Analysis
-
max time kernel
141s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 02:46
Static task
static1
Behavioral task
behavioral1
Sample
65be8705022410c66cc8f8d48a144a04_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
65be8705022410c66cc8f8d48a144a04_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
65be8705022410c66cc8f8d48a144a04_JaffaCakes118.html
-
Size
71KB
-
MD5
65be8705022410c66cc8f8d48a144a04
-
SHA1
be49a71d8f26b7c531410c6225f807bbb7ee6c1d
-
SHA256
0f10307ce47703fe9cbfcb80cf0da6fc5790957423af9b99c1fb0b170ea678fb
-
SHA512
0adcda75d5bde2f8c44d26dcb82b072e37a30bb6f7dfd7fd60a5d266a0300c08fb0ade585a0c71019f84e2ba7f72a82829ff0f6a66a5889cc91e941edd4ca2ce
-
SSDEEP
1536:JWkADkAZckABKQbZkAXhTcr0IPGNMxZPdJXxPTQakAm+S7vFSBpQucfA4mJ0W1PY:0kADkAikAIGZkARTcr0uGNMxZPdJXxPK
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{884A6FC1-17E5-11EF-A759-F637117826CF} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422507875" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2012 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2012 iexplore.exe 2012 iexplore.exe 2576 IEXPLORE.EXE 2576 IEXPLORE.EXE 2576 IEXPLORE.EXE 2576 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 2012 wrote to memory of 2576 2012 iexplore.exe IEXPLORE.EXE PID 2012 wrote to memory of 2576 2012 iexplore.exe IEXPLORE.EXE PID 2012 wrote to memory of 2576 2012 iexplore.exe IEXPLORE.EXE PID 2012 wrote to memory of 2576 2012 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\65be8705022410c66cc8f8d48a144a04_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2012 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2576
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize1KB
MD5cb35bd9d6c5a4fd50a9263018bbd9784
SHA1efec24f93d2af7bd01969c36870ebc928fa6c790
SHA256be648ee93df285417e494e28c01e3ab8f3d043845f4d3b397dfd137d187ed612
SHA512ac26182fb167458da4b465b118720470859e8028db8d3d71ddbe0c5be0e46b9178c5f7ccb8b1252c38754e27da1af546f8d2f6e32e1bfcbeac0d510aa831bf11
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Filesize724B
MD5ac89a852c2aaa3d389b2d2dd312ad367
SHA18f421dd6493c61dbda6b839e2debb7b50a20c930
SHA2560b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45
SHA512c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_02C4C6ED250727F9B08935C0A9565568
Filesize472B
MD5572ce74ba9e3f6ebb167fa9963207f6e
SHA1278aa8ba3ec53d91fec84d2529ca4248007d5b30
SHA25617520108d1756f8ae26f0f66aa0b175d9f29e93339c4fdb67d2687906e3e917d
SHA512fb8420b98a725c41301795fcab199e6bd8fe66bccae39b3d1c296058d4be49b6eb2dc5a48aa4f0ce62424c13cb16e0672af381f3834f35b25de6a88010e7a9d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_91E41FAE8B0B67645773C1C9A8DB10E4
Filesize471B
MD55688c673f543ff5d378c6a671b3f5215
SHA18d906e86d3627df2e893711036f21ba700c92e67
SHA2563bf10ad8fd66510922f3bc28b182ad5c2ecf8fdd38abbfdf00054d0d2cf02a84
SHA512f4c77711a8827a93b20e6b8ab93255f1a6fcc765bc632257fd7034d147e741fc1c3d13ea0ff16428544e670da76926f05a6fe008c0415d814fa3f8c7ad868257
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize410B
MD535a963f67b721b413eb20e6b86586469
SHA16cb2cada6de07d34b4d7c8f38427e525646c9507
SHA256e0cbde8083dc5f5e44f3d7f74da486d7d435cda406a508f84e91bceec764c16d
SHA512b6a39102c6e7e63b33d9ba676da26c0d7ff336c11917dac96b8f17f39240aa97b38edea85c9ef0aed6b95d6b6e5e167c63444d0b549772035ad808ced916612d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize410B
MD53d73c0453343e47e896df468b86e0ed9
SHA1947fd6c5ace932540421eb2f8e994cac2aad8ec8
SHA256c265ec94a62afc072ca5a97ac6ae39a817e17c05d8c890a48a3b15194ef6862d
SHA51268adde0fe27ee520138120f5042d77741b408f3a3d0c9978ec3883cf3fce7868e34695708c91d648960a4ac4bc2807346baa733c27637f3145abb1b7b30ccb9d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize410B
MD55250a29839313541cae15d3ce708cbfc
SHA183cbcecc012e395200e349e65b04a4145a16449e
SHA256ce4636fb7eb794bf9c26b74a09267ecc4000307a03fa3b36f8648904a1ea10a6
SHA5129d0ff50dfec11b121dc50259da489c386ceba354797bfe9943d8046fd3006503a0012c57a0b8efbbedffd21e9016841e30f819aa8d3c9c461dd0778cd8b29dad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59fb91347d11941ee688767639c421e44
SHA13412db85c4852dd501a1de99760dba269f464604
SHA256c7389d063ffd107f2e31b2267487b0fea16d20fa2b35d9d892a1ab44c1d1b968
SHA512368219b3f224cf0f938601ddf04c225f3e3724ccc0a6e517601961c5075ab62cc1b210a21edba88cd1e15ad520eb3754a04bc76af9cd05314514b7cebc011f58
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD558c527edd18ec83d15706b124ab644c2
SHA1b6d4a8c1702ab1bbc850072177a7cc232d8f767b
SHA256556c7045cbce9515149edfcec97806952694620ccb106be423469546de3286aa
SHA5126a1fe9a2e6586fe8192117f3068804d9bc06322ddbd8cef11c8b8c72819f0e417be8a26b2f950af0ab777d057dbc8ad563dc59a50215caf8003ff21c892163a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD529ed62ff34a0db3699b4f8cda291e37a
SHA156dc0217f63f84a4a7d1c6b42ea3d12669131881
SHA256cd0e37b547a6e01ad9b379a8407fa8532d931ae10ac01fac353a006636948751
SHA51258b233dd858c48471e70135e40da03f5e40cef388adca2881cc158a0007fc4338a204077d3e2ba8204506d431dd94a6293cc3e8b6c37882e60c8c4c85da56071
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56fc1ec3181e84d58e32c612d2513386d
SHA14f6d6c19a602120f9c7682f95ca6b4e70de2b9a7
SHA256f0a20a29f3e1b8ae1961a77fd6f1ec29309b778ddcac18dca7e92017a398a8cb
SHA5121567bf80505647bf817baf2b94cf94b70898639dab950cdd841039bc1c69ea75c7376aad8e3e9703443e0e284ea3f2b21edd38aec1d079c92c7de44aecd954c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57a88c0e3a5f5b61427b619f0660f37da
SHA1609da3703acd55dd70c4d6acc74925ea517129d9
SHA256804984caeb5a41255170ee8f58b940346538ccd3713ca95044634640dd8a1b9f
SHA51288f5d890d88f02da8dfdd1c034dc952179d60614a0c9cec0fc5d1cc17bc0a157eaf01bf04107fd968dbe4db0e510881f45318f19b49b1013f04fbe0451851098
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57fa2894f18b2b77334b60b5bb871177a
SHA177843e8e8a72bc25d282f619129d4fab33ff1af9
SHA256fbb897eba15aea5801f5966f0c491df13a168dcdbb31dd3980ac09fca8e45b21
SHA51246acd13fe490fcbf0d33beca346d480a9112b20745c89166d351e38c310a6ef523b940128c3ed196c0cadaeac0a33ad7e8aaac14af19c4bc9730577ad8ca0ae4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5785f9f971a019361e274a0041fce7f07
SHA1ea9f772a34f78c000c658922ac932c861289627e
SHA25656d228305d1eefbe1ebed78570b318f3506dfe8f746f0d795a8d936ce4737536
SHA512d881c9297c001c1ff01f61f65fb7eea062a7bf07af5c6daa74671dcf79b2a5b54ada29d83643059051c6db9b75885896691a88948a9718fa5222601dc2870aa6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dedd6449ef5b2763fd21fe9fd9431a6c
SHA13815ca266a6273bdb73fc10f341acbf0e0025081
SHA2566951e40a50816831c54ecfddab631c7482b3fc60cf4a30b10aa7e42b2e0a221c
SHA5129f2d7b143845fdf6f94b9d64890d8a1df25705ff5bf4294d98f6ab2459dbe241ae20517fe18cc9e191490ce228a5bc173a003c0be0581f775bd337a79b2c0bca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50d24a6426ba7ed6ac40600815a020e91
SHA18bb145000ef3ff5d15b0a700c176c713d44677cd
SHA256a6c43f0c84742f256339d188c30a8b736631aa0710d732bf1750556ce928346c
SHA51263e52d928172b218dd4a6d30c1db38ab71ba67b00791ae4361dee79ce3e3b412e903ee6ea7e85b067ddb3f59ee499ff2fc7d5bbc09b1dbe303f6240532d133ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d6983504bb2b55e473f358c376ebdddb
SHA1c7ee1397c30ad6db3d6123c31bcf5645086fb25c
SHA2565b164985c801589dd7fb32e8bb9d6a578bdae073789476ffa2bd91cdff04b651
SHA512cd0328c98cb17a29586ef9d61e3c9d15d55290dd70f3eb6016477a6abea82ad93d8eba588eadc3abaf30211d87c672b0e4540243dcacb1fa088ed045dbf8f069
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Filesize392B
MD5639ea547c74330ac38b29d1a7571b83d
SHA199de04c73574c6394e211043cb6d7c9e1e0fa4e9
SHA25646be2bbaffededa06c31035302b89965fe71b8234fbca2e822e4ac428e0599fa
SHA51245f8d4c6af93167b900020450704f106d149fcdf1548c9e8ff956ef09c650df0a83f0c4292a1c27ec966d7855049af9784f559471e0b42ae6e3e7778800b44f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Filesize392B
MD55de6b747934b827e85846589f2643e49
SHA1cfff52fe7b3819eac277d9d1b6019a80ceefd99e
SHA256e2df022e7b3f86dd788759030c5aad40cc845cbfdb015f4d9be5149560f4fa43
SHA5122abd3798073370033b299dc6dea69048294fd67136b061d4eec435f15334fad3612fcb089e5787665f661a9ceacd5b1ca8ac9b2184f75623e21c7307c4a8fef7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Filesize392B
MD562a7b013ce21e0c2e8b9e2414ed0089c
SHA1ea290c3df4b62f8ada1a416f622074170e044fba
SHA256e49e63b0063713debe0e26d0c29cf81ef70e72a18dafb4e79c11b24a7bac124a
SHA5126c58664eea1a9b33a0904ee67c7b29e7ed169aae4ae3843d7a33412f03a832eea185205dc02e407ddf652a28ade7699b8d9a449750fb225feb7d214b36e6b6e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Filesize392B
MD585ab8bca12db0c221db0498981069d41
SHA148ef814ada044784c31861dd40441e17e9c8d911
SHA2560fc34075b9a7261e6d59835e1908aeb3f11f32241299b44efe72dd1870f05351
SHA51228031988b2e7866ad279a672ffea4c270d27125acc11653693325803720831d74e3dcd88f53edf1ad71d3873b1123f41b87a78d9c533277935bf368da845a665
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_AE85AE32AE506782FD0635A537357A5A
Filesize406B
MD5a090de3c429eac91c63bb93297311444
SHA1283eda55c1a0cae9a51dc5af2a8512094d88388c
SHA25655a6a3ea3abab85d3996286452e342ac77b2d7c7b8824330513d1aaf0bf2231e
SHA512c4672c09075a5fddd7260e84e09f8b699eda1a3a9d881f3000980d3c3d5a5c8944265da437ca81a47ba1288040fb4f01c30507a60a9924e338d72567952b0c0b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_02C4C6ED250727F9B08935C0A9565568
Filesize406B
MD519ed1feff0d808e34af0611f676332e9
SHA1f61de26f8f1f8e931e612b3c26eaafc3448f9e81
SHA256b73b74d6c1c55515f105969abb97baed33ff8f40d84f96ccc6fccdc2f2ab1a64
SHA512508400ecd25e3a5ee3cf35c385e4d61019dddc7ef73c3e334de7d09d229bd5f4a5b8660c1169a9f6d46c89adc813c24a10a843c624324bb02925f1dd609da6dc
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a