Analysis
-
max time kernel
118s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 15:16
Static task
static1
Behavioral task
behavioral1
Sample
67b1f5f8fc684e612254809133660692_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
67b1f5f8fc684e612254809133660692_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
67b1f5f8fc684e612254809133660692_JaffaCakes118.html
-
Size
461KB
-
MD5
67b1f5f8fc684e612254809133660692
-
SHA1
5e946e6b2e32ee8aad0c0d82ab525f4146278c84
-
SHA256
ca36cf18a758de755ec4f4254cda1302924baaa07330a5c7c5d9aed6f878c50b
-
SHA512
8478fd9f6d3760ae6fd45d4348e1872b57cd141e4f0e4ca985c9380e1aadb29c80005943dab792294d98cdcba3083d2a57b255080f0f30334fb57c20d1693153
-
SSDEEP
6144:SkesMYod+X3oI+YwsMYod+X3oI+YFsMYod+X3oI+YLsMYod+X3oI+YQ:65d+X3s5d+X3L5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007c7b218f58a19a46872ff25a1cf63ad8000000000200000000001066000000010000200000006472efe1177c0ea66f8ec11b2c7d2fae5d8fca482cb43bb3a78ee35c7c8d3508000000000e800000000200002000000053b81ed014146001ef40510f3928da64bc1e21eb524b78753e464467edb9fa0620000000c5b57093660d9d4db849ce82fa2ee97a808c233031bb1073cc4eba146ab041d040000000efea4a327aa296e3ff7e2238c304f87190e20e2739ff5908a2d6cdd4267c7c1eb87349ff92249eb4c09784cbcd465ccbe2119caff4cd4daeb03fcd5dafd41a1b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0953c135bacda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3AA7ADF1-184E-11EF-BE0C-E2E647A5CFB6} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007c7b218f58a19a46872ff25a1cf63ad800000000020000000000106600000001000020000000d556321fabb388baa42f2e34b1734d7d517b2030729452faee6b85512ad08499000000000e800000000200002000000080764a53f4d8111e1b80489155b510c9ed74281bc1576708350d6fdcef64b6d09000000049001466011de427e38144b6df7a986ea0e354a9cba80c1f772b8ee36c44addf75e924cd497109e2335c1d24860d8b482ce47a0a89673077518494eac8a80bd5eeecbdee0c65cfec9189c3fd8787189838662597978547b8bcd386402e8a310be533f03cf7847cb823c42fd8ec9bd1dd1ae120c2658fbb0b827fe4fc929d3c3593a3d53ba64ba3372138b332cd3f816940000000321b4afcdb8400138893a9b44a9375ce7177f0e79f310e9a1efecb4691e9e42ef997cba22f76169dfa2a6fbc5651790d625ad7a33e4d368e571ece60ff08c462 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422552842" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2924 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2924 iexplore.exe 2924 iexplore.exe 2560 IEXPLORE.EXE 2560 IEXPLORE.EXE 2560 IEXPLORE.EXE 2560 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2924 wrote to memory of 2560 2924 iexplore.exe 28 PID 2924 wrote to memory of 2560 2924 iexplore.exe 28 PID 2924 wrote to memory of 2560 2924 iexplore.exe 28 PID 2924 wrote to memory of 2560 2924 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\67b1f5f8fc684e612254809133660692_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2924 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2560
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59a3535a5378cf69cc5d1b3e469fad294
SHA1e2246fad53e937b27390cdca4aa2a2732914e468
SHA2563ce1a2e9b1adaec3ab01885029fb68f094df91cacd8f033b9564927dc717b2bf
SHA512125798fcfe84cecfb695bdc5ab27e927636a3f8a5cb263833fac5dc4a434bb0661a74e7636a98620d588aa4d130f85bef5596ceb45c69db47b129bb156d2d529
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5438b641dbed7208c2c178715d1f7d034
SHA1bebdab1fb46333b28bb841f59d956c0022f82c09
SHA2566458609def15912f5d7ddf822b0c53f3f2bbeb42334f687400267dffc1728866
SHA512736bc562775f84728d82a37ba27a230ccc173570c7284e5073bb1d85baeb547f9ea48e5a2f5c14c743cdbcbe500d3276e2e1ae07ab11dbe44b448d26967e477a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ff2186fb20a53877a413d10f5a4551a2
SHA1ced90d343db8c2b2c73dbd718048728597a8d673
SHA256456c261e3650d190f377fdf54e858bd556bd8ff0771b30ab81b0d1d7bef54747
SHA512c203395e37f146b119e98e663cafa339c2c4d17814dafd9672394e7aba15faaed19706738ef9a96bfc10a9d2aa1c717f8a651a03a661ff5e8d0b26317261186a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dc4d69924e90e3a2ee6e2d896d037291
SHA1b997a16eacc09bd851a602f5187cd4680993814d
SHA256f3ff4daecf88e98a2d277c0952f3e55084df2f393229857cb7b3b41990908950
SHA512e7bfd3f082764bd87f54905a7a0c934dea18d0899da996d113d3bccc1cb2e177068550198c558ebe9e7b34d285df1d863f6cd0c9bdaca43fcdce92f2ac36b318
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50c40f073af91564ddea83c5c76d08925
SHA1c0409860815bf17ae8b8993254f9f19ab16cc944
SHA256d27a6feb56acc5c6a805aa47c779cfdd6deb471da50db0304e4cfb401f3156b6
SHA512da80a575068d4fe4f16b6908d55d82e3f8ef9a2099784e541dee4fe4a77f9c8ab1ffd4279fe050003f1135dc031409708f34f7a48f48e9d7d070b997ce4fc776
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53ef1e0f8ebcfe870aae9a98f2e2bf665
SHA13d75516fc845f6e94b6147c926fc2f004f9f40f9
SHA2564667a1dae58d196e75b51d9b5123055b36cedbf5a0de160e5efeb9cd59677166
SHA5124376194b6a650baca9859c9ff368743afb5dc66838168bb3f62cd57ad95191e7ff32c6818db4a22e6f0cbdac80b21ab8b1d63ad9fc5c251d424aabb68ce14d2b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5390fe37e3f3c1272feadf0e3d753a61c
SHA1df6c44f7c50ce4e3d92a41b508cb0247140b14ca
SHA2569a21c3961d41bc1905116ef427b39e4c057680ae6c8e61ea1acb1b6948457e6e
SHA512360ebb7f3d377cb33e0d1e24c0d6a69b1862a4e9008936b4a2d9590a22302cb36fafaaa54f399d8a2764127640442c71c8cba081727e8741753350f545882ada
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD528a84f01b6c7530b76dd0b9cd4431dd1
SHA162e450f636a7d9044a6ca92790803c2fc60cf554
SHA25698fd3293c83328630f23dfc05ba3a4003ecd26a455c23a052ceab93abfa5b395
SHA5122cf08099dd1e52b9038b92eade001e008a9e8a989f097d218ecfbf38d72b2cab7147d8c41e6905c5bbd72983554f4f4cffd1ddf758bda8a9dbb05b58cdf190de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f4a13d0e92fb6bd3050c04df8c29489c
SHA1416f97bb77e8549f9af66420429c749e52af6e9e
SHA25664d4a1006355346d60e806f3dad648ba4855fd5d9a5ac282380320632f789dfb
SHA512be72e33ffc71f52a5b570d71b950a0cc6a5df93ddbf64eed6271885953f7d8d8ed34c244f288ad3992b215d60b8a27faa234af563cd2f53b884ea0b936f52464
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59f389d59081337f88e69bbcd74b7f986
SHA102c7a0d350653b8166896df428e2422349b08553
SHA256705a57ec52d0c609ad3fa3c9b56a8244fb5dc78832b4ca4918f1ef1e038c32fe
SHA51202b36f58f505047d586032bc88aa4e5d933c00d0da1eae4157611e679bc1a5348e7eb02e70b4542e21341e33e6cb907388c7ed0b3d916c11036ed5256f846628
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51208345b76965d078163e95b8ee4bc93
SHA1f127110133fd1f6c6b030bb68653026793bb7800
SHA2566ef482e628d6502938cc9cc4b048821adced5f48c228e3dbdacf3c1cb00e9d67
SHA512a8df5b41a56377b9ac3996f1bf91c45ede7f4703b0b0e2dbedd311bc885d2c685b43d68ed62c40260a6285c488a64054b98559d14a4e19c1640284720bee24ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5146a297890d9f73b9aa9024cc9962802
SHA12d2df8608cd3d812198e374e18ec80b0bc03899c
SHA2566da42d1aa54cdc51e9beb6cb2ecec49d31344451d7066e73b7de44e9809f77eb
SHA51244cc1950dd2f48c237609362ad62a01ae0cb88d70aa4f425b3689c2bcc446f84e587646369ba13a9821115195d3580d19383215d9d18d33c444b5f3396059f79
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5242b27c6386bfa37d54ba13e30a68801
SHA1643c0a4cb5e2005e0e2435d9b12bc3cc32ad9ad1
SHA25652cc2d099cba0dd3718719cb6654375c7c3a2d3632f2a67896f2bc5f5ad8852a
SHA512f671bcb72ce1071d0693857adcbfbf816b9b75718627a31a8aee99209673f671d6921cba7216b662176f5f8c38e64d5d631fe1c546546211dffaf2195c9e12a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a31ed4c80ccdf2209214cfd127dd1c76
SHA16afb4285573ad466916d103e2181bba2659d8db8
SHA256cb9f9a459ec887c650e5974a2def8c8cd0a66d77b1ebb255dfd6fc36ca102a53
SHA512ad7d945eb0708efbdfe8521bcd2caacee56abc40cd61f37de787db498dc8e292633e0b96373e0482a942484c3a525903dc940fb25c455abf59e0c674cf868934
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57e867629ddfb8c76dd9809e5cb006e8f
SHA1f02543fbd04e351c0c55bf1d9dbe23353a0207e2
SHA2560815048257de0f170f7ec2cff6ebd968ccb9af9bbde809b52289b9013203837e
SHA512ac5ed995302ac5318e44eaf4aa114e026a0e0b6a0f171b64cacccf8fff21734b188c7298140eba65d0b0edac0d83fa55848fc3a6135f64eac2fd43bf3845e87f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57bb5763b214ef8a1c30f7f36656dd3a2
SHA108648f50d79ad89b8682978fcd5043291596107d
SHA25648a0b403d216990bb5a48719a0c4b24f02fbc8448a51ab3ab9c133c24c531b47
SHA512b2361ab19b83d3e3481a433d6356dfdf6d214b75a6427df68d25483330d9d97b95b9fa4b06096e0314ae2b16da1ae87edbaa819e3e078957138f261dcc3b127f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aa794c1fe393f976ff75095cd089ec82
SHA174439ad3a6ab5075efcd023462e0965b5e320c73
SHA2568d081b6fecbb7a45c0c2ab6f0324f4f9f0db4c9ce9ee7f7fd49233890bd38007
SHA512e4539a2d88ffebaa51e0f965ac6abf80ac5eebc72ad21c1a2d71e62824362c6ee8a207dfb543da831a546580311761b651aa5708e1d7aef650735b14a6544055
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a