Analysis
-
max time kernel
121s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
22/05/2024, 04:01
Static task
static1
Behavioral task
behavioral1
Sample
65efcbb9f3769d56284b30be499fe376_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
65efcbb9f3769d56284b30be499fe376_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
65efcbb9f3769d56284b30be499fe376_JaffaCakes118.html
-
Size
461KB
-
MD5
65efcbb9f3769d56284b30be499fe376
-
SHA1
f409e78ebb15457edc5e9856065b66e251873316
-
SHA256
110a1f6161d6cf7de5b87ad5a18191edf17c6603e0c321d47e08fec50bd23a71
-
SHA512
37dfaf794304be01e1c0e3fde33a41afd11932f54be21fed08ac79fb61f592300b2c2f636dbb0985e6e1b80097e38fea311468865adf6d15a829e161bfd010b9
-
SSDEEP
6144:SXsMYod+X3oI+YN6sMYod+X3oI+YqsMYod+X3oI+YLsMYod+X3oI+YQ:k5d+X3A5d+X3i5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000603f03bb13acc5db6c05627aeca31008d043d79dcb6b47f3fcddf3acd0a00f14000000000e800000000200002000000090e3c6d6d9520c6c508caaf02eea1d3d404cbdd1eb8748a437eaf1a23cf94ce82000000036db27b2d2e69be1359883b1cfc0bb807803658701793d9ebb1b267a010a69f3400000003b0dc528eeb3b32f10df0191336cf01552e872ca477bd8216fe680bcca8a3ede3cbe3aa046dc09af11d80aac3819d5668e99e917cd5fcd87ce2f20408028944a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0452C591-17F0-11EF-A9A6-4658C477BD5D} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a045eadcfcabda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000004395186193c0dc0bf7a889aa535f47cd9ce6021b32f2dd36aac5a53851b0dc1b000000000e80000000020000200000003c2f56ca35acda9b2c20f92eb4dfdd7d6e32a485f123cf6cea30293c58a090c2900000005fa888fcd73f08c91307f50fc7f92fcb29682707eed81405b1238b737be74208a3e588cb914341e6ca0f829d112a2d83602b9bd3efbfe9d793ec75209d88d5523d55293e668a8b3483c168c1348fa9f4fb012a94c40b7c8fd8dace9834b23486881446d218ed9695208ab984d969b86e08da573bc1f970aae44e3a9e45214cc1ce1d8378c3eece1ac5a7752633918f2740000000399574e2878eb59f213db721b55cc3c7cbca29de82581ffc7500c3781287e44b4fd7211bcc736e33fc860354d6e0fc74eb393dda25eb1840be9d8904ff66032e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422512377" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1724 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1724 iexplore.exe 1724 iexplore.exe 2604 IEXPLORE.EXE 2604 IEXPLORE.EXE 2604 IEXPLORE.EXE 2604 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1724 wrote to memory of 2604 1724 iexplore.exe 28 PID 1724 wrote to memory of 2604 1724 iexplore.exe 28 PID 1724 wrote to memory of 2604 1724 iexplore.exe 28 PID 1724 wrote to memory of 2604 1724 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\65efcbb9f3769d56284b30be499fe376_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1724 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2604
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e9beb1387d56a2f2de3f91ced6a59692
SHA16b13ebcd840c5c3fe17744d83e149fd97689d038
SHA256004f33c765bddee19a472e3f01994b1f76dd112dc6ea616c5b081b512afaa2d4
SHA512c2a7aa71a1ce0e76e7ae4d817debca840a7eab390b8823e5416d092131b11c6052be1e2f42d5e3364a0e108fafb540794dcb8293b5e1a4e1091a20587a21226a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD503e2ac149beaf41f4fae9bb281e1dd5d
SHA1965bf58d2ab22617cc5acb1a4c1a524f6010a98e
SHA2568420acf56d65228b37b10132573a3a7b884a7267486569cfa538ffb1e337e325
SHA51296190da48ef9f51d5d0e9c81479e78fb1529fc37340ac94f8e8358535127fb54629e14eef8c02ee1f776062018d4d18c15eddd67fff77779e062eaccb9ccd55f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bd85ad1165a5f7b0d263e66fd8a076ab
SHA169692b3b39c889f927a3b80a26f919985ffc51fc
SHA2566e45b88e114428d27fe2299f8cbb2445d44770feea2fcb5d64ec3b1b2dae824e
SHA5128ba96a72a69ca41f8d7c8c39b16b58d2611f60fa9f93cdbde5a84878f28dca4c695398a0429fb6e7921ab93f5ab78d97bf62902aaa71a2ed5d83eacb28934d9f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c75731971db94225d20bae919bde2177
SHA171980ed5e267df87b611acef7b06a6ca25b1ad57
SHA256acc5f897b8ab81498e9ad42b6eb65e5f17f7ebdd08522a3b3c2ee79a3879da06
SHA5120cfce348b20986164a5fdc47e64489041317c8366bb6dd0d8d62f94b01fc3646df6e5ce412fc2d747c44346ba314a8f4a9ae7d07d420c7faf3145203d5dc899d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57d97bdc2e4015a1ddeb191e0d6533d5a
SHA180713a06a4932292ae4bee324905ffd86781eb94
SHA256f113ec874e528b66e2e533219b7f0cb3f496f02c8097a4b938c014f405635b80
SHA512347b0ca8a7b2eb47fe81a3f221983db967b818aa6d1ed4e9700091244f176201718ea287a6f80d4ff86bffbccb13f1025eae74132d99a4b1c7fef3df6e074032
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50aaa498ddeb6a1796b44c5433b360af9
SHA1714848e8b1ee873aef0b5d91a48ec31f397bfc41
SHA2568a20e1a5f02612c90aae4738d93da48d346726d79a0e4d6c1b02f7da7272f8ed
SHA51269e3ed146eab49b25e570cdca63d0900a231083746d4f0f83c3839f5d9d3fec1c9962f98899b87e53d7bf9ba46bf1a2e2bba923813e31a38e7e55e6cd8d5bd96
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD510710e4544c62f7e090f2e80f6b461da
SHA1ab43436404e3a8cb8fd9d8d09d2c273404ab6f7a
SHA256234db921a2a6074eb971ce5ce5440450292eba656bcde720599abd184f40ee2f
SHA51212a72415118efc54b5b3fdfdbf93cdbf91924e6b91010bc3d2fce0332958792eae669ef9ffb030036c6f95fd0ff86dd4473503ed8348695dbb6b9dbce49d23cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b1466b371875608626b0cc10763919a7
SHA11a61cdfefa0cd94199adaa654537846fe67eab08
SHA25619a83e02e146ac41a4cc342bcf1f9197a322571edae0e9a1e773584ecbeb2745
SHA5123bb0dc778ab1892db185d6e458e19a616373e298e60592ae8e1fdd18640094d96b31f6851f831df303a31d65c061b3c4271a671b64972a92f7156a59786fbab0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a0f4998f8f43a9e1809a194de798db01
SHA1196b65c7a29f72db092ee57a44bfdebd46194400
SHA2569403695a9d773d8fbfd7a28599fa27f2bc19a08aea1afe4219f2be44634d1e40
SHA51224784a203a6d9bde8add35412a6f1d4d7bb6338481e602f9cb7e70f5d46c829dd53fddebd196f982dd7d006910fa9e18c4312af77e2f4c0c37aac728b4c86161
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52b7bd86d6139b8e994a016a329a64fa5
SHA1f4df305946188d91f22d97ba77de65c7f6aa87d9
SHA2564a3565420cb4b0d95b4a3d8910880d0950838b22e9d4f6a3a4f135652890639c
SHA5124b4e39ff79f442e8b86c13a1cb6ff6b8a2417bf0ac00b5418307992c5d33597d39b0edd289ddafaa6e2097571f925d96d8b9419b81345ebe144b96021f58ec1a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51772688903b57348975f5830361cd612
SHA14462f58f99e4825119131be2fa70eddbeb20c968
SHA256053051939c416ef38958b2a23f011928fe20fdc25e6c17aeedec38c97b04a3a0
SHA512d42f4897df81978330555fcb41d529d9b9ecfa2721a51c3dbabddd09cb6a6749f6631805cd83386d8a84ae3e0cea8586aafa5d62be07dc0b5ae0ecb77f1bf3da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d08d620a79814984e2d915fa2bc23c3d
SHA1b794a3c1e3b0079d2a0d7b684ea94f584d13dabf
SHA25636cca22d57e24c5b18e85af66b52b7e5b80b5babebde8652649b4df97054657a
SHA512d5fb9a30e3f3d4c5bb1cfc7ee1ea4fa248a809ab2d690065014ddee5d77a9e19624f3543e8608e3d2e02e0296ebe153abd70cfb0e6157ccf47c6b2753b816521
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c3ff15bfa90ee32a7c7758bfbc2323f7
SHA173c6acf9e2b77b3196e2c1390f8dd806be9c97e7
SHA256d30e4a30aa363dbc2fc900e0a886d9980d02436bf4d4a2eeb654f2434f833fdf
SHA512e5af271c5a997e9b07f0dcb11a69b28013b73e6aed6d870d423be126ee75f274ef4c338b9da51a8274e9852b29e0c2e7cd58c666e8e3281415682f4d7247e8e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD572b6cd640b54ba850899c52a5c0160dd
SHA1035e429b6091b7deca9daee5c6d9cdbacd145230
SHA256a3548453032a7907bd9868df55fb749bfebd5d2335edae7e76e9458cd3b01385
SHA512eebfa9733109af97aa19621fed857725fc708b1f35835f0d5575521d22898da09066e11875d179819e5253d7ce22a13b658b3ee4c1f0f2fea69a9f03f7b45ffb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c48ed22391bc47e4e9659c41f324ba8a
SHA1cbe872496999b615f0897cd005824538fe0932c4
SHA25670e040852739f8b9e9caa9180da271019b41596eec492cf6d70295727d42bec5
SHA512a809520a52e9f1af59595a32e31fb227c20bb7ae643b1594cfb6d3ab21ba7c1f054fdf74ca7d9438236b65bd61ed98c6a7587ca639f155deb653c6ba8df7b2c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5120a5569490086a8273a672b39bbcd2c
SHA186accef5f64257b7a8b428d96c47c321471de4ce
SHA2565fb6f1c53c67a3db44aa7e48308de2b94cc19159d00d4b2c10ea802621c1c6b3
SHA512c8844aeea5e8d457a04254a635472e5368dddcb4c023954249fa227aa8c4be0d121c50ef98724d3d7c91a3a7580831e957cd1fe6eab7f9123deb150076cfb561
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59d035e276e14474c1e9b5c880c250826
SHA158d3ab9ffda5b40e33ca54fee67b39efee7ba95b
SHA25616e4db00badf0ea1110acbbdd1a00c563e162e825b300ba5f3ad7a1cff0e67ad
SHA512a6de2e1474a62ccf452aae05234442316092591a9e0419d66b0bdec78b99b67e0510e8911f862cfa774832382d91cbe2c9389846adfabb5808e746b5d7ad8940
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ebecb8e3b65c0b162908b2fd8c1cd164
SHA15a240ecebc586bb839c64a7a2b52a664a0ce7c68
SHA2560c17d66592dcafec217e7adea8bb587331cdd56b65c365ed720b70b8fca2cb90
SHA512366c61bc4eb6ae9fa66f3f9be9576a6ed05c35cc7daeaf91e93303c1542a62b37006faf3660457528b9f8615259113679861528bd437ea09a630e5ed637a7b28
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f11f958937844a5f4e9740f3fe98c453
SHA1d9f236a6f83a6582bda3cd03ea3e7579fbb070c0
SHA2562960cc9f7536b9d4e335ff36735c62b57b0ffbf8aedb3d58d95f700f98c26b3e
SHA512fe0f3d1b4da07a71a368abfce8c673b6697c8ac089d330200cbdac55e0d638d1125b2e45356d9162594b1dfb6288f6a6df0b921e8f744ab0a6408a5c7bef948e
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a