Analysis
-
max time kernel
132s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 19:23
Static task
static1
Behavioral task
behavioral1
Sample
6857feacce52e1fd3d54a7441491f197_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
6857feacce52e1fd3d54a7441491f197_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
6857feacce52e1fd3d54a7441491f197_JaffaCakes118.html
-
Size
4KB
-
MD5
6857feacce52e1fd3d54a7441491f197
-
SHA1
b60c5ee8cc5a2f511fdd3d2c6546fad029af25a7
-
SHA256
b4e1329be1f07ed42e55576533d03951895fc04a186893f25de3156028935de2
-
SHA512
9fd2656c456ddd70c2f3e85f1d7e6af290b35f010c32da0ce3f9996c34f115ee14ce58fd2d87788b987cb46cb0e0817a9af876e9fa07a65202def19981982287
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8ozbGAgd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDN
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000c65259749db8075959efd49cbf1d584428918fffbfb56dc6000669a814ed4aea000000000e8000000002000020000000c2f4ad88bf94ba8c72460fc0755c6b09d1a7c3dd87f5dbdde8b804f9b9b8abd520000000251050617dda040faf5f8d2926059554135a7a3d20abe106fb7d710c9f3e99bf400000007fff9fe00cb238859d28dc7a276fe98a0f6dcb7e77283d4720707360692a241423894594e11818f3e27382445d49309c4748289cdc2a595c020867cbcd6b09fc iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C8063AF1-1870-11EF-9CF3-F62AD7DF13FC} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f048839c7dacda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000bfaef51eb7d08c51188e1cc4e3463eaa66dc36a9aae8f29291969109624ef191000000000e8000000002000020000000ca9482dcbb6c69176a1acb3dcf5f098147e8cfdb339597662161b52207581ee0900000008cc79eb526718989abde68ef5bdb7543aa7648f100eca4cd4155266d0ab4878b580ee0c767a286f693d7ab78015cf7c6ec83d49e860900cad9424667d2b7b988d080cf9e48d5607845e42bff4982f9fbbdd66b7a5cc2bf23e772ba1129ec8ae4dd104daa6e227e896cfd541b8a0395020da2e2d563715759d0dfa629052a1f332fec3f39f9685bf919e3efb2833ad6e440000000a6cb7062f976aef6c6a5d6cf14ff2c7bcddbaec00b0d432e66a3f630df9af1ee8ab9ae6f6b336fc9206b41db749ec6aa5a3834e2cc2b4d20348e7ab7b46a38f0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422567681" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2012 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2012 iexplore.exe 2012 iexplore.exe 2936 IEXPLORE.EXE 2936 IEXPLORE.EXE 2936 IEXPLORE.EXE 2936 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 2012 wrote to memory of 2936 2012 iexplore.exe IEXPLORE.EXE PID 2012 wrote to memory of 2936 2012 iexplore.exe IEXPLORE.EXE PID 2012 wrote to memory of 2936 2012 iexplore.exe IEXPLORE.EXE PID 2012 wrote to memory of 2936 2012 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6857feacce52e1fd3d54a7441491f197_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2012 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2936
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58691c706bd86f8065507e66a669ada1a
SHA19535bd493f3a38145f9d7eb267c6548eccca1f1d
SHA2561b34f9ef48f3581eaed88b80a71dea68329e1097d1d6cb2b01003d2297a9f3a0
SHA512afaf533911fee7c6b396f04402ccaa9c9444aaa03036853db47f09c656ba544f81105626b12a7602559af73c45fdb44d36abd4d8bb6ad9e745e1f0de7f4425f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5353c92a52fdd2499893b20b5cd81f7f4
SHA11400a61d841430b3728a7c1a164d4c87aa69660d
SHA256f692ccfdc3ba873e756f602f733238a266e654011d7f29851c7dca75fcb02896
SHA512b7ef7a047deb7eb7c0676612b3fb783650abde1bca610be76782af3d0814fadfa02ff0fc6630ec8e5f9aaf0afa0a70bd2022b001d10318f7671983d52bc8ef41
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b85a0ea6528d92a52fcbd89fcd89b3f5
SHA1dad48b48682d85219d54eeb38e5eaf63174b5a2b
SHA2564f08f5353398d7eae2a17717bb73f1ad4e61dc0ec4cf3ce88ea7ede04a3058f9
SHA512dd5fd773a3957a201b4773d2f7e9b3eb07f308f61d2d5a10b13d426cb56b1623b8a38faa0700d94342a7b4943a66e74e876d59fe67e875b15754051275b79d30
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ca6b3b9780a7b7186a8f5d0d23471015
SHA18e767236efa5cb3bb1010d5b67c86cb539f3da18
SHA256c8800c68e7421d0cedbdceb34978228b82f3626edececa10dd79bfcb4a5bb437
SHA512acb14aee05c023a756b72bbd3f0765e98fb8de1ce5c12fac94b4b8dd82624ceb8e0a16ea4ebcab84c1c302bdd2ee65dd817a01b21340c3b300e77febcb0627d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53506fd044db601a764fbc1a6fdfd078c
SHA1636f11fb01fb9934feba7edb48e979bab1641dc4
SHA25652de1177835bae3ed84ab50970d3c33fdc5c3ce5525289b48de816d54d15555d
SHA512aa7dd831b17874831e8a98e3a2148920f27d86c6838b767eeb142b74868943d65ff148b40a298b218c1efede43e914ed2628ab0954931f458fcc569df32a70e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55cf9b8b981117e2b1739becd28741f9a
SHA118a99a94dbccd5d75bff54064cd572008a287977
SHA256f3f423581d1c95316d661048de75bd95731e384b611242eaeb0293ca17f0f5db
SHA512f3f526a3f3e5841ba29245a870fc6f5750aa94cf819a9eafddce8b6efbff225ec3a8121a0524cdf297e21ab05ab5b9f435ce11684b06ce3d70a19cb0b1bffbcd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD576bd9b48a676a2e8f696e6280b3c6ce8
SHA100fbf83c18dc1c449951c24baeec12acdd7e9d01
SHA2565167cf119b45b30e73b956fcb7af0a2b87efba11238dceed38de2ed902bd2987
SHA512f55e92dda4f5a00b171760387b9e81b1f33f1640941cb23bf2ff888b2c98beb3104dca2ae6f558e07dea9829a9358159a8213e83b90eab7d356fca051cea2747
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55f1811b360be379e66fe2f07525a39ee
SHA1ca220ab2d6ab13d3c5a5e7437092bf5013d246d9
SHA256c8c1b8a8baefe0af4d795177cff18ad3ceafb25fda31dc9fa7f548c53ba29855
SHA5126a086564340282fc307aa6f9b29de7980b7bf5b89c1df09f7e3274f6354fefd5dcfffe6573b2fc91f8ec7894d3c185e18d5bfa9f6fbc9d138602684ccc988706
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b7656741e6332a6d51b5c2d05a2f25be
SHA13fe79bfde9f564a6abfa8996fb505d13a0e97c3c
SHA2568c5dfa9ff8a520daa60339dba1a4a7fb89c6e2e9d19ab9fbea512df78187cb46
SHA512f4353108155097caca041e296f46740e9c552db81e0ab56d8d25a122fd74ed72c5d95ab2e5ccac5604249e794c85a793fc909ed1b89f0ed41a511fa5eb81a82c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD545465033a2e8fbb1a53064d862efcfb7
SHA1d6e37ac300f165621134c2816001d11ed95bbf75
SHA256e86bed69c4a092d6d2922a9846546d9eabf11f969e3625df55393ef8a103fb1c
SHA5120fbb5a155268ea8b80aeb113dbaa91ec4087ccf96db6045900d94010b6516093593a92dd6c9148424cf597bbee36c0b82fd5a0dc939751406924cfcd36bc3caa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD536b20a6eb8f32fd1f4ac8513cec2e39a
SHA1ae90eb031d98c1439cf2bb9e22bda9d370908de1
SHA2567debc2de77536289f8b0e2c5a8fd44eb8410e0a68e089d24f4c13d1160999273
SHA51290bb685deab4332ce0da74b4b6275f5d6a9eb0e02147f19e9d4643b0bbf17c1c0531d12bb41536882ce26e90a3701bfaba4f804ef34362275692687961d9bba9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bf4e193e00bf8c5cf83fe32014e1382a
SHA126f83eae1d7d487367c5d9d506c6f35bb501e1d5
SHA256afd2220439c4b568ea58e7cff964269b8d9b00cd45021348eae7de98d681bcfc
SHA51215927bffda9f463b363b3761ee086b90ae7c9f155dbc5af52611539dca07dc787e43af31e84b80091a3892945e1ca7e50cf80aec9816371feb74e4f006211f70
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b013a3307679e0942049ff6a456b24cc
SHA1fbe22f1a9cb9d3a84c3396b55c9436b8e25774e0
SHA25602ce17db2c7a910f0e60c653252474d4c3a2f57dcf3dc612625c3749cf40935e
SHA512be5611bdd56a32d8f52984c375a1df22c8570dd003b635b69f1fc233145236387c655a7ad164f62d66a89b0b6c8d957d9821bd2e43cfec54cbfc10b03c1ecb5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56532a119585f2f4d006c1e3a2ce6fd4b
SHA1b2bc630a5590251c5fb9982370b01b33d6c65285
SHA256b7c08edabb0f7062ce2a346ca2c0eb9cd419719b5fdf57eb7e2ca1f9c818d067
SHA5121672009ba22d5c32ba089c47c19fd97280ae75735c2fc39b10b571f84540716b80ca5bf691f5fb43008e772ec37b157495acfb583e4492471cfc9f154849a1c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50d3aa43096dacb8054435cded08d6dd8
SHA1a10c6804a11da9b6ea3c86298baeeb6267e6dafb
SHA25685c16fdc25de105ddca5d88b53337bf138937980a5c8148b79db51d6383042dd
SHA51282699ddf7806d6d9fb5c44091405442f7818ffe2f4f9f3d5f835bd6c32a1df684dce996d0ad1bb27f1ed7fd079379d77aa68a3215c442446d8108fcd933230dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eb5af692bda965fe514de28ab803484f
SHA1774a3eb388c8cbfebd45319d2687015f1893bb89
SHA256849158c7822c44500a4cc4ffc51978f855aba7850d03b10f4a1600343f268e68
SHA5120222f955e3105a3756cc8a3d306f06e9de23d6135f97979ab7954b6b00d9681662343c2cf87f2f3f145e97ba85eb90a9f66772ee069b923cbfa23759263b1ab1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bef0ece6c85a432bf6c68ed9b1848415
SHA1cae692fb95c273f83188a7082c54ce9140ad1b2e
SHA2560e7027e31f7d7244cbbf1c47a1774b742438cf21e5c4c62e575b2e7d4027012a
SHA5127afe586ddbd398b9f649af2a0f993b9d67c4a828e74832f0da46308451af97944c306217bb9669aef2029843e3a533c55407bbf7689e880487d953bffe51cb46
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58b8284cf7e5fba41921306a740073ea7
SHA1c68015359d4afd53bf41e777b197dd13359b1e74
SHA2568947d506a2e6da2e2a42747994abf2bccdacaf1ab4ecefd66c01cd278518869d
SHA512e3b2a5751a1f35cc8ee9c73d35f6e476849faea3fa8d29aa0e4ededc9ce84cb44ca8e515cafeb5863373dfa939f2ddd3c46d03be572fedd3a1fad3355e1621eb
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a