Analysis
-
max time kernel
118s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
22/05/2024, 18:23
Static task
static1
Behavioral task
behavioral1
Sample
682e742fdedd855edc49b157f2f0b21a_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
682e742fdedd855edc49b157f2f0b21a_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
682e742fdedd855edc49b157f2f0b21a_JaffaCakes118.html
-
Size
68KB
-
MD5
682e742fdedd855edc49b157f2f0b21a
-
SHA1
0cc317512c1f1acee64ce3db4842d5e2ef89b8f0
-
SHA256
ec78fedad60f300e8108d5123930bc4c90abb73366ce8b2c59d43b45f89a77c2
-
SHA512
882709a692c9d7a811f01ae5ebc7953c6cd75410ab90dbec26aa7f209d0564740a34fa911c79757f10aec567f1d50d70fcdbbfabb62b19d88d88a3ba4dac00fa
-
SSDEEP
768:JiwgcMiR3sI2PDDnX0g6e2ZFEoTygqwCZkoTyMdtbBnfBgN8/lboi2hcpQFVG8sM:JCwFZTx4en0tbrga94hcuNnQC
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000235b21187e8992419b09441783fe0bd900000000020000000000106600000001000020000000afaacf04c8d088f45393cb29c11e883b1338b1ff03b2ed66fcf01c7d74e5a730000000000e8000000002000020000000c9e9cf7fade95ea375136f1adaf9dc0d144f5d3d775b74bd0c2251eb6e2c2675200000002d28906d3738349d5f4f08f4014429bca5abb2ed8fc1e4ad11f5392cb943c074400000009f185d84eda77cbcfea3077ebf80216a527df883c9730b9230afc93501d7f87f7603361ff2c30064d811cbeafc234f5833ae429cd302832e5ea9355a5f9ce179 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422564050" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{532B3261-1868-11EF-9FEE-EA42E82B8F01} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0f0cd2775acda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000235b21187e8992419b09441783fe0bd9000000000200000000001066000000010000200000008ced2358874218812e3308e3395b2af677dd13f060750fb900963d0266acb054000000000e8000000002000020000000f72f33cd499db472ddee68bd81269d0a763b8e10c877ab76237823951d74b2dc90000000e90962178e3686faaabdf4d08e9ca1813f320655aa643b2f606e5285478f7fe6a840619cd45a137e96609c6c8ee90c245fe851256b681a3f5277dc736b879b5047814970a94d1b3644a761d4b08f5605f0ef5c6474ed57bae078831c2171ac837cff5848e4f896bb2913277d19e0210477493d6e62d59e09de9b5c17c0efbd25c87e703e4f76c73a69517782e2a20f4040000000d1e76210ce14171829f16d00fb7cec52f61410b724eed699548fd749d220fbeb7231bab2de39ea4a64df8be2d88304f60ac1fc09a1ed11811c1d571a746b8d91 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2908 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2908 iexplore.exe 2908 iexplore.exe 3024 IEXPLORE.EXE 3024 IEXPLORE.EXE 3024 IEXPLORE.EXE 3024 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2908 wrote to memory of 3024 2908 iexplore.exe 28 PID 2908 wrote to memory of 3024 2908 iexplore.exe 28 PID 2908 wrote to memory of 3024 2908 iexplore.exe 28 PID 2908 wrote to memory of 3024 2908 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\682e742fdedd855edc49b157f2f0b21a_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2908 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3024
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bd86afef998ef8b410a9902deade2a34
SHA1331a7898cf8fa91a6df8f5b494d9ea99274e976b
SHA256a9eb4a7303b87957bdccaabbf5fa5f3daf5db540b4bfa1fdde10b629bf1d5116
SHA512016df541f9894dae3fb68585975056cacce7d71bf233a81594d0d58e5a2731f6825625c7e61fbbf6e73c60426a76aa806812d79475886745397dc1acff52b631
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57a3ba86839481c103e0b6793cb4e31bf
SHA18a9a458d0e9b4dfe72b80ed3cdaffa29f068f5e9
SHA256cba96357900109192bc6e828fbf388e66e1a2953d60cd76ba689b2fa4230d179
SHA512018a382acfa236ca64f42a5eeb6fd6e0310ba2dd849d0b777d1d49c356e337329f4632032aac7b25520e3616d35f116e171003c6a5e23a9f0e8d328a786c657f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50d2d756e3e3c5770d0c3e02cb4d5d1f0
SHA14f14a9cc978fd45fc595d399cfc9577f3dd4a190
SHA256f5ce91560bf14e36617b6671e2dce62b25fb0fef325a10351d724ab32ab6a9f0
SHA51232c86c412ba95f6d06526a94c64a4964dc08016dfc4410ec7a7e00df00c082f4aee4b6c20f7f0fa813f909ff1e47dce868f26863a9e123e35cde616108ff1ac6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD577493a4afabc179d65c8533bb0d3d2e1
SHA119515c150a2c6530c211aab5c0e7461b2ff47db1
SHA256c8eed2e01a0ff0bf6274865b5ae58e491814b8d755381827d330650a3c95018d
SHA51265e9237de18c4bbd6d27baebfadd053b9a4398293102af5dadcfedad4e53b96cdaab2c45557cf4d0c3be19ff40b4b50548fddd8007a90fd241d5759c2fb6f825
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b221a86c4b0f421d71d4d5a0e800073e
SHA11edcd68be2fd679bc2d34f757c9a0026ea178566
SHA256582b92b4de3c782c60d0413f1efa976d48de58b2cbdab6523a997206b285ac2c
SHA512b7cf2796052affeafe8a741f33e49e5c2cea6d0067d73c890f4bc42fbbba37ab3c41d2261a8be7050af8deec4d4f56dd7c83c8720bfd1b027917ae354f71aaf7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52795719f9f33a758f9789f38d5544da3
SHA1f1bb5a32b419d3de3c72824fffa9eedff929bed9
SHA256500855a579022b2c2ff0c4231564c3c17db5e62d9a712c4ecbde22fb792adb4b
SHA5125067192afd3c5017ddce93c2da129aad682584f19753340b26687abd94c4f6c88935d14f96824e8c8ffdf4028d0750fbbef435dd09240936b48213ca642b1e21
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54247428c4cc58113b022c1024c22409c
SHA1e4883f5f42c7e3c5004754617071f4548188872e
SHA256226145c1341fecf66b3ef8089c5480dfb51f5f5ad6a75ed7562aa1e50cb1d59c
SHA5129740b8c7423a3221395a345f86b73cd23aa5f78e56c8eec8cc49f95f7cdaea069d3e9ce0b46e35fc39a6b41ae5d2643be6c0767ffb795c9a6d16697539f5285c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD540dcc158c1583747c5e77eb3c283c594
SHA14dfae640239a82f4c16dba35cbbb7c7695db63f6
SHA25639f1c92ba805fff4f55638646eb24aa6d4f961e9b2335b7fe2b4ae8019c61d3d
SHA51231b6a1378276dc12503881d1d7b264c4e9aed1c2a38182b28d4303bfe0ef8c452bdc2c814d1bc2a0a09b7f346e0355569f323ecc13c61edae1fbdc7bece4affb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD568e71f7826e0dd9941e5948c9582ef7b
SHA1a91f425e93acc4c538ccf441658596a44bf06ea0
SHA256abbd01a93299e117bde5ee1c79f0a380b14cefa929bb856ecec4eea226aa122c
SHA51289efebe5e4c336e7f86d81d4771933dfc20e8258ab705cc8ab3fcbe4340cf02e418ee16e7697ff4b97606f2bae2b01686ce4006ba3a662e179baea44377408ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD588df2ef3efd76dccef2caf7606ba5240
SHA145c7f22517178d18131993d34c763248e0fe359e
SHA256e62ae94d1ecc007bc19f8587ad7a3234dcff82958cd2046271ddf21f7948b888
SHA512ed353c1a134264dbaae471977ffacb08c45bab8aa43e5fa31189613eb938428c1dcb13584049ae5b980d8ccfba29e400be0b7942c79a384429f4a1d342d6c30a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b9d9be6e526c6d5a19db692c3db2d50a
SHA16659b9544ea69eafe4e82396eec3d4de8ce4e500
SHA256c07de99b148486a7fcd1357eb043183f399ba0f12835266547452209a3dbe691
SHA5121f1162a48d20cbfb308d00959f49f02b002946bc8fe27b7e04a1c9268a3f6d10218d2f2a1f21d73e6eb1d5d9e77f94b57a20472e925070967ce5ae423b7a27fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58e752d2885e307a26c2708b570e3ef02
SHA1e84d033ebb6caa077bacee8830db7a7b65622a59
SHA256de31b22b1f59970168574a03418a73e20078598a6a8bc292fd2f50a95618a5d0
SHA512b51b90a5a77cb96da92fbe0847de77d266180386f5c1b811d7428dd2fad3c33a773d9af5e901a0e2f5e906512be80aa740e87b3878fe6c04bd435f0456e9c976
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e565814ebe8faa3a6580a020661dfb3f
SHA116a0e5eeb8f4845e6de4d9512efc89a3469fa484
SHA256530b87329774ed4e6e391ab65121332c99ebb73b8c59ed6b2834cf45c7fb60bc
SHA51235a8a3933a3b5541fca322f03394444a18e3e8576b2fff8ca32d42fee7d0e8027bc4a38c66d4998d101b7118e30b868d562182c715ec1914655dfcf204db1f72
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5743e5e9a849d6a42df3032ebc0a43db3
SHA160bc80d8fe4fe5bf7cb2244a7c348fa3aae4995a
SHA25679ae47e8a6755c82f0a1a8cb59ab17ca1753c0142a7ba8c5629c0b995937eba2
SHA512b1a1d255531bb31d01ec59303cc57ebac0f6f9df867f12e12102d8b888907a5d10bd9ea46e336a12850ff50eb366168f3e15a7a6d0bbee9326ddf50aa5b4287f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD503b16f2fe433ab336b2b84df65718acb
SHA1e1073ab29bf27684cb03b3db85f8184b2bbc95f4
SHA25640ed33645f2ca279b2a40ee03e7b6a2d7094b3486ce7c9dc96252387c737fba5
SHA51215e653d64ca8433dad978a85efcc6d9ef11c400d6e123ceaded46c799288e9b0e81d93edadea407397ea0865d81abc431ffa0b0faee747317348b58cc273951b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD544968c57794c623c8fd4c7cb7c257c64
SHA107ddeb08deed6eae68c1a700fa89c5f7acb58fb5
SHA25646d1f4b83df95fcf09addcafe2432ccab71ab3b9d876a8314ff45ea8ffcd82cd
SHA512682c8c82c999cc6df38940eb598f200bbd604453955bb6b31e59423c83c731a9cf142fb4459d51514e32fe2ef653d2c97bd03579da9bf90055aa56773ef23306
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f2f8e2368f20967206a8046c4c55fbaf
SHA16d91132c7c05a36192a712952ca3ce40b552180b
SHA256aaa3caf7ddc05c751fbcbf13f35568e6ec779cfa7e178e5c61558d657a5feadc
SHA5126c7212d161f9223ecf600f6b54189b474f60a3bb6d110e154ed29bf92dda12912ffb4b1726209dbf6985565ca81867151889341d48216b99d0b63b5d7decbcf3
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a