84fe28982a21318e31804a9e92c5384f48e312a59b6c226e574ca443bb0caefe68220f6cf1a18fdd47092d68b10400000004018992a2f22c9c25ffa5e1aa3b55ce1381c277c82a9c57e455672895d1b3077f6ced12d6628189022e83f44a96856875eec2d62627ec57f59e350569968d642 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2468 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2468 iexplore.exe 2468 iexplore.exe 2336 IEXPLORE.EXE 2336 IEXPLORE.EXE 2336 IEXPLORE.EXE 2336 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2468 wrote to memory of 2336 2468 iexplore.exe 28 PID 2468 wrote to memory of 2336 2468 iexplore.exe 28 PID 2468 wrote to memory of 2336 2468 iexplore.exe 28 PID 2468 wrote to memory of 2336 2468 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\60467eed7b9b1137e6c5c015be428ae7_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2468 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2336
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55136bb39dc5ba61e927650ae98c074f7
SHA13b088a096874fd986f0d095a687865195c1b9bc6
SHA256953497afb0e3cf3bba1128c28a2a7ded75f9e6badf14deb66e95e1278a281ea0
SHA512f32a85a5b2ae68538425a64571701be94c70b1c6bffc628cf0d4fa1f265f54d07c7b6418df04306ca3891c9580bc1ebe56c0d86d5a6ecf45c4bb34eb974b887c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58bb56b71c7755fd04534174b97124193
SHA13e36d9b3191a3cfb61669517b02fcac98e7a54d0
SHA256bf46410303b28d022c9aab86023c9e339d15ae41d9d8b96f8abfead639be1210
SHA512d6f3523d96026453291127a688b363e465329968ac21bf0367da38a05c879fdbde4e8f13c0d7f56b05dd4e34a3e761744d94c20642301aae8f54f1bcdf59df87
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56b1cfb73b610c3c0062cf9121a03ec06
SHA15938fae110cfd167b98416bcbaee0b107d3bd213
SHA25601570525c58718930931ea456d65f2b292c658330de264682a6c4420d445f45b
SHA512ce64d6689f67fe43ce9271b4b1f608f5e03b3144384b521d83d519b115016afd9ca08d7dc2333b41c12d8c60d2ac6beded5ca8b0ff3022a192da7ba58f062f59
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59756bccd9cb63cead50a447803b87e4c
SHA19ad49a8a1155a92858399d0a9461a528bdfa19bd
SHA256111ba32c8ff988bb6a647ee486c556c2056b1d906b3b1c1b65c63a136df09071
SHA512732be54be64e1ff81a6117a13032eddc099d8957457cc95f93b1b007cee195cd547d5cc37e71b5cb826398e77f41e4e2ef23096533e2de7146faac187ad07493
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56785126110b13dee035570ecdb6408ec
SHA1393f85b0ccceeff340438ba8b80fb8f7e28cf4b3
SHA256bcab439263f5687b3702a4459a07640b53383cd933c6f8bd34d977ceb064a8f9
SHA5123af1833ebd1ac62c940b5913315719046f7f79f00aef18737cac660978cada16eb837a05d4de44559ca411d3222fc054db913849525e67542fd7ca773f976004
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a419f0ea61504a6ec4e6292bb1d3f8a8
SHA1d6399ceb017dc32730f15721fd1f4d7016df9cd4
SHA256ee7443073001375d1303fbefc81abfb2d5c4a7e8dd0a0cdbece48219d8a143d5
SHA5126f6daa536615cb98cd5e6680cbcf7e07b69b7797f0d4ac2a0e7acfe0b5b032ee08178b60bc1aac4ee957919c1f7b38fcdc8e1639eabf65ab7e60589207462770
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5057b9819981f84c99226ae99abae8b26
SHA1aa55da402c2b9e969c55117bbfa4282963587b6b
SHA256d400b0587da87e9e956599ce0e311c90dfac56b0c7f7efae486ffa5768981940
SHA512aa5934bf6cae0e270c07854f2f0779e057f2e61d6b3550952aa4ce9676d38a12bd48ea63c0525d8d7b38db591bd5831b103168095b6d7ac90953c55fc18e9569
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f0fff5fe06e2194389d25afe012b1c7e
SHA129053bdaaad78f7d9299bd599ff8e4df3d68fa35
SHA256a06f7aca1413b5740d0c4628ba978b68203e3ef31c34c0d431df2b9e3119b235
SHA5129568b7c2df2f830ea38cd4268eba474a12bb6cfc84f077c14d0ee4242c4b7622b6e11dd383553731ad62441fa2ca50ee1dfe9339ddb95130e15f9d1da03d28e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5016f33aefc7c89553083173f1f94ef59
SHA15dfe1766f3216c8e61c8f143f446b17b3b4c1380
SHA256b617a6d4e62f36f3df65f73816a927c383a154c800b623b94dd80bbca3a8da62
SHA512872012e94db0c7545a2f797baabb57767109a4b4e8b980ece75bd5169a382fd781da3003bf16dd4376e44bb9552fc7817ac1dae51261173713f020cfc0b8299b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD568134076c65dc23c6d14306489243e2e
SHA12afc0846aa39685c807efaa742f1cfda420887f1
SHA256477f49aec928f191416de6378a20591e36d30d50b07c15c366304d52d5dfb974
SHA51272e1d9ab1d886bb25fb50b208cbd498e493207e348a1b46d18a6f3f9035c330671b1bd235395a6819f3a0678a63c7f493e795db6e54d22e0f42fbb2bbbafa198
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ebac4e4d9c0585d9b3dca2ec7bf539b5
SHA1ad167e3c1b055b9eacc979341979adda294b57ef
SHA2566c790707b1e176de8f87f5ddeb33eaac02673f26869b1faeab714d2db6579d97
SHA512e214df197f1e0d3858698a5e6cf9be6e8fd62c8f8b1766eb128dc1f177db6528504274717457c4b1f5349b68124afe557bcd64cbafb75bad3c375da44175228b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ccec0325e29ec9d1277fc5d58ddad6cd
SHA1ffdfcc593780bf77dca36992fb23156c5803d55b
SHA256e020e5a734af8e2366254496e33a71f42a63e4f86277f7d320f2f931bdb04741
SHA5129b46c6be4e3c5a34a424dd2907648bf3c588baa8d5852b5c59bf701bded339c862d3e50d48f422c664dd5f9ae005e0a0240a0df9d560644bc74abd85ad3a8898
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD505cbe22cef53e38dbd945e96e7f1deb4
SHA17dad4c8a9aff7deca2c395d7f27b6914de8f55fb
SHA2564f053552792d3cd025300c27f5a3ebbb5836b1012d92e3de39ed36e7f151f96f
SHA512aa3a51a45a0fa685eae92a0e92bc67ff9e75a7a38f9e6592d1aab1766a8fe20766ff876bdefc5e7f0df7e350e929cb5f2dea80bd7f218fb70e43b2f1b1b79228
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58d0cde32f5d3011fc91782d49d87bac7
SHA11d33bc833e8cc9f7b531a2ea3097b7f11f0b9b5d
SHA256a6ec405b64d7d7817d1d799e2bcd6ca85877eab7bb2d7848983c9316a4eb46d9
SHA512ee3274916cf288427d850ac3e01b05d5604af7c07e6e5771643c23664700d7df8c48a5f2108038c8cf1e47413d6d71794eaec218026a9c4d93cb6d7344759131
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c4c5fdcf99f21c7a1a1c896f2517a269
SHA12b693895465b9c2eb0fe47c1e291b3210fc1d75f
SHA2569eb79eac0e06d5b52c31fa0fe38479b06e40af8cbdd320d8788b5d3a9b21ba30
SHA512b1be01055e60dd6f298382ca2a5b207d29d0436c64b03d421f1d99eb7b818bb72f647b9e64e42529ead4afffe2b33cacad7202e6077b195e9e9d3303a3e5ebb5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ff8d882b92d12c2ba4684a2927c31181
SHA169f8cb37fb2b260b9b4f6498959455533d2ea9fa
SHA2567910bb7ce819b66dbe826a61062bd44d7f01f673eccaebef84bceeb628648b5e
SHA5122ce4dab75e19b6974a55f590f12d96bd22c6f1c6eca50d4c61644af42471a7d8a990d6753cb2c6d06280ff758753e1ea5fbf9518f38825aa85c59526d16bf6ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fd95dde84034dfe8d3454cbb48f72006
SHA1018c5f7011537887a69d768bd4eda5de768ad839
SHA2569bb9009a7f5f7e1ff088a68368ce3e9c5b2dd875d1865fa11f2f65a7456d58ee
SHA51207d1aedd78e6c089fe825a55680164e56dd7a6413e5f4fdddbe029c01776c50d0113c64518c300f1a66494d8bc602dcdca146d3d2becf6befa36b142f975f054
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5af648abaff6b643c380f355bcff9a1fa
SHA1fbb418b4226639d8d43cb5d9445f2447c2777646
SHA25652112ad50245d5a0d5478d8eff1e02aeaafcde42a222b5f3f33f01c99a78db7d
SHA51252a49bdbbd2e732d8944b06ef6b1375e72bdcae91228466c3218f7d3e7d0bf4ac2d276b0dc14b4564cb408500a5d5cc328526bafa5fdb22835c14fa175dc17c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53cc7db42bb47231e63f07b0fc66cfc16
SHA10ccc9dc119b922b8ac3ea40973eac14d255069ba
SHA256d9096459ab01bc582db202ca4893f8e342ba866affa9ff6af18f73bd17999768
SHA512cc89a65a46a41ffa68105925a4873d94e2bbfb3104365e68e1097f66e168009b6cea251a736d6ce461382e7ae8c6d30e50774f65af96f1d05ed4181984b7fcb9
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a