Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
27/05/2024, 00:20
Static task
static1
Behavioral task
behavioral1
Sample
774aafd14a918d7db9f87b1c90dda521_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
774aafd14a918d7db9f87b1c90dda521_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
774aafd14a918d7db9f87b1c90dda521_JaffaCakes118.html
-
Size
6KB
-
MD5
774aafd14a918d7db9f87b1c90dda521
-
SHA1
e5269fe595fc8aec7964f417779a004ea5091f25
-
SHA256
c7ada48503acabd0fca786a073fda262c07eabd274bc791bad341a143a4ae7f1
-
SHA512
909168266975c6f82c7c598b3635ea3f494d13896d1139e9460085e709097091aad545aa5e66589bcb91144d417b4fd60d41ce37945c791ccbd69d822dd1d0ea
-
SSDEEP
96:IfF/u9PQbN+6a2FYNUhhG2poQJe/tJ22Wlftc3HjIjT/WemK:Is9PQbNPa2uNUh5hJALVWlF2jIjT/W3K
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F06F8F91-1BBE-11EF-8DB2-F2F7F00EEB0D} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b03d09c5cbafda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422931103" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000002e8b88f142fa8531c58df0ce182385190aadab2af02110b3bb87e2d6c46d9a0f000000000e8000000002000020000000faedefd729409680a58ae5ea37437807a6ede1610854872aa1924f0ab953e1cc2000000008ddbfb8d630f74c1ef9d1a8e0c17f040719ebfb690a90e9c83b3dac8f7e446c40000000a90995c7dc065247595acb257aa6e818efa4f3a0638e0607e5e7a8421bb8368aa49b18a1582d078d3654189b85462aaf380f1380dfc6371e90555d632b4a378e iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000673cb4866dffeaba823495afde8fd0f2034185289a629ac30fe69a302b42ff82000000000e80000000020000200000002a453d073e3cdddbdd6895cb3667d41582315520d107b4c59eae2262f054c3ae9000000093756d817774643d3df5050597de0582ceba5ccfba60e8a07576d568261428b90dadfdd2785732a852453882f500e35550e2df0395401b886b57a964dd221e169822a31633acac757f513437c62c089c04d2dcc2005e681371b9fcb556ea17c30c06b1364d1d1d5da5196fc84f50742d89da7104aa3ddde57a21fba40097e947d3edb2fed1e363c69725d7d013009a0d4000000003e41e60293118c4ed683c639d7b8cd018d31a2aabe10539b16a81e2f294dd0866c2671d132d6062d12e655ce612d5d9326e8218933387dfddd478a4acd0df5b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2224 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2224 iexplore.exe 2224 iexplore.exe 2100 IEXPLORE.EXE 2100 IEXPLORE.EXE 2100 IEXPLORE.EXE 2100 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2224 wrote to memory of 2100 2224 iexplore.exe 28 PID 2224 wrote to memory of 2100 2224 iexplore.exe 28 PID 2224 wrote to memory of 2100 2224 iexplore.exe 28 PID 2224 wrote to memory of 2100 2224 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\774aafd14a918d7db9f87b1c90dda521_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2224 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2100
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD521d54e7513fcd1e42df533aaa8cefc23
SHA1e7c59b9cc86e7ab525831cde47745dddf200bb27
SHA256a60a979a0adb7a1f90940ff937d64050e9911422a40b8c684ce745589db7fdf9
SHA512575520b817295094cc0d7499e181dd8f70633be2efea1b12e415b9060a9b7554b5792eb1913ce775848b43daae3e15c807bcdea9123b5fff1e1426aae5b935b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52cca5531cd25309b4e0870be7605f5a9
SHA18ecc2eaf2fd6ab85ee42ee3bc2dc9676ec7f1aa9
SHA256a3b69b545cc7df8f2758069a2af3945aa282cf434922d6f69f7907fc1a4cac53
SHA512655fab94738a297f873fe82d10a80116b71693044b40ecf28e3ecff662b2f655311a73541897e86c7e4a4c413ffb0ad6a08f495017081458e88a4ee8cc1775bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD508dbb7998edd442c8204de325a0fc606
SHA1f611234cf5c1aa99723202cdcc5ad6a7c9d4abab
SHA256ed6410f36909a27bc1ac846089d38d0a3bdab2f5daf80fdebdbe523c8b21dc70
SHA5127a9662ea572dd0d4f002e90bacbbb92d2ace7a72c179701fc2d067bf90c6184b91947279ebabc12957a21a599edb1bc0f7209e6efc400f43345f9de476c8b6ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fd2eca861d3cbb899f48bb9575dcbf80
SHA1b393006f7037a2f1e97518d0f48bbc532e94dc2f
SHA256e6afc7039744ebb791b7ae127abf91a21ce79a824bef0d9b63180184269a1f1a
SHA512a2f9c8db98d1a2f152ee2114b8f105ea1a9b632008827fb9901203c38972161a07a48e4794e9ce0e5151c8ccdea52b81312bb808f0a7b6801f68f39c447e3566
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5468dec2626c4ecd72aaefc7c22458dcc
SHA1eb7dd46339fa8d5d461cc41cbe0d5b1a2e325a87
SHA2568f745f3901f518192de1b6ba77466e68687d9762408973cfb9a2346e6fbe93c2
SHA512f1eaf7e7c5a0979bef9281eec30d820ea3cd3fc17e457a719498483ac4b1ecbeb5600e038473f5a5df243a8c3f061b0a0d1a7df5befcd95329dc513a9f196a9a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ac98ab79253abac93be30e9f5311676c
SHA10bc4f40ccd181c43f637091cf3115712c7947ecd
SHA2568f711f38fcb1c8dcde365bef003fd5d0922c8d232cc37bffa53b59bb7f1c678f
SHA5129675023104e06799acfb5ef99a0e498b9aa8150b7aac466f19a66563636ecbab2e00e99c5796bf18246fba196b312c4347f8d52a672a42c07d89d0f651f0b82b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5529b5cd3bff2dfcc3d3e014207c856ab
SHA1988d593a0277f84b43cfa840386c2546d610199b
SHA2560b9537af64ae7506609b75bcc908034c84323c75010ed0545627bc6182c259b8
SHA512ae6841f5e8eb4f902c5425ba1d7e2e69ce36151703915c89e6c85eb634f5578f386d8dcc5ed2247d1ead9d1f775a93fe089e3e2e2ed0f59c7a11028c013ec666
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5344c1cef86b0e72096b753275495739f
SHA1a724cbb74bcc7c1fb0984cf0109722399786504a
SHA256776dafac9c330f426af40e83835a46523149234e9f6f422fd984ae094988e487
SHA5125ac8c709a680960e33d24f8278334bb7c3547bcddd8ecc818fa0363c01df9fc0f98342fd1da697095233903838e1b8966149ef200f27e04bce087dacfa1d9f2e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f10e79f5bfc27de35c2b6e6997a49604
SHA1c95fd9bcd296b24112624d2bbf78f93d6c802c08
SHA256154845cd04122d454fc5b7f49f458943158a96245400c28dbb721f43f2e2418e
SHA5129af7c7209720a345f800afaf8ec3905f19cb5f272a9b8883cbafbd341294fac04903896cdcb7738efafbb19c2b2592b4abb4b29941127a361ea1168875df73e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54bbeb9dad325bc6dd4c169df5d4faa66
SHA1d278fa761bbb3ea61e2135c4aaf13979372d561e
SHA25603d7c8bffc2b7d82e4ffdba76875d1fb972bc19e83956a3eed70d0b972550699
SHA512bf0b5139d0bde7f3e6561816e95f997a53580e530064e9862effb8e1e57a18ad3c37a3c7beffb2f6445333e756ef9ca1c0bb0db224bcbc5d160d543f48451f38
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD514b146491c8b53612ff8e7637dbd0734
SHA184a745e1127c4839f059bbf0804d9aac65642498
SHA256d427792f8a6454e4fe22c94e9114033deb830ea00251190f7e21f7077726735f
SHA512586b74146af533820d277e6b9ae0f908a8e5a0250110f3901a7dd805cc96fbc6a17e91d60a3924d57b9fbf098592137fdc368ebd6ad40cecfa2b59d1d62fde19
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD528a29f0025ce31b03bf6953e7f51ee53
SHA174cb1c6f7e76689400f705ce6b74fe6beee4cb4c
SHA2560208296a6b243f013e520f7d0aa184fd1474e190f8e8ef9b342a059a613d264b
SHA51205682488e58af0daaaf8f66947e6a580e5f8bcf510bad32136edefd513feed74a11cfafebc8c7020c112b68991604c9e1eb5a7c75a74f42ac457a4d27dd03dcd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54bec3b7ef7f52bd9dc7f71e2143f7172
SHA147cc82db668bc27298712db5c4b6520188ddcf33
SHA256d2a2e078da1a9a57685625517e2d049998b9812d56e5c31c503942f889074df3
SHA512a8cb4a81c27b515fa50dd0074a07698d5232414c832c99b631f165f7bbe72baf9841c1d10b5a9b1c5017a5c597f0d2bc5cd78c9e0baf9bc399973aa9b6f3f1c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5490b2ba5659d87b82c5ca63ce7d24131
SHA1e9117b1ec5ec2192b1a23cb8156f456b7c985f2b
SHA256c990109494a342215b3ba83b63bc6ad0d31e285d3ad72a231b0c6c6ab8644f77
SHA512ee01cfea3b53c3255aa2f405f6da5a4126ce451825c90bf4118a1a690c85dc11406d3346ebc82724ca7947df4a767964c54ed68919d1b47ada23db41431b9056
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD502bae3fa22b638dd563eaa155114845f
SHA120679e9cf31fb1127dd89e7fcb99ee691101cc8c
SHA2566a0b190da2045a148fb08c50901625377734e9e42184da2478423f7027fbb61a
SHA512e5d6a2d48bc99712c306e24f9cd94451783b28fa4a6b7c5782f7066e75eafbb4ce6ae8dd77edefe7dc8a1ad4896d486d35df5af3b0481618a92b3acc8ece68bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bf39baf3a563cd14c66c0f605704e4c0
SHA1d27b77fb6f3fb679ac83fa6d763de4d745ca170d
SHA25658f97a851de817ace6c5a6012ea31ebd15a3ec69db608c1b65ba21485c012aaa
SHA512fdf2922ad702e19e3fd4857cf56c940a3feae37f1753954cfe6b135d1c35ff7f4c3900ef5adbd400b8d9698e5e30440d7bf6f6ddffd4ec1c07a261957443e26b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e027570c209fd25548230674c3cab7b0
SHA1cede0300ca469d69975f09ef4e26bd3c749d3fe7
SHA256b331cca354213e1840ae8f523f20434209c2d64e6a6c18eed8ebe2f319aa40b3
SHA5122c461324ca7c6d5407bd88c7e7adff205cddd5b30e71f82dd571e7e12e90eb4c862e11e433947e013542fec0e7b011c56d147eeada07998fd7c34cef1597657a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ff8c99122e2360de842859b8cc260097
SHA1efc5f2f48b6ca2dd61d540c222740d9ba7a6470e
SHA256a8ceadc65aaf4d3272c0d028e63be6426c69e061533099cb9c47c928f468bb65
SHA5127038fb6f4da32a8e1b29c13b59bfb0c8a9e56784015fe529dcacf6244886752727e8fade46e8bc847e5d65cc9d18b2ede1aa5153b2119e19f6d533abccea303c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c0bfbbced4bd7e2e1685adec35e8de8c
SHA1e03d8358b84252c769a2567d909b40291abc0002
SHA256d02899541f3e11b6461b9c1c3c3fb6d9bca2f2b90ffc02cd14e2cb4a6c24be8f
SHA512a0d41965087c89ed4b1a59fcdec89998720dd0d72b1dc608bf5c2f30c3c9c592ae2ae1abad608762bf89d6df7e8cc81b287d1ee67521f2411813a9f7c3dfc121
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a