Analysis
-
max time kernel
121s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
25/05/2024, 06:15
Static task
static1
Behavioral task
behavioral1
Sample
711841edf03e419a7540cad69072d419_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
711841edf03e419a7540cad69072d419_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
711841edf03e419a7540cad69072d419_JaffaCakes118.html
-
Size
32KB
-
MD5
711841edf03e419a7540cad69072d419
-
SHA1
ebd1ce31a48fc621ed492852e6a3ac7a3e855b73
-
SHA256
6d6fbbfefbdd971d450acc36bef7c2927b16430fdbe92d1c6c00edaacf9f2633
-
SHA512
a796033c6fcafc823533444e236f4363628dbd660f0aff1cf7ecf33ffdd26a5915c447ebed8327bd283bfb34f32dcece0986a291b48dfd36631258a6862d5644
-
SSDEEP
768:0p0P+hRkLtqr5KPQFriVfmBxbk/otoAoaCMpsropvjZVxaYeFL:3P+hRkLtqr5KPQFriVfMxbk/otBCMps/
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5065dd176baeda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000000ad05f13c2c239e55ff95056aa39fbbaa245d7562eaf61c564f8ae14b870708c000000000e8000000002000020000000eb2e6e120e97a74ed60c6689709393a4c6ce7c99fe1feedd0d0041c60a79a8b120000000ccc33ad0eaeea3d12004d7fcfe457c2ed274e6c565de4e85e806049868d02c764000000029b728e05d35f0beac56208bc250d6eec29daf9400780d6b997b3d5f8b3b6e7f2d86a024aac1e5277011927d59e5c99d487cb69e7c4ed4d2f06ec079e4fc0140 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422779630" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000002db2fa0d218e18437d1f7f650f9cea1183bfd100781902f771a7deb0ffc313fe000000000e8000000002000020000000ec333b564928b8839d462367fe48a0a957eddc83c706450486772503d8394d0690000000a551c4ee5a0fad58b2c4f3627d4567508bfdf0ef4ba8deb97eb5a22cb88152b629903482dbe7fd44143b6883521319c1d08dd7e8d7014db8f1944c4f0a04fee784bba1003e8352615d3bee10441426c9c01f99e205b9e6b0988db72f78eb9a12ceb42ff7c4fd12a97ba57788ac909893da517b67242645d195d189ed5e53216af7709bf6d91c11d923b78a1d1a47942340000000c52769607e7570d511e3f237399e946f70dc568577d3f399f218006a2cb4ea596e9ef5e642844c021765d1ac0044757d57d6c5a9f0a0e9dc2a7b541f43b2e25e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{42EE3491-1A5E-11EF-A4F7-5A451966104F} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2244 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2244 iexplore.exe 2244 iexplore.exe 2092 IEXPLORE.EXE 2092 IEXPLORE.EXE 2092 IEXPLORE.EXE 2092 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2244 wrote to memory of 2092 2244 iexplore.exe 28 PID 2244 wrote to memory of 2092 2244 iexplore.exe 28 PID 2244 wrote to memory of 2092 2244 iexplore.exe 28 PID 2244 wrote to memory of 2092 2244 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\711841edf03e419a7540cad69072d419_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2244 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2092
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD523f0cd20311b62977c081d3453413295
SHA140293dfe15e7137c9369624cf37b25fa546464f1
SHA2563610b4cab77de528ddab2bb57accfc582426868e3cf1a511899f3d20b92b2678
SHA512426d14a8ce61830b9c34e0c44c78a47cef50b1cf49ed937a4b0ceebe6d466d7697810d09da3e6738aac1ad34cbb55057e9f6ebacb605ccda383153747f181c75
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c5b11c9f963e69b15e04cccdc2a37169
SHA1c2fd2b0ba10b961c80d595d295d9dd7a50537c1f
SHA25624941b0c84cdcd9554df9170ce50aa96e29caeaa691d60f620667c535570697c
SHA5126b57bf3f7709bd13b7ea006d8394aca8be6ce617358c067e828d8a549380229ffbf6a0390f354b537cf0b55126aba2ceac920a0b38809a7586ff17ba23e5afab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59de512f0cae9d0336274a7a66d6aa323
SHA14c27ee6e05cc31f223a32026b26f9215d8285fad
SHA256c2bede84f1134573a7d96f2dcb46397699f5110cd95be1635fc86279395c21bf
SHA512de1fe6cb595c7ab2de29c4cb76e23454918c2d4cdefb5cbe56334a7c4dcfbd5e1cc230eeef87fde06e5aeb8ab791d6f2c989c71e2162a97f711d8f195d8270b1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a26c7d155ca180d012470705e9cb1462
SHA18cc4c8279bbb836faa43e5eecdd91b048374a659
SHA256aba39b4507c372b6971be769a228e73bd40ecb49b846352094f667141a5e0ae8
SHA512630866d7e65a779cee50d20be1d9c8ffd726f681cc8d17c8a9770d58a6fd2971fcc4a41367cf3398a345cbd103e13d8e94af5083e3a17ebf052f48ed6212b8bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD545490b359cd8fb3e0794bbfa1d6c89b2
SHA188f45690aae5db9ddd41035136a6cd01d8051296
SHA2561157a5d15d34741ee0594d6bc8ce51b251472f0028255a71d813f8e1b6250672
SHA512d685dcce4ff929a796539edb6602f22d1b1e067b5ae9204e82050465217fe57828d2c47f8aa9a8b73a99bfdb0ef8106cdc38cc33625344af7de6be3fcf4756c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dfed2be1109f6017cbe1c7e59d364dfa
SHA17c0b3b7f4b6ca5af7254643db2572637280acbe7
SHA256e06ce942d5adba21b3abf0f439cfe44ebc4439e2b2b5bf3074dc04f276a74ce2
SHA51258c4bf24f665cdea7a5bc1282175b07b128b95e3e79bd6cdfc9aa36c78d0635000f05aa7383bb3bbb7288c99fc19f8b066141d654a9fea5ad0cd58f358c62f2e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD588e4be08e4c4239a9fc715133977369b
SHA1cbdefd7b1b55a884754e1d729dc06a4d98ac5da1
SHA2563531f65c63dd090612e83bb26a03cd264ff7c8d7a63b5f6046bbb262c49d0742
SHA5122c4c230a8002c62020b22404e4ef899def56cc7632b3dbd29783fd076190c8e9c755abbc7480120c461eb5ff84dd1fb1a3d9a493508d95c6dd5e42b6e91692be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cb942475c978d56b1aaf9ba83674d713
SHA1a9571309e52d95e0c8f2e70ce3717a8a5e6d87eb
SHA256240fe3603359bc32ac6d74cfcdfa5cbe824ae5379b64ddab06e595e817e6e0fb
SHA5121f4bd251147d66a870971ecad84a0fead78ba6acabf407c537fb4f035874f039930cba3f58d672f8c2e9f06904e89364d701c9baf7a5a2ad95a2af9ec5e97f99
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d646b3f17004a365324e40a4951d342e
SHA1f3dc673229a2fde9aab0a290825f96f98d393232
SHA256521a4e750f3d550dafe661195f581af719cf0661993e76afd13bc9f325a39489
SHA5127bc18df084f882bb83c96f7a69545f259f97efe2aebdd7a4c26b43acf439c83fa488033e167014e969aecb9ad59326c5d8b4da8b40fd95d8e00edf56f2d54ba7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56b000b87228f62d6325811ad5860f94e
SHA1ac51b4355e8e4598c97f3b3a22905ed7437d7449
SHA2561e1135f2bece379861eddbd97a278988433e15f3283862176fc6ad2681a3bea7
SHA5126f7a6b2e22e0d36d3c45068bd0109882c01e98006cdae69574baf567a30966cd9877c755dbb60d1e933c71feb801b6381a7432d88537873327cd36524cc7db4a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e24bcd343250c5ba95cafbd6cf088e95
SHA1721e2cd7bc3a7b6b4b24269c8c1f61c7e093d72f
SHA256af92e507a49d12441962939644c6f37da2ec23cfadc4ce53b5d43fa26a6a276b
SHA5120efb34fa1367c7e5628d51ab7a67ec725f3c3bd3794a88a5bd31e07c65c4fa18e26a316aa364bf7ef19f67fcfb6a4b97a94e366ddc0099c69a4060f4ca63c722
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56c099844712f3d170a05a00fa879400b
SHA1afc1c1d4865afd9d069378975e00e6535b2ab485
SHA256ec0080e5df51266ccece99107219ba5b283db9df7a89f5db4ff81b0e897aa92f
SHA512b58482f6a360cade25cb6e40d4075420d33caecb30a725480bfbfabc1c7a396a11a4d53d6bc33c11e868f01a9d8f1506bce85ed06acd769022b25af66e7189d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52436e0d230445fc78af3a0cec4e8ca3c
SHA111a757b339f7d88b02db74b63832c5ab58cfc768
SHA2560fffde6e962d1d3ef52ebdcc59ce4e136991b4c6611b53a05cfe882f96696e6e
SHA512b05eb8dff4d096ba21a2204d96966f6af151651d04e26e5e35b2d2739e5f3ec044cb687a8bc65f249d515c39941cca05bb0d32d05b51c8fe7de705cbcd8d2ef8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5671b216d68e27c4cef169bef50089e08
SHA1597156fdd9c2181c1daa9e63df44a234e56b1777
SHA25677ae070bd80a85f4c2c2b699dda906818f4c1113b8711a986a20160d058c56b5
SHA5129cdbbd13e35c779523f7880c6096e67e4cf6b7e04536a456bfb2e151a9438d536fbd6d74e3f2338ca33f7111fb1014ff59aca1be7a0874d9a977d54ebf3b75e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ef8dc8210cd276871be25f4c5ee6b020
SHA151eb100f7524d651f293ca2613471c57bbeb9443
SHA25661e61e7d554f48f4c4f7cb76ecd3760681e98b2cd04529773c78403c666d057d
SHA512f8d58e0b130f25a6a811cfb39c4318a9c96f1d9b82a09b16ec9529d0b2d340491582b0d8cd36162eaeb33d5c573b0b7470f1e79597aab126a030b7658bfc1456
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eaff51e254cf181b3c25886da839f3ea
SHA1a24a4dc34f830b19d6aecfa890f28d5b87ce36dd
SHA256061b060459037483e21f6d410cea8a30a25d5120ae351e8880ed6e9239756520
SHA51291325d6a3b44ad856b40b17171ada2f0cb3cf8299ed86c1a091530b9983196cf383ab51148b451e3923cfb1bbcf2226ce922a8626d378f64078511d090a4eaf0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b7ddd5b6455c90b3458cb0a298ee7919
SHA1bf95a7406e7aca3c7a544003e9c38544d87ed701
SHA256ffb7abe071ec8a689c7bafc577ddc907163812a966bb2104a1bf25158891e438
SHA512c5f1f0f90f904a89d434e24c08b538ffb6627584841d5ed327eaea927e0599ef6f7db88b3a30d08e6627e9948dcf1ccd658547b0e4757d6860857bd5f8694b73
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f6c57c5811b6cda11fadb5c65e369d66
SHA1ef3c70c2d18cab79a4cbef44be2c25e65f27f88e
SHA256794480cb85bba1781b3b04646e3bae68653c49af556547d1ced2ae6ed130bf86
SHA512e45667fd8097fa6723cfdf5374f0a7f19b3dc6eb661697212693ad235aa3da62acf1194ec74314cb1c23e522a85414d0857083310dd183fd08a6168d3d34e351
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54642ec4a68580d380811b6b903cd7a44
SHA11f490850cc5cc0cfe7f1cdf052b47c4209795783
SHA256697f66b95299072c009ae2e9b0b3709870da186cd83d2e801b301cd37da5bef9
SHA512bca99fac23137b22a1b5a2210f06415832d127d5eef8a02f4cfb8838a50c9f6a0e143c725c9fcb48a29796d356871a411327fbfc3e8209a37374937f56511638
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a