Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
25/05/2024, 06:46
Static task
static1
Behavioral task
behavioral1
Sample
7129dfe381a637a3b0a33a5f2a1e9765_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
7129dfe381a637a3b0a33a5f2a1e9765_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
7129dfe381a637a3b0a33a5f2a1e9765_JaffaCakes118.html
-
Size
461KB
-
MD5
7129dfe381a637a3b0a33a5f2a1e9765
-
SHA1
4af4f136d346a296efea3ddf6d43dea2314f3601
-
SHA256
0170305e5ba2c50e95ed24c6973f86fec87f27cc76a210744a0950faf863f36f
-
SHA512
50bf9a79d68c15838e36bfccfbaaac033f75bd9ec77a916ba744bf498012a2300b71a6627f254169dc6fd946467eaa03e642ee5f0300503a9e6547fc5b416730
-
SSDEEP
6144:SCsMYod+X3oI+YosMYod+X3oI+YPsMYod+X3oI+YLsMYod+X3oI+YQ:P5d+X385d+X3x5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000005cfd5222e110ef3da62bc17b43f0dfaca3de7e986a1200fc2e5e2de679484eec000000000e8000000002000020000000406ca912ca8c360cd03f13601b6741e4fa782196606c17b797ec6cd6fd14122190000000495243e570fd1b10a96712476dc3252795e47421cb24d8d6a36e52287174308173b7bc74f552bf0839814e5a4a67c40efcb6461ec3710ac60919ec9fc33fba705ef13e9316819c0adf7977a1d1a4a5e63035b5491c7116a9d6b58533ba2910eff68f5ca441ae2ea4db4a292520f08cec74ac8ffa570d858561e70741129d5b19694b0aeff452b876b1cc2212328b5a9440000000df9892ad3d9a675249f333bb20d24f625221dd1cec88077356d25d0927c5996c3c279ce0084b5a2995f51086c573e3c7e37218203221cf247e6ca370277ac123 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422781431" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7468C861-1A62-11EF-91AC-F2A35BA0AE8D} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20e4044d6faeda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000007dd82ce376ba18cf7eadc13886ef166b4d445f91b0e889f3db4cf246137b2fd4000000000e8000000002000020000000ef2acd88cec76153310a0b4711e41a517a73a64265d9e8a3a36dd67adbf48d872000000031e9405ddd2debacb87cb92a4bc47a8dd25a45d9977ed5d6d6a0057b348afa0040000000e9ddd03cf54731cfb5ff54b576f357bef17618ae03ff670bfb654dab7863cf727e7192d77dc2379989c42bdb6937113669e81053cab6f94ba356e7b2ee98732b iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2956 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2956 iexplore.exe 2956 iexplore.exe 2620 IEXPLORE.EXE 2620 IEXPLORE.EXE 2620 IEXPLORE.EXE 2620 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2956 wrote to memory of 2620 2956 iexplore.exe 28 PID 2956 wrote to memory of 2620 2956 iexplore.exe 28 PID 2956 wrote to memory of 2620 2956 iexplore.exe 28 PID 2956 wrote to memory of 2620 2956 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7129dfe381a637a3b0a33a5f2a1e9765_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2956 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2620
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f7982884cb82ead83be89b8ad4a57745
SHA1298a302485c2cb7d66ff1c48a9b6e66128a67566
SHA25623f04d8f7a2b5e3ea7a74eca63aa3218593c133eadb6d72792dc1218b9fc97fc
SHA5126e3f040a1a943b3113b80778935e1a41be3b7f1921e8bb93a1707858333cf4fdb9d24eb14a6e578ac5cfad0d20067c44e6f50864e5d24f42bc9851d34c1835ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a3360f4ec679b58303f94a2bbdbeac90
SHA1285a26e7412dfa14f229441a5f360a0cb7f96d69
SHA25641c45e3603bd7a239c27b714efebd83c3d04a9d6b0fb793bf8a9363e9d6ad754
SHA512d7383e1ace2105b7187aee0cfba9a2193468e00058597e1a12a9495e5d0918d17177b11c88038ccb74fb76d3e1b4c8ad2f0459f5164d1a48f7b9e10ae19cb43f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56c3c6f3e3e9bc2f7136e21ddb4f89995
SHA1fca8f3140bf7251292bf807e16644d454e2fa050
SHA2564ec34e5d144a4ece630ec9af16e928cb534f4f51dc7621c933e6c82cc22f2aed
SHA5121683e2cf965d5dda430f4cfd69810e325c7db5795c9a799f42f0d3fa7633317ad9077b9675af7b541c059e9a7615a627f064a181d97dbf5a5fd91084e2ab8ca4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD524b26a8158d6a64fe6b7848f4e770045
SHA1b71e0c47911a887c12d2dd67c91a167e57be93ae
SHA256593d5182a5ffa543ec8c1e4d23f7395e0a6c34dac495b30c4717bb889fde7852
SHA51276badd12c68ee3b9bf9ca5fe9e5e90876ad0b12286b0026030b1a6c158184ecc9a2108db3c6ee767dfa275d8ee999b66494a8aed69915ede3d4c89d479ab8b18
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5feb8f81e52bce816a433bc2e99a497cd
SHA1a3f898940833e8550ae03d628b9a82c976d90dc7
SHA256e8c4c4ecffc1d419dbaa5240aeb8a808270d7f34fd45b934c23a36c445b21695
SHA512a63ba61429a9d4aefb841336671871d0d360765232292e3dd2511d71538ddbbc40b3cbe47189af796b9edc43035d63c142ff7d8968e67711821d8dbccbb3ee00
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a349d075638c1085c13d44a93560a8cf
SHA1d9dbb8991c0f261d4c660609942c27654edfb7dc
SHA25689f7192d44116713bc66ab4deabcaebc9bda47f5d3f976abbdea9631de18a055
SHA512d04ef68377811039573d279de8fc520c30994cb2adc8d60e1a0192ef23c33b3be587dcb5249fdbd5dae5cf7a0a13e92b38394b397dd42563bf26032675dd7a50
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD584408cf29bab8141630cbed8a79d0437
SHA128eaa3f4fc776d7f914eef16187e40fff962b565
SHA256e573ce0c9ae903606a09b669f7403f408a88efe41578b9d7f477ec4b3b2b469a
SHA51217086d645485d738499a701a0d3f3882833834417f6cb35edebbdeb275b9e30912a95f2c2bfdcdbeba62d3f6b45972820ba096c9f1a10c7756b09a911741489a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bf3ddb001f000b958ed42ef4830fde9e
SHA1cd5410c81ca2bf4046f4a02a286e66ecb0194fb5
SHA256964ee950e85742435e01e959694ef2c64622bbc47c7f7eecb71c949847785b3b
SHA512573116f9193646d68a075d2031612372bbc5697bf0e46305429cb83bb76ce20725c89a2778ac8ab9309aa476eb159264ce1ab508cf929e5720707ffe15914083
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bb04105a0d6576e22fa226f5999b56f6
SHA1eb796899e5c5c42e48cdae77d652a500db61328f
SHA256dc709786de56e3ac61d73347ab9d974e98d806cd84dee464f01ff7f4aa3e74d6
SHA512c35ac4708954f43167bd73e12737431a03f8c92d971ebc6da25824f821a782eb1fe94fb3de77c03e41463c92fa652be4f728fb7fee22d45dc152a56d46f38693
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5454f4491933eaf86baa118f0cd2cbdd8
SHA1cf6d8628dd8c6db36df5d963edb413383a7554cb
SHA256255b1c1db7eb111f8262d826111ce506180979eebb2b9f03c04f2f98c1574cb9
SHA512443d698f1c4a2d26ce7750781b42e8210a7428e2d1edbcfb56e7c99a7039e9f1143a662704c288a8ac5dba16975075a5a751fec03225261d9e0c6e124e60b326
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54fc97a5244cce84ffce13e2b6b50aef6
SHA12e68458bcc2735ea1e882b344a04fa572c1b77fb
SHA256de31ac64864d9ec472d5b76851f5bb42d8409d389dab31371301926fd9970451
SHA51246f4502170435f9f2f217cc77f34077ef3c64710aa26ce289549c667e8bc22a0f1b0a1957a7f66cf2c794423db6ca366eeae041d26e6a0c578de342be29ca7c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53b7fa3d227e1dceeec9b795366126323
SHA160b9855bdd908eabfcb2aa3370941cd383f7a228
SHA2563224f35bb550429f2a7048693e90f14fa6d7bb7c476b47676ba1b4dd10ad5259
SHA51251cafcaedea240250654015dd2ac70617c0615edc49b82e0eaee0df0746a164dd5aae0ff82b76ea63c3b4f89db79b2f744132810e44dc78b6d4266f631a18331
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD540ecc5874c4163af221437bcbc92bc1c
SHA1a2969aed8dabfa22efdedd5d098bbf906c9e72a0
SHA2568e8e7c8c1939cdd04e293a5b04d265e9fef97e8743a0f51cb38cb507a5bf5cc2
SHA5126d85cbf13c34be066321a8d2ac17496400b08673058ecce6c96aeee32f1e8360736c5d77268456a79f639163cf319751500619606f7ee79050a782c11c22be87
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52554324abe2da1b5e074a96a7b793f50
SHA1316d864eead0da53e06cdc1894dc1ee9ba28a06e
SHA2562f645eaa27ac89a824e439d06527767433ca421bb83b81a853c27d4c6c01da8a
SHA512563107f2177e3bab276da3c137c4d70da0c65e27aa20a6aa72a8445bb6d1c82af595b1c7caf2a6db746bbe5931d6d13501374449c63e084d0f4a60926b37b868
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5de738964b38829f28eb3918e1b3c19ed
SHA1a5981e1e43c4cc131ad61925ad1313afff926ad0
SHA256283ce4121b01406a85b0a20f90ad4f19f22178703bb8ddddf34b672784feb527
SHA5129b0db9b98089cf22c127713eb4e029dffb4c8a2a3854898984ce0d1939877db07f8150ebb8f2da6c2a720d12238051f404dc32598a3718323ef26ffc4cc8640a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c9a884e39c9c95e04c839500871829fe
SHA1528cb3fe90d8bdf40f9da5e1c5ad348f02076f89
SHA2569839c3d414cc81829834571e54f1ba5c5a1100c0fe7ea0ca23b951d1d827f493
SHA512fdac38c7bf857ef2e53559e06955afa08d8da7ce07fafd262a41c8b9038931ec48d8a5d8ceec6b89b3a17251098fa4981deb5ce0b8303a457dbf71a21a47f19c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52dd605043d48191515c570ff629a03d1
SHA173b89339ec5682cdedf9199e652a1500a9449b18
SHA25676886d47b988422aa85fdcdd692268709ddb1a99032e69eeed13357ff33f0e3d
SHA512865463bf535dc7b6c9b3a6ecef0dd1088d54a69958596d1d4d34e6e8e80d0a04258931e70f9e8a430ef740b014afe626cefe27a11214440a431e4d6cc002b602
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54992c173ae234a8a342ce300884d3d6e
SHA1605093fb6a773e94787e10e9dcd3e870175cf6e9
SHA256afb0530cad02744adc7a8b7042e85d1fe86c8ff92d6040a3dc7908150da3be02
SHA5127111637cef71ceab0fd5dc4808fa85b82bada83505d8db26dc0480715c8bc3bf7c827e4dcedf80dfce25476685e0bfbe10211412bd5dc33497160ac805f0f0bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD594b3fb6e9060f6d9f714425afd93d315
SHA133811b278bcaebf61f3b12eaaaa4e1c4b8383196
SHA256e77e240538cdf900b25437bf50f0f56905a4ca0b0cac25e69842a714a71a8e1c
SHA51294dd2721d6bd0e9899c92d916d93322724ef9cf76c8aa4b95ba6fe72a3c94e068b658d89eaca1f090e5c1746e151af1302f13f42974b50228b045c65d575b643
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a