Analysis
-
max time kernel
121s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
20/05/2024, 18:58
Static task
static1
Behavioral task
behavioral1
Sample
60ac978c22fba74fda5b528d2465830d_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
60ac978c22fba74fda5b528d2465830d_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
60ac978c22fba74fda5b528d2465830d_JaffaCakes118.html
-
Size
463KB
-
MD5
60ac978c22fba74fda5b528d2465830d
-
SHA1
91939ff2e6cc205e65d7892767328f3cd0be607b
-
SHA256
34508748c91c15ab2914435ba2d635617fde0aa625ff687bb2144e92571c3559
-
SHA512
19a4cba69c1fb474d65bbf884e1786dc8f123d7b2dd3bbf2880ec4688e5af77b6d5b8c45c8f91870e3935b38346a37618a03f52394f3b44732ab5720fae35b05
-
SSDEEP
6144:SJsMYod+X3oI+Y+QysMYod+X3oI+YMsMYod+X3oI+YLsMYod+X3oI+YQ:u5d+X3k5d+X3Y5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E5A2DC41-16DA-11EF-ACD5-4635F953E0C8} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000a9dd3b710d3e1cf330e5c1df6cdc6412ad5ba47168a6ffb959d13ad9f69c3480000000000e80000000020000200000008832e2d5a6230282656d2005b7b210f44070357222f06682a5e3b0ab43e1c45790000000b54a0da7ab6af24d38b4d4407530171cfbc1ce5c5f4f5a1263f5419e3443be2fc80e9cfbfa0fbd504c017ad028c42641789b2ab7bea424fb037b66f613445d9af28f60af5e6e4a66b14d164e08662f168978a08b8a5fef3733f8c122dcbf87aa48cddb4435e5cb15970f39e72ff16d20b4a8c46f723f74e4cc241bad0893498d82da3abf3a28c0871eaeddca212745a4400000006d268fa837833fe4b4c88157f381a7536ba06d5bb89b3792cdfa8fdf133e32a37d6654aa1268dcc8244021969ebfac954129f2d4f270dd8f2753d21b9f50b4ce iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a04a1fbee7aada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000abba9c280a1f404ba2dea756fdf667d4708192da7b18a87410ad8ed8f3cc950d000000000e800000000200002000000090bd3f1cc17e43dcc68e3081801dcc07056e6f60beed5ea044c06846e68e016120000000ca72dd31dfbe08eaef85e7329aa55aac65f2a9ede2a819b386869e285b9d80cd400000008e5d5e71365b206e30bfaad074aee8d829275a8b0e3dbee38547c2f095c6c24d606bb700d7ead61db09da72f6bef200f4c06aaa20b503729a60ca2b1ecf05376 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422393355" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2180 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2180 iexplore.exe 2180 iexplore.exe 2924 IEXPLORE.EXE 2924 IEXPLORE.EXE 2924 IEXPLORE.EXE 2924 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2180 wrote to memory of 2924 2180 iexplore.exe 29 PID 2180 wrote to memory of 2924 2180 iexplore.exe 29 PID 2180 wrote to memory of 2924 2180 iexplore.exe 29 PID 2180 wrote to memory of 2924 2180 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\60ac978c22fba74fda5b528d2465830d_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2180 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2924
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ee565d88b885d2f65e3d4746125b977b
SHA190be13402904cf0babfcc0dfc43b8bec6738545a
SHA2567f73a8d8f165fb675d7dbac43b61422eb5a781136c11208825d31d2edd06726e
SHA5123046b09ce17b7d039e6f4b2e45d224ed4ce039703505c724da7972bd3d98e87e65f33988e9e342cbc8bb3ee1ccc53afbca367eec7fff999266ae7af593386b31
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b3cc795ddf25437429dd821d5a5d326f
SHA14f4617b953a5288e0b8be9f924361a08735ba6f0
SHA2569899c583762f1468c13bd7e5b7454fae675f63561bc354abc3576e9b6623eef8
SHA512b93b43f012fed88fda514d8dcde818e551880d51ac9bca060d227c192d61557a42f51194ca4e6bc3701b3834430d20271afb86d5b631a5bb07a424b16133d2f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c6cfb9993bcf3a6eea8740fbb89b69f0
SHA1ff2ef2f7fa870e285631f15c379a0920b2fa09e6
SHA2567cddd28798201933b2cc8bc9cd65aa2bb178fdfc4ef0e7ebe377dc6abc262fe0
SHA512242c9950d2b2f49da9abc02ef7a41852c8ff80701d39994719f6e225df0434d71931fb94dec70876e92e048ea004f5ca2950bc7939889f9139522bf8810956f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a4acaca0dc8ca9ae0a569d3fd17d64e0
SHA1ecd0707fac7e2e2c27261c2ba8a82c53f7cf4ee0
SHA256301f2f81db11c023cbfcc5c60b6da6e77c6cbf28757397d09c16ccf41671d967
SHA512d2978b7e4064c43a4ddd4aa271d6901bd7a44f5bfd2daf9a491720b59b4bdc339b9b04f905fc8344e03c62dfa43274878c98f55b60d0b140848b8495e01349c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55efea8d6225881bf59e872ec52df935f
SHA19dfbe08153bfa43de23c1fc6956768de9137d3e7
SHA256830eed4720f750c86b63ced782a86d41672531290cb299ee6082772ddcd6a542
SHA512f3043594fef05f4eae2dd6b82dd185376949fa428b2ef51ce33ed6a555b435941ac0e59f4e868838d3ca13c94cb88ffdb04b409714eb61bbe108d379cd61bf75
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52462d91c31c34620816bacc001b52fcb
SHA19754b1976f2206699f7ea2c97970581b2c662164
SHA256c30ccf550f26999d68cca4c33a44ce9571e656450395f0ce882b433a42e9aec4
SHA5125cfd639c9947c05cbf31ed1a8019e94dde490298ec7fc30180e6da7ea3006771c5f261ffae007e1e89b30c91f1d6ce1638b44049ec099b8ca1b4ea8baf9dac23
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5719a116fd8f3cca834885c634c30bf16
SHA1080eba017a163842643f305d9fc6bc5f1ca7503a
SHA25653c3c1e739cfa0a017855d75d1bf1ef72193589dfeec9f9d87658933462fce94
SHA51263f78ad2b79b019370e6a446d213e76ccc0169d2f9c43da34fb55ffc642be8cab3eb98643743fff94d4066193c3530da61877a8a0f358db660fdb9ed02a65856
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b8139184bc71865f515a7fe5be20640c
SHA17bc0e15648105d2769b1a0c17dd8d7f32573d664
SHA256913a232438f86d0fffce846d0f65b574467006a9038389918eabbd6d0da688b6
SHA512dea78abd12edbf10ef59593753b9ea03bc762660e404fd3716deeb915fc529a4bb9aaff166d9cc93ad2077ed39b159616760e19b944b7941103b23ce4fdb0f2d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD559ed074bcc0c81a87cd298b709771d02
SHA1fc527542a0e35a06a9f9da52ceb3bb425dfdcfc9
SHA256a0a9672d6870c194441ad1709cc6836c2eb8f0793dcd6bc870942be157fda215
SHA512497d816856c8e21a5346d6df95cd0cd6fcaecde79e89077f7f3a0ee173367184cfa5559ded54e567429a0da62980621f611f0533eed1a7aeee9f4da3c5bd27e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eec25c43d49331ca5fbfadb81c5fce5d
SHA1fa6e1485a8b59abfe727b7905842a69c1a1a1557
SHA2563f9c4304cfcc0bd71df5375c04f972b1bd224c7c4528d2023a4cf5f4e08c25ef
SHA512d60dfbe41544bb83a4ef42a017ab17c35dd988a145283defd4c7b1e98ce72e7c92c027a78eb12e9746fe487255a245955b4269d2d5e2f399f00a13ad464f6806
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e78a6d3f7e9fc4a4ccd89a5612defe5d
SHA18a43cc22be4ca2f537b892ac0a342e98ae82cc2b
SHA25688ae00f625d02742f807a9a3d161628b72538a368f35f177773b09da714f7e10
SHA5128265891b3069f870d2924e4aaf343c34f30a45f6f5a4026387094a866cd13d79de1cbfe47a1513ead799aedc2262bff18bfc43d21d08be19754d4ff183b07c77
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5488aeb8787ad6729238c94c36021ce6d
SHA161d65d98dd64bfd285e2a75289002ec6be6a262d
SHA256141a2155c5569817ab939650db1e368c69012c18dbb398171b0ad41c0f7ce4b6
SHA512bfb15e317db88d8412380cfd0ee86588273273a7b3ce99a34740b5057e0b0a87d737fad77e776b7f5cdfb2351dbd565ca3e7a4cf6c19f78020a3a2254cb4216f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54b57aee0652a4271d669c260a2e72bae
SHA11ffa749aca78d0ecdd39c601ecc37de2709854ba
SHA2561fe37199c50094f985d1c8fed03d431d54ffa08e5a4d0a0d1d5b5eb4e3efc5dc
SHA5125b7c01017522009fe06c2f4490e2d5d2af6ddd2f14ebf8cef7bb0128c07c1bad6272e9009900b1a676cc4b1225c32db2c4db58fa0c9a40059485e17d0c91fd55
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5741cf5918f80dd063db603078251fac3
SHA1cb93d93eaa2e669e9cad6f2713fb3dcdfc7d4ff8
SHA2567c3f41bc5285a2db31d12ac87fb5772f96a0cd098f54c58f97ed6ff28f7409e8
SHA512d9b923efaf9c895b33576d218cec9c69ccf5afbe46bc4f06ab4aba8f81ab30c7a3ffda605379d144c135092366d5564d0cc7ddee34d2432dbeb5d34593d23604
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53990253e7eed79f2a9078329a1bf6cb1
SHA1ce1099aa9908b0ca341b78da51ddcfac415722f7
SHA256a035348fe07788e105f7186834e712a6070e87efe5e13ff3419ba23b27694014
SHA51298d4f9921a7e310679de084425ce27087e7d693d68d8abf9ce18e518690e5e6412782b9f5d6e0a54e3c7cc39bb950fc828b268ae9a9722bc4c52d8985c59f06a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dccf4c820c4f2a4e00b416c399bcff4d
SHA140c28305be0529d9c2afe85d504cf49ffcf7fd06
SHA25691dcf74ef631d903f79d9f0a964cddd85e742bdd21c32a63e922294d3fbbbf63
SHA5126872790c37cd01b88b34026138915c10e5a5071b719700b9add464bcf7532e82d6b1d5c0b67cc21625ece1e1b9c15b6422b3ab698baa44d5de8b83a11062d5d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD554d850c265314491745b7143ac5541d5
SHA1648d538aabd1797c42b7fdd7a295b3335b5abf3d
SHA256f053e99cca8bd9dd6982ded12c1c7cfc11a3a176fbdc2b1a703c846f8800a0b6
SHA5125dfd201f9717bda4e1d4152450b93920e10e62a466b09b311f9d6188a3cc591bfbe19e98f2922b00ce7f71d7a6f29e13acbb2bc13b557314f97e1d5f6a4d352a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57697c598a2a96c67b3de447cc05f6d9a
SHA1054d7cb98c27fca46fcab7dd30cb0b6abf1d47c1
SHA2563aab0f889bad1e0535345a2849f92003ae1e6d596f179da5c20333503cc1c7b4
SHA51212e5b29a969c6d73ff47210fa8630fdb2754326c9afa3b484bad95e0ca31103d6ce062fb6e995ab8c19dc2eccc3b1fb8536e0c77f09f7b7907bcfb072195f887
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a