Analysis
-
max time kernel
134s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20/05/2024, 19:41
Static task
static1
Behavioral task
behavioral1
Sample
60d7c072a235c34e876ee9430f19c9e8_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
60d7c072a235c34e876ee9430f19c9e8_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
60d7c072a235c34e876ee9430f19c9e8_JaffaCakes118.html
-
Size
461KB
-
MD5
60d7c072a235c34e876ee9430f19c9e8
-
SHA1
2ba36581d8c5cadeaf303efd637eea173cfbac1b
-
SHA256
9402f298693d2665548a2c2a8828c93039e05e7cd118bd44bae9d28601bb738d
-
SHA512
a2708f127293974dc46b20e0b546be1cff02ae753b17b32651d2803ed5380cf54d7df7313342bee7cff6bf38cbc434aa28d46252e298a3d46355020a615e4179
-
SSDEEP
6144:SwsMYod+X3oI+YdxQEsMYod+X3oI+YKsMYod+X3oI+YLsMYod+X3oI+YQ:r5d+X3r5d+X3C5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422398958" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000bacb703724144f62e8b8946280a4e692c54810386306dcec7a41fdf4173b2eef000000000e8000000002000020000000435f65e88eb0c6ba7ef075e7ef409f695c87abbf52eb610ca1a27771d6ce95fb9000000087647a7aece8b2dbbd3273100375cad4cfe1cf8fea3963a0733a72d0d64a26fb6702357419a99353e91b2409b76476d4e3305ac19f4d94d1b14cda82ffa0eb55a92690f92e5324741d0bc445f8e6343848f4a77a1454651b9d35339f4fe813832407a97fb65212be30124033f3cd5433be0090da0f214a93de9f494a7ca3c75a571f65113f672945b86b2f00827b077940000000086a2d8b09f0b05c5ac05fda17fdf23be105cc26c51530e8667a7ec99d198cb3ee13c261f7bf1618307ada79df58f8d21ad8d71f7e1d3046da925c78df4b553d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a700000000002000000000010660000000100002000000061df50c1d6f898989c006acd724d280a3e56d548aaa19c098615aae16cfe9fa2000000000e8000000002000020000000907ade1d8259e859bd7b976a239c7b179551c5e2802cdf6e479128a45ae794c520000000ee7e102be8b46f4d242c0528d50df21231ca47add18a125e602732327f398ee24000000065911c65b7f91fe2ebbb3a6d2e049bea62d9f9f280c9b0caa8bee61eaf80a449c65ab44825d7657d21d8a9771c6a0eda6963686d68b941b125187f51e5700435 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F0B6F001-16E7-11EF-A7F1-FA5112F1BCBF} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 307146c9f4aada01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2352 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2352 iexplore.exe 2352 iexplore.exe 3020 IEXPLORE.EXE 3020 IEXPLORE.EXE 3020 IEXPLORE.EXE 3020 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2352 wrote to memory of 3020 2352 iexplore.exe 28 PID 2352 wrote to memory of 3020 2352 iexplore.exe 28 PID 2352 wrote to memory of 3020 2352 iexplore.exe 28 PID 2352 wrote to memory of 3020 2352 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\60d7c072a235c34e876ee9430f19c9e8_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2352 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3020
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e897cae54c87174ba241d68aaa044399
SHA1ff77d21e9c80e0b7433d7c6ea21435b31fe7aaec
SHA2568af9a49087f2e28b3a1e12607d106b873561e734a9ca6f27ff4ff9ad1ef80272
SHA51252b694dc86a04458ed091a7d75c8772139ba7c8ce93ce3ba2763fd478c29aff3294b129a12f10c8024db79f5b3eedefd832ea5f09e7d5bb54e7d90f6af5f65c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58b254ec8e11383f07474947b8a707305
SHA1a314578880cb9c3ecf99670938b2244aba7f82fb
SHA256e5401c0b19acd4d5452fdf3996e0ca657c457e4e0d51247e84e46c30415926c2
SHA51252c2a86a4a793c9caab2b93b11c9cb73818de5f891013583f97a47095210b5e899c1245e0562da0eee87fa5dc028c2cd811fb8ac1ce279386856a4629b25a8b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ea6b7f155c060a9bff17fd2b5edd50c3
SHA18ab8b383b7cdc1ffefde51328caaeddfb32daa3b
SHA25683a06b4731097d0d37ccbc6c0bf53594df46c103e73996c42f8b8836df1dc0af
SHA5121bb720a99e8c482f2162df7e1ce935c21cd7b90fe35c3062e829c6dd2106396c56b7d4c2b891365b358cf14bafff7ad99807f4de808291884a719606e1d034b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD599bf1f720eecbfaf876753ba34014d28
SHA1926acb464d71b8f4ba188edd4427ce05b434e2b6
SHA256ef1ed192567208d1e981db36f9bc149f204360946e38a73cf98e5a83e5bfa3e5
SHA512035c292fd4113bf88abd7527a88ad010911047c88bf4af84e1a020806f97acc3f841799e1a626a68b5c78cf2ab6c65a6dca6ade56b1fa61acb6f1aa17d3f42b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d48eed621942a58a3ab657847b531eee
SHA17c0e874182cb3fe02ea2d7ffd21ed5f65555df57
SHA256cb27ebd8a91fbdf2dfcc8e2a435c4f6c470ac71660aceca8f492351743e898e3
SHA5124bbd073cb25d7ce7def0df6a6d8d8969d1db8b2999e321ea15cace1e1d46d3e6580d3b321733b9ea9210e613ab6765058123262f6c6162bf5d0a6b93bd8ca0f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD588f97a9f354967792048ceb3cf1eaa00
SHA12204c67f49e696035b55b4add7eb08f5b570fa49
SHA256e09c1a3eca64275e1a0a0cf542231f14a5c9df8da8e3764d5580bad89245a471
SHA512b4f6bbe19f734cd8e87ed972cda9638924392b55903a2f9eee6b7e8882b098d0dfc6a16160b17d22869c0bbcccf5a1d5d36033b543883bb883a9699a7073b483
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53ae2fba87414c304b5405516898b0a91
SHA1c6ebb2cc04672c71c55787bce1bc7c753a274b20
SHA2564d1281a7c6a109d5836226c5ff84e3875374459335509c095e9dda988c13f3cd
SHA512a1d08db4758fe6df2d55240ba5cc6c1dad23a9c3a3357262234af7e26c96ea66a8a5e23704bdbcd11a5396376f0e8c18359b43158bd0b8c438a953b047630bb9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD552def36b2620a7e23abafef98447f303
SHA18929e722cebfa19ef4735a967ee98a6d015acc7a
SHA25640ed6637e13b8158cd6942e408eed9e19ef98b8099ab2c72332af6a0cd9c8cd4
SHA512bbbcb7e17d9ebf9e36c557e755c4981f83dbbba5d88491950fab48080d90c2a2e5fc90bccbe12f6cae394210860f46a3106b31a3db8c7bcccf6dbc683780390d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d70a7f6bbb39155158af84b6a2963888
SHA1d3091cc981e1137eec96631562ad72f852ea2172
SHA2565671c2dc6f77d9e8a68afcb6061354d20e4ee976ff60cc94f1a05c410569c395
SHA5125951bdde8f43778dfcd620d45760b1929d41553f78fbb661c52dbbbcfcdab878c96a33fc3b055e2198f5a8117d0783465c1f0fb63f5661fadca5cbb19dcd067b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56508584c2db694ea9c6ad9473d774414
SHA1566bb5775a76994109785847148d80379c55a5e0
SHA256e45de3fa8bc88842d32ac9938aa4e1937bb7dc1246cb811fbb82e5dc75893fa9
SHA512dc4b3983966c85b0af60661137f4af0858ce29a4033a17fe9653e99009448ef11d93cea1fe566a9295e3960502cdbbfdf9f19cb53967c4eed7ef3ff7d423df56
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e72aa96b2d032c9c2b802c681b77359b
SHA187c78580601d5067a214b191c16be3f1c7f5ffce
SHA256dd8b4335540c3dd34955738ec2c20deead7079db4e46ee9a7e335a2b4460811d
SHA512b88ab95f1150d7e39ca8c258c6d1f7eb3065899839fdedc4eda730edd6a2978a4e5a13cc0b40b483a80ea3b4699302fdf8ae6f64fc8c05bdbf4e974a7ea6b457
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5645799d55e97ca8204446c026b7baf69
SHA17f93e9acdba0da5d1badc16c4cb60458c4138548
SHA256e8cc7e1539d75ce9c76e013ec1d9388696020d3ebca1bf753118ab1a8126431b
SHA5129284d3c2e3feca540f67811744bbd160d69b89e8c985549fd1623968b90856bed0db822a9c4c27acaafb5171d80a97a37be090c2e8724f21abfe4e41818e2315
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56184f89afaf8a3cb4ed110696edbee83
SHA1c75e3e4f0a87f84ca071ac9b77e8c5e1281b2578
SHA25668b3bc5f999666487ed7815259959649cb57e9f83e0cb4d50303576adc60e5a8
SHA512778dc123328733bf5f71e6190701e7bea1e1f0134a745ebdc911daebcc08fa15d302fc6fc910217bcfa4271a3ec334f63295d83f1ada700ab25897b89e124eab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ca7f01f1687525d5f2a47c7e9259ae5d
SHA15f8d26bf0cf2ece1db58e7a136ad10a015ac2612
SHA25673327ae07d832d75f266e7971a03156da01604fcd7dbb202b19f10572d36e320
SHA512df452c08f4341c2b1b427c6fa20ce6c1c25a7b929db05941881fa42d2864b06400a8d75950f092974bfbc983938acb0e14d3264b9f8bac05f8f26ce2ebd3f44f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55e19cf1e40cdb85045ea2ddd400e3c10
SHA1eddb1c7472dea48c96e534c34200158658cd5660
SHA25666b8e24f20709407774fb8483751ebaa49017d9bb59597cbc2e5082bfb692a14
SHA512212cfd202a184148fd9d3a721cd5473f432cdc9951cdf167b5a649dfba2e8be7794fe71273385d450c17b0c86ac0c2234118462d5ff0554f32bcb4e1466d6eca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD510dfe2f259dedf166e121200403103a4
SHA10f12a8c152e5b6a57362af23c6614d2e3c2a8151
SHA2568150d64652161e91899df15d8382bde69791eb134d1eb3d34bbe1f69c77d0485
SHA5124409524a0a352abb11063a73bce9f85e79ebf6e724bcc6786f061b779ef92f3978545fd4f398a1e235975a12727d5f47e9983a311500935d6a96011ad11300c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a66ce365fec5bfdea56ccb44180320b7
SHA1b83b91d24a45601553200b861977fa529d6132e5
SHA25636fbfd239af122f4a712bc1febff020bd539fc6400155e848acdf41dfe250635
SHA5122bba97b866fc737a3d4edfba7dad2ef895916117e3c4ac415cd646f427ee622f7673f856797c309833a39bf0135653735ef2114a36d0e98f40a7f0ebde1fff14
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD579dd68202da60381f81ec2ef520f53b6
SHA1963a1b8c04403df623fd68ca9ae1f37025f3a87a
SHA2568ae3b8665fe7bd00afabb8ab8dfb221a74ed89146094f42f936eb874fd0916cd
SHA51242daaf22efc3992a3ee34e6d3089e841df8e565c9bf2f6da66f8a98c3d900dc8056825608db7deed54a5e8c393668267edda7d9d85b05d7eae7307549174fdeb
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a