Analysis
-
max time kernel
134s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22/05/2024, 01:38
Static task
static1
Behavioral task
behavioral1
Sample
658d02e1a5e4ac2b9e3315ea5f1ebbcf_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
658d02e1a5e4ac2b9e3315ea5f1ebbcf_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
658d02e1a5e4ac2b9e3315ea5f1ebbcf_JaffaCakes118.html
-
Size
68KB
-
MD5
658d02e1a5e4ac2b9e3315ea5f1ebbcf
-
SHA1
ddd6c2eef21480677fc82c33aee4c2b1a0ea7e65
-
SHA256
779afb0ad8904271c13bb4cf79fdb706b1b9714fa98d42efe917125c74542c53
-
SHA512
4a8fba36d2517ffcec5208d03b8b40696ebc607546e36689dcd38cc6d41e5d7f21c2b236b0f2411eded3f3ed445e4bfd210f5e609426415c6451f4561956a377
-
SSDEEP
768:Ji+ugcMiR3sI2PDDnX0g6iqQXoRZ2wZN+oTyv1wCZkoTyMdtbBnfBgN8/lboi2hX:J5xYHHzTcNen0tbrga94hcuNnQC
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422503802" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10d25ce1e8abda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000548b5d7be02bf54d813d789c2a8a578b000000000200000000001066000000010000200000008bf92a290bc7f83f4bf83ba003a3f6366f7808780ca5e7e8a2df40abde5251cd000000000e8000000002000020000000ab29287a65f72e8e67c3eb711f91cff226b3c34d9f43ab8a1a4edef12844807c200000002ef2ba35c1cc8845e1b48fb1a7f366b07f062ec561061f3649548f2a510d49554000000021e1bbb6559f1c79eae03e33c867bbeb586d297ef19c15f932ca6f7d52746853631f0ffd4c5b6c53a71918aa6293fdb1ba7541388136dd031a5075b725f7044c iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000548b5d7be02bf54d813d789c2a8a578b000000000200000000001066000000010000200000000f6c10eccc2035843b0fd60c0913a954b7dd7b1de20676197de9aeecd81e78fe000000000e8000000002000020000000ec94376a527ce2f630d76a6f3ca51e766910b09ccd3d67ead5ff15be25f9ec97900000009a143abe3ed4c03191fb9b9c25708bcc0784405742dd0553fda3456d1bba3c197c31e560497abb174c5115e3edeb9cb301ed13de1e957c12a98a014df0129cf115964972a0256fcf2e1486a804db7bd6b6b83312a9501ff2b4443fdaef634856e3ff42c2a9eb257fde2f67c75e7f0c34950138e681d40bc636c3a44054d3a46189788e7c05e76ad7d653e54cc2aa58f540000000b01697d24d462514f526733cadbb984f04df16427705971a929b164c06d1309b3f49680870f1e2012a3cc6dda502918836337bd7c5bd4762e9b29dd83d40f30b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0CA821E1-17DC-11EF-B1D1-D2EFD46A7D0E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 756 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 756 iexplore.exe 756 iexplore.exe 2620 IEXPLORE.EXE 2620 IEXPLORE.EXE 2620 IEXPLORE.EXE 2620 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 756 wrote to memory of 2620 756 iexplore.exe 28 PID 756 wrote to memory of 2620 756 iexplore.exe 28 PID 756 wrote to memory of 2620 756 iexplore.exe 28 PID 756 wrote to memory of 2620 756 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\658d02e1a5e4ac2b9e3315ea5f1ebbcf_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:756 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2620
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5917e096fed8bad95600f4ee894384ef8
SHA1d474bb4d4b1a965e044edd076a1255005ec6bd89
SHA256a30634bf704077677deed4d071ed87d8290d461b2a40d3a14c710fd3415eaa38
SHA5129f6f328d17193068aa33e3c657d7c5c4c2847ef603cb193a84e0ce2b6f9be79492ef9a9607b4f0b9479ad4b4825582b5e33febdd3176166570c06d64b57389a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c0f42f628e4e3c742d99d60081670b75
SHA17eb5da9e9f0bc7b6360146cf85550b918e5c93df
SHA256f6c7649eb7f27cc7b404d2223f8de95d4dcdaacf017866a8e2f38d785806a932
SHA512a55c252530a13d5215af40054098bdddcdb152761db186dd27c9b3918d9898f3bcd0fc031e69ea477032ef98957e44515fb6af5d09dbde9379abd7279d73b29d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD574f526169014e9150d8b5d1860809efa
SHA1a274caf655ff5f2148883cdc46c26c9940ebee67
SHA256f77840780b2b3ad0369e17c8f472e9777dafb78d80eeed232947998860944b48
SHA51234934fb2de259ff073ca93508272a738d50e10e907122098c842f7b865473323d47d3cafba58903ede7b865821b2e53f5a70da81709927998559a879cc549f23
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD516e30e103e065db9af20039c4d611331
SHA163ece0081df8e8016420dec10d6864948c1f428f
SHA256cae9974356a0c78c59911734510eec3583ad211c82ddf3b68270f35c2d23f1a8
SHA5125805607e0ac4f8b95a757ff68a84a92b575c07ce6e7c88841b4d244734a97193bd525acb217b18bda2ba9a8b81d98164cb83eece5794482d441cdc1e204ffc6a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55264dc46eccf93fecaab3fe1736b72e6
SHA16e029580846a99effebe19ae85699eeebc36e24a
SHA25611987fc6577af70716a4e803b5d90c19705fff39408b0d4bf525ece3f60dedf7
SHA5121d1bd05f402938ecef3a1b15bdb63071c86ceab033e24aa798f02f1211f3fb44d6500871f1553f7c0cfd1dad9ef00f6ecf85dd669c68055c2032076f5dced95a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fa976207188b3d8400e356f38b04804b
SHA11defc0e942894160edf9e98cb98e984e02731108
SHA256bb02826e4f8eb222e926061f4cbd8b73ad9eb6ad0ce63e368e4dbddd45fda84f
SHA512de87847184da8abef9552f4752eae30dd49958cf24857c04f3cd3b327ce7cf9d16a3000389b6a9022bab0b239628a1a350381c55e3cbab0d84a4da1dac97e7c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD528b63e1e6e9302f8ec4a1f3525048605
SHA146cb3192e2d6134aa02392693540531782600581
SHA25671e73a3d88f8d4b4f72c26ea5e415b83f68a4cc0f7567b7f8eed34399341fc7d
SHA5124c89bbe2271f6f0bb2e19a77a825b5984deb02b4ece48854603698d8e557bc5c611e0d23d47738ac8f882960da5106162e01610975b79f48ce372bc1dab3cd0e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e9671d5130c86af499812dc659ce3177
SHA1fa0627c62daaec6b098cfc006ec760dce2c91680
SHA256537e15a024188042a58eebec94dcad1b3fabe21e9bfc8329b8660ae193750963
SHA512d44a4e520f2ff5c7253e0d51b5b4ac07e1c978b895ba976169c0dfa0ad18de84ec5c4e33b758bd41d67deda56dd28eaefcba917580660fa1bb8ccd9f59c2573b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56b7efab1cc42509356650038d1cda454
SHA1de918bd1ba515b20ccb7bd7b83277667c9b3e2a2
SHA25618f733964bfd0630b8f501b5b1ca90502b7dc258c03beb831eeb37a38f09160f
SHA512510f3dca993a39b8429f64f7e6c818e75815b7e01b0d66c3f341315ceb9bdd83a9a128c02e621186672cb697b12a3a03b50823961cfa2fa7b079b97b21c9609c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5591cf16b9dbdad7413a4e8c17d61cb57
SHA1ed19622d095dea7daf53ef0d74e264c2f0c6c86c
SHA2562db5250a2364069890a2610aced9c116b88effa9d44e22cae522b486bbb3f6a2
SHA51236fdfc5308881cd7d6b1cc1db6e848a10c40709c6d48d318f10b6f493dd4e9a91cf48c767414e477c1c3a9ff39c38f5341d6b95e7a2eb08724518aec27ed7962
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5175c4ee446792e94f78e90cd640a99a5
SHA107ce94788eab36cf5ef765b50c6aad2e51de2930
SHA256774c6e33036e811101541988f61234026808e770d76e8e52e380419a2b020648
SHA512a9bdae17fb02b7a1971ae5649b2256f3dc5c61fa1ab16a192a29e3730f464b8f7839257de0d88c886cae5f490a4f9e3261aa369b7934e1b8248c6deb86c5999c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD545620b1ec6450cfff9613cc9b17dd5a6
SHA13a9c9a69692a9637fd4b092705081d6da9a2bb17
SHA256bd51545e8e91aeeb1e8a78efacc2131420be681f412e0d9459035a73af7979b3
SHA512949607c38013eac2f455bb5cc135020971ef4f4c0614d05c24c0742dfaba99dca5a6c0b928884c37fb184533eec4c8429171cd8c7bd42f366698706cc6715694
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5067d2948c7fa157e34287d3192a7540f
SHA1b360fb928293a0bab0b7da9ea4e7de20324dcd0b
SHA2562f1791333539ea239fbe0632dc7b839acc3f64ff05b611e2641c80000cff30d0
SHA512ae4547862f340db9ed6dfca42ddcb1c4902fd93b0d6a84e256e9e1919306331cd43f115d77560391c1f6bc53196ef5f145278ba09b4209fc3ecd3bce83b3c051
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a16d5a9c35663f12a9f40bb5695cbb9e
SHA15bdb6d2c6c0ba7224d726ec96ecd1d0391884fd9
SHA256e6a8976f1fec2ee88b230cdbbdd87ca232552b8d8ce103c84ce0d69f6e71aeb9
SHA51259903b7a15b8a22b182a1d22b4f595541d9db303b32441522deca94920d29b06f5f927fa74e5fb7184139f86a6762721a195708191ca1b2be63a757bb0030e27
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ff36a008cdc69863118b0d803b9b5cbf
SHA1bd0a257a73ca3ab880ba4a2d5ec0d17dd088371f
SHA2569b58d623e5cd715b7ae571bb9175cd6e3d9220fb5a01b062d64fbc27f42d5b2b
SHA5125975be5687fa5a6517e5b6d8651c21831a67cdba80659ce1c709d801f7c14f88c45b173739146d24006303611b7d59fab11e3367af261aeb77e247b6faf8da5c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD528ff71947cdccb630d2a80d292e09f72
SHA18f7ae689dedb86f88c974b1f2c42aaa227f382dd
SHA256eab3f95a54c7517e8b8253d0953db2cd474a2d67f70b0a1395c9e4172f85c0c7
SHA5123d68de0f0f0202ea577e9df3310318d86a3ed36ce3f9b03257f17e2e5e3983c511dd60f664f1f8dc4bb8eaccb1af0aa93fc452409ac2a4586f8ecb24f2e715ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD521b13b230938e3caa8e91c5cdd460b6e
SHA1920913690c19dd32014c49d09ef2fc6242c0a593
SHA256c457f1ee692d8cd44d4841162f3df1e54d5fff5ba33d2bfb0451ddb6bddcea23
SHA51283d73b7f56d9ba363af07e404bbb293cdce534f4c584fc4eb8d1bcbf1efa93871abb074c83e66e4368d3e5a159a271c5843a2e4d1bbd3764ebbcda92c8d74b31
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ba0cd0416a927dbdb85b2a0e9ee4575b
SHA168cdcda9027a69114703f549fe9dce4967b385d3
SHA2561070223c2e38b00d3a357e9b2e1a2b710c054a21a79d322fdc44f964e369673a
SHA512de23d91cb0a4ee3f71ca47b7ebee1f92dca28b90310b51a2583e8d8a5abb08f10e0050e87e28588b8bdb97aa9ba987adf53e36247324e74860d2bee44cb0cb81
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a