Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
25/05/2024, 11:05
Static task
static1
Behavioral task
behavioral1
Sample
71befe7bb7786a88614df0357a1c58b6_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
71befe7bb7786a88614df0357a1c58b6_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
71befe7bb7786a88614df0357a1c58b6_JaffaCakes118.html
-
Size
3KB
-
MD5
71befe7bb7786a88614df0357a1c58b6
-
SHA1
ca24f636de21f32de388a2e10196df1cbfc347cc
-
SHA256
0c1fe320b9dc275f02eaae7467d8f270a1c4a746faf72518404eea26d8081100
-
SHA512
6b314a1eee0df02691b6169883b5f2fe16cad25edc397dc3063e4154299bd4daba1cc2b4a7a157db955e2c174e6afb9308a8c403b37f79335dfe009017370d0a
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AC7D9591-1A86-11EF-8D12-66A5A0AB388F} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80a0e88293aeda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000766fc6d5a9ed458a836743bca79ba794bef671f2a5480a7177890d285c145ec6000000000e8000000002000020000000af0a4ad507bd7e9c1734f30aa2eb92fc3b4e59a69522f23717d67a3e3c088b24200000007291358291460218b81e4bc13aa39fc79678c229eb2919f239df8965a4d121f6400000001c783e7ee81c2786d6c517a625bda69b66d68372d3ff24e9c3bff2f26319fbd6f62ab5ecf745c7c701f3eb81465826bc8dc66b478f6bab47e1996a0315efb1f1 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000c2ed6de0f96329d4f01ccfae3e94563839e9ddf21855d4d0b78bb120a3773e35000000000e8000000002000020000000a29889e7498872dae6033532e16e2d72e94cfbf7bf0157728d094ddd3ddf300890000000d17d2127bea93fc5a7951bfd43834fafddc68b30e745547c06fea80d0029d83b378196abd61dc9140ba3860ba5525b0befc93dfd573a70f46fc6abafb1af9ee902c7f9a16b52e3ae21006f3e8d7e7ca559ef6ed93d672efcefb7786202967d0f7c8881094f9fe5daeae499ba07f26b534fa7e655ccd17650828c184f9cb33b215d1313a50cf018d0a29331b860e42c2040000000240052ebbae5711e2ce250e95e754411ff065129cecf0cf1eb538b3be828b55327423bd03ae826c9fb200a08e6b1bead0ff345175b846901af9b6b2cced5958e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422796986" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2896 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2896 iexplore.exe 2896 iexplore.exe 2372 IEXPLORE.EXE 2372 IEXPLORE.EXE 2372 IEXPLORE.EXE 2372 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2896 wrote to memory of 2372 2896 iexplore.exe 28 PID 2896 wrote to memory of 2372 2896 iexplore.exe 28 PID 2896 wrote to memory of 2372 2896 iexplore.exe 28 PID 2896 wrote to memory of 2372 2896 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\71befe7bb7786a88614df0357a1c58b6_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2896 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2372
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57ef129ee6816888ac02af8707a8c8629
SHA1fe1c9ca37ea8fdfb372c9b287ca415448666f388
SHA25636c928309fcd1e6cf4db36d2dbbea04f028a33f01e96833e93d5ad602c20aee0
SHA512bf0e2f0d8b300c52b71ab14ddcbf1f4eb6f4ffb4c67d3833d6178c6d8af78e8bebf596b55a5ca46637cd7df7f19aac98127ef02583812bffa8728ffe7be1ff1b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51b321cfa31c61ad354c134d9026c0cd0
SHA1909d3067eb9ec3e8dcb1f5ee162081092ab6b8ec
SHA2562d4167d86ee49b5820550373b64f87944f94ae35781bb6eecf2d1d779b2ea158
SHA51251ee86b80f6680220c94cc68c5bd378f1e6f7429c501fca4781c529d3c0c4f1b2d687e66dc84fd73edd611f5eb5f4162b6dec07d58a608147c9bc56690500bb7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5903f23a96a407689707e7b269fe9211d
SHA1be3e30e6866af0a1d6c9f97e241fbd583d58fcd1
SHA256480415906185087638f6f1f0e04132687c67d6a72f9e4f180519296233ada855
SHA5128640441dd3e4fae33d1f5be0b08ab1a15275f19b4d5a0c6d4b4964f717c389ab7f76aaf7b8dc7cd325188e3b8312acd7aa6287ec85f7f0f13042a27e014828f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5269427895a67c29b066f42980cf6fc6b
SHA18c6d9dc2aa1e8ca0304e16ba08714b8ee6ab2de5
SHA256b7096ee3995d51635372248bf338be059246efb7dc9b13d0384b45ff21384740
SHA512f7c72dd48da6750143f0a7cbdc19e8afa6f4aa8cdeb9279d09a0e0b4643a0cb87aeb09bdbee201bd820941a0bbd9b38b931586d5b087d6c2a0682965d73d1c06
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5626ccf7b972fd94ece7570f5be285ae2
SHA1c44ec901c865e68df081bbdd157682db09f87caf
SHA25690f7a4332f498481352cdec20d8108e8d3ca942461053448645b94c22a1b47f5
SHA5127cd2a20d0b7ce898bc545e22b8eb0874e79032549134195435011a704ae3b981ec552108b8f65f48602620d23900fe0743ffcac8f62b93599a6880a9195699b7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5da0518097afcd3e331b97842669fb590
SHA10ae569b52b4f4e066f7b7856db818751b1091541
SHA256125890aa86c1fb9fee4582fe12bbbb6d0f2c04c90355435bbeb25ece9e030c1c
SHA512133cb00b4feea64199554e6f6466cee9ea128ed15dd8132e1eca3bdf85e6a7b85d2939ccbad17211a7c79ec58834e3f2f9e1c3a8f8495056d82f9180cde4a730
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e51c5ac2a3e654d70b14c54b6078c3bb
SHA1f442e2fa38decc713a15854aa23effbfcee048d3
SHA256cf227ab9c5112216a29ba2434ee8995d81ebdad4da4d157b4dc42e3ae5bef14c
SHA51283591606bd5a32330387f147e2d8f21bf965f7f40c55524a7af1795a657748e4b8ba12a86dba64cecc6e422186e2e2097785953f7029fdd405aecc055c1931b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b6cce3e44bd52c59553c280041071f76
SHA1aed21474f372a46fb89305d541ae9851d9cfae1f
SHA25657a48275f607277d2553b6a062eee6ac714d2fcae07b23321a5d7dafc79cdb2a
SHA512bd99e4c32fda5cf85a41db61dd44304a2ddd40bed7871db1c363772a1d6a80fc58bada18ca8a780a32a9f70ca566983bf91b06276425b19e789aa9b0055228f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aa71561c062ee14c16d5e625f29bdce1
SHA1c54f725b22b1b689fe80dff7549a8088f18cfb3a
SHA2563efc7679f02d7e1dc306a29f4bf940422806db4dcd07decfa93be4b68cf865f4
SHA5128a3360926583cf419923b248298e98b78058ae53fa480cb33cd569d8fa41b695f24a85aa300e6972c502f323ce3ae86e35386e3cd2f93c9c46bdf58edf07c9a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56aacedd90514671f2b06900dfe6b2eca
SHA1de8fdec8f252e6ae2d7eb6fbfbaa2cd05f4c7690
SHA2565d86c80f29f32cb4789a3013c572725f29c86d82070df83cfa61ff69fae6cf27
SHA512a1ebae457836fba41aa369f7ee67110c1574a3479fb48c4912f6dcee7c893dec7cdf86c8827fb6b5d1d7395cd54c9294e31b08bea0e244230451b06dce54c325
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54673f4e0af86a009912888d066db4222
SHA1aea69e2f2f8d041a89a5de4378c6c0fc4b5089d5
SHA25621de94f72da3844d0ba1c3c39541c5b5124be18a54410df1a6d5699ea8c6d942
SHA51230abf7c75035b92158624806ae33a99b035af3cf5987da1a944c118958f008dffa8f35d7352a07ec3c50fa8c52be2f06cc3d71f2f7cb51ca42f9466c134b6aa2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a688a1bcbf5a56a9b360bf0f0f74aaae
SHA1a116263d1a5aed1c6e8f753a2627f8a4beea46cd
SHA256469b95e3e6c0df3de6354625bad959ffcd894911e6f5c0369ffc4646fb6d3cce
SHA512cea3889afba9ed55a0273687d883e0ade3881b1f8760801d2b2f20417015e313ba3881b4b017ceab2e3e918279da51d39c7e41f8a601f28ef8ba2081cd93c431
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5045c00e62b3ec9b467a28268359bf0a1
SHA19189b5e660e1fc06f1dca047648c5f7c3711cb70
SHA2565dacd9872b715b0aeb8106b3f3e7e10ea3580320069344e8a2c9862ead0aaf8a
SHA512fd84e288a12c6a0f90666e5bfb214a7d4e068ae1987cd061a4f066a1ec89f1c75f73b247c60c5f7aba2a560875a66956a138d19c9afca15f73cbaad95895a355
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c487144f423c9c5f130da6be7eb45c16
SHA10044fcab55d69777a52c9a75765da50caef7f132
SHA256162d397faba25bc3e0ed746ba46bf62db80a1db7e2562844910a000880fed86f
SHA5123af7eb124fbbfa28925ea05f627d49740b8fb5493c50981a98cee1cbf88b0a2c8c032a0e09086869d6053ed0b554ec7e926610dea972dd7fbf89fe05c9a9f6e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57aae52e03a0979b40c14da280d5d4301
SHA1930fdd401a65e0d173e8b4edd64e21882203d8ec
SHA256a5272430ab875ff605eeb95a4e165fde591dd0d23c72bf670c550df39a303a9a
SHA512afb974a83a37ba701e0eb60f46b98768a92ea9039b4c70b3247f1665272eb039024a355f573392082bdddb82a025d3fe0a03de0e152185f845cb24de289c8da7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e3f0f0d7e396be26b1b7ec668e0f6c1f
SHA19772217c1c951efb1ea6ddd655fa0f771463a2e5
SHA2563187d73eaa8eaf61bc325e0f25d67f6873b93b9ac71cf9e69b6d1d03bc7c3fbd
SHA512880c0b852159aef49333e8af409823a977b44278bfa4c756d7520b3f7e68d98d282ec6e66055969800f556975b1329a659d11bf68468b942c13ba8135dba85ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d5331bedd83ed352d79552618f0fdcea
SHA16fe18ff5d4bba775c3d465affcbf64d5699dc47c
SHA2560f56605a1595e0fab28c597ff7bdb06b43c7a627222a60ca41700538a0d7495c
SHA512208589eca7a25cd2934734f01cb2541afbfae62ef067b978f2dfaf52fd590fad980e9f1faac8780cf2725604c7f6cb4591d37a411c63b4fb7dd3c2745fa759a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5452da1372eefb4ad02b1bd1d9ea789a7
SHA1784b0ce207687c6dbf597f3ad6b8633f2a0324fe
SHA256cf3b44ace87516419b107f3f620801b64ee331012f82ceec80072a1afa8b007f
SHA5126149830474144ea9e34778a003c4feb50a79400de453e0165a2a3413342b3f62008d91e0e7a624b739bae67409006581cdc9e129b4599e689116e1b00be386b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD586d116f948895be4e4ab268aeefc6bd9
SHA15a754bc46e21cf4365b6f46c19616cda2bd6e198
SHA256fb7c22ebf2160f5eb30b64c4d175f69cf85f630726139996d3b8a6e93502b7be
SHA512b2c5a9b7055bfb978153af796fc887cd84acb82eb46c9c14d7e929b29e4440596de44a0648b91873ceab5851260e8c4784590ec1ae5b04173d202082a1de2d9e
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a