Analysis
-
max time kernel
121s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22/05/2024, 10:01
Static task
static1
Behavioral task
behavioral1
Sample
66e036909ea815d58776c8e025b116c0_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
66e036909ea815d58776c8e025b116c0_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
66e036909ea815d58776c8e025b116c0_JaffaCakes118.html
-
Size
31KB
-
MD5
66e036909ea815d58776c8e025b116c0
-
SHA1
48ace1fafdbaccf30e69cdaabec20ddba6cd2b74
-
SHA256
5beb5a183db83b9c32df5543b1aa0e742d2319e37f54b643e32ce3d84d614517
-
SHA512
25428282ac2ae04212bdfd2c8f3551b56adb6fa77f45b824c1e44cf2a695f268317fa4c2f9621f1618cb70283cad6664fae2632e0ce217fbfc61cd56dde23fff
-
SSDEEP
192:uwfvjb5nN6WonQjxn5Q/5nQieENn8nQOkEntbbnQTbnhnQmSlxKii1cX28VWnPRp:7Q/ZOxKiiQ28u9CS
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aac8b130a579c4c9a46a81db5582c28000000000200000000001066000000010000200000006ad12d318e2761ecd04c3135a8da823a3d77df3da7bdf7d2ba0a48b60ce1e2f7000000000e80000000020000200000000aceac6339052c0ad9083222ea992acd7924f1d78cb1596621ead8ab1e3c0a1d2000000002a64fa2c31b3cdcf0daa10066f0c1c574787378b390d5f01fa2cde9ade3777740000000762959246a0a5cdacb3d09317119ed289b1008cb35e56394434d69857759ddd35a34b546ce4d3a0f04124fe795d4b3351fa6be8f5dd3217137def2125e756678 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{42D8C581-1822-11EF-A336-7EEA931DE775} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40ce21182facda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aac8b130a579c4c9a46a81db5582c280000000002000000000010660000000100002000000094ebf632bdb18d25548aeeba0db50df1e2a32d9292658ce41f0983701c79af55000000000e800000000200002000000072de0a0f0ad03a8ea74aff4f66f9bc85f1b45b0845d66495bdabdab4026d90ce90000000f8645a66fb79a148f3c2660ca81e5d3b50bf52e289599479398f161c73847d6e14b66bef641277e7d6122d4f55a150be6d2e9788359af06aaffc9001b79076c74ddf3ed68f594098e5aa47c2a122ee9d7ae140e94bc00ddbee8dacaa7c159d2e59397c04555ac7b416d7424aec0a2b7fca138595ad44125d62031e407ed7e4740ec81618bda0d39e123d9bc45488f5d14000000084a4a55eb422c9a00318b6ee7991cbcc7df4f8614475362787d863b7963be1062e3331d3c91a53c6f13b538e8c120abb9c7cc31a9d4c50b0bcc985c7422b55ad iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422533959" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2256 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2256 iexplore.exe 2256 iexplore.exe 2472 IEXPLORE.EXE 2472 IEXPLORE.EXE 2472 IEXPLORE.EXE 2472 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2256 wrote to memory of 2472 2256 iexplore.exe 28 PID 2256 wrote to memory of 2472 2256 iexplore.exe 28 PID 2256 wrote to memory of 2472 2256 iexplore.exe 28 PID 2256 wrote to memory of 2472 2256 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\66e036909ea815d58776c8e025b116c0_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2256 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2472
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD531c1cb1d7bae365949a42cb3c388c258
SHA1925d3787b529683ed152e17a1be21aab6bf32a1d
SHA256327d408ef09d27075b7534bbc18f83104a166bb5d252071f6372066c9e86d805
SHA51240912ad50d043bb40b8f7fd68102ec87c038a0903d848890ca6085f124d15b9ab5715216592e11aca4f8eafc94d0a819b760039160ec8dd191dcc59e9878d235
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59d6c1390253b58cf6408b5d24f6f5c55
SHA10957c8bb970fd30cd6c85a4d83466874e0fd0621
SHA25602fc6494245a5d10318b011689827fb2e5134960ff4a9d9df503df00cc0d922c
SHA51250b9e6648253ef9b58d9015522823d481378421f2dd1a0fe22890fdd9e863fcb40ff742336b0028f5bd04e4c9859de7649fcc5accbb6835b816cce3366d53400
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5defe3b0e2e192731537f5b9f9c07ec93
SHA1063b4f794bd0756d1cc937145342f187db6a041b
SHA2561aba4a5d1b4ceb7781f0593c27b54597332fb33db2ec1142944d0dd3144ed60b
SHA512a13335a75c64bc4f874bdc66a6428a3dc8a5df8b3abb8b27c094f17579eb91608dc246cc475f4f1a237900e79eecfa1f3a33fb757ba08907bf4b6f074e61d92c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53a9256f0fc783ae6c89ae7e943ed7590
SHA17a2c43cc3c9d84d625a6af3b63e57d050fc7e44c
SHA256ecefb710b56583fc0e4e24f6874a86f8ebfe382e64f59650acde021564065868
SHA512d44810a05a768426ee48cbe714beff2652f6ec38023d6a74086f14987222bf07f46a7e7e17a3506d3dfd77e50d67ed6c388d1d909e31d7d5de05d4d5b8381c27
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57a5091c910e96b714d4455123897a470
SHA10eb70634f4941e32668de0addbc5dca60d1a87b4
SHA25619bc95431361073a5ece754f23b8e33844db93384ffe2da7447b65a087915ca8
SHA512b50c802bce2cc41d190e123d7c38e22542db78cbf41c91111a93bceb12c8500ba67d21f3d1359b4e518996e94092da24201e362c1068a85fb7df6a1953f3c4b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dbe0f5acc3f8f36d727f485dea44dc6c
SHA1ee480289817101a1dabab4f9624118a35d67e9cd
SHA256369e05c6eed14f771d3bd57cd26bb765f52b0014cd9e5d2ea501f6679bc7fcdb
SHA51232a731d4bf297290851fd1582d5c2eadcce1d53c2dba494a16ac04dd444bb02fc1aa2c1a2c58a30e06b6424c3466210a52ddf09738a04293207bfe0baef2800e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5953d2fd9e5f3d4d9dbb6a6df39c502f2
SHA1cb7b65bc941da4f6bf894ee3c7a803df07c43801
SHA256f1b180984d9cc2305ecf7b4110a24aa3ffd25c2f46867e95ac36ddae0ee7550a
SHA512883a2e87bdfa51aa12a924815c94761aa47f2256eaa261f7ec1478d806a777592313b78128c987f71f93dfc90430f98c0e79d430a751ff03412d1fa0af64c6fb
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a