Analysis
-
max time kernel
135s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
27-05-2024 09:05
Static task
static1
Behavioral task
behavioral1
Sample
789fae4a6202fe44e642a10024838313_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
789fae4a6202fe44e642a10024838313_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
789fae4a6202fe44e642a10024838313_JaffaCakes118.html
-
Size
350KB
-
MD5
789fae4a6202fe44e642a10024838313
-
SHA1
fe211a35c725bbab69408aefb0b5c8f21d2bfa7c
-
SHA256
bd89fb10a3cb565f43bd9a9321ff5763fef02aec65854204711aee19e8802696
-
SHA512
0923abfe6062002720aa087f881fae726bd44f9f04399875978a2380298c3d7e2872a2c394b010937fcfb372cdf0fbc50b22bbced09e846968e2dcc778d22085
-
SSDEEP
6144:SUsMYod+X3oI+Yg4sMYod+X3oI+YAsMYod+X3oI+YQ:H5d+X3j5d+X3Y5d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000006bb4184d32ad13fc77e581a28e2bfa8854bac1eb2f1b24ef6fa5465c3d7268ae000000000e800000000200002000000044720dafa25c40bc1a333e3a3d55d5c491253674bbd4bf46588c968f29ba1b46200000004479a173ca656dfc202837d83187e6de629bc933ea3dd68acd24c7b39612c92f4000000007f2174be32891ec176f75cea54beda9be1bc8401cededc2f61e22d85b6137d06ed6a13595f4357a4d7cea7bc69b70173b22146a114f84107bb1187a27977688 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4FA6FA91-1C08-11EF-B2FB-7678A7DAE141} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000005e4d7e62a77c4b15e1154d8e659d882529fd2a81be1c12c322de0579abd19162000000000e80000000020000200000001d14e827db98eb932b106a2c66018f420a30fc29c54b6d864fdf241a7ad989e790000000b34420bfbcd430789d294b72677b147fbcdb28ee351ccd0a3152c2947e78113930409582a2747f8fed0b47161a7c344f6a5127cdb53a92e639ef5a4530ba4933769310bb6e8e3dc7eb1a52ecfeb43c99ce8c25e31bb8d74640379e1b2c609b65d3f6acb2e826735bb46e7513ed5723627b2bdc39b378305fa45460806032b818b3b2f26f1a4398dfae521211b25faa0940000000f2c89df9c438b0f091520b8c1fb821576145ca094f6358c3b85ec8e39befb142400e3e09be19f40215e722e8f099bf0ad9e83464fc99d33f8aadbea82f4de2c3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5004de6215b0da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422962617" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2156 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2156 iexplore.exe 2156 iexplore.exe 2700 IEXPLORE.EXE 2700 IEXPLORE.EXE 2700 IEXPLORE.EXE 2700 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2156 wrote to memory of 2700 2156 iexplore.exe 28 PID 2156 wrote to memory of 2700 2156 iexplore.exe 28 PID 2156 wrote to memory of 2700 2156 iexplore.exe 28 PID 2156 wrote to memory of 2700 2156 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\789fae4a6202fe44e642a10024838313_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2156 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2700
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5182686dbd400cc7491bb86cdee393b6f
SHA1daac84ec34cbcd44fb45a6d916276c69463ab9ec
SHA256d1b377d2b46c24d4766e5c8eceb4058e38acaa8993b404da46cf7fd06e08949b
SHA5129c89f83e9c1552cc7f52d1edc4f04573e399a72d937b989b725fb4b976b40b0f7d04ec430c261e7c77cc0bf0464880948e456cbd8686b56691231bfd4ecdb2e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a359d9a2b92b8e651dcd2def2324a8e7
SHA10f093ca347b4b06642d35dcbf8b23ab61fc54538
SHA25609040b2a0d77eaf8be1b30b4212766667fde986d44d5a701bd048adcada84416
SHA512391b4557e9476d12516eb3f9163b6479835202581dcd1fda07713e90d4a203f2bab4f1d3bb7df00725a7f57b99912b8acd4cb868bfb99d8ff854c1be233dab83
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5babe518036c9ecb0597fe5d81b633438
SHA176d7b9727ef928b2668ceaaa31eea7bfd72798a3
SHA256b3b34fd0175b2aa7865271eaf4584c63125e93c977a0114bb7034cfb78d3ef8b
SHA51223742760ded9034dad14c7e01b7dfb76da237ff26b128bfa60b8ac875187643cbb9b3cd9fac697eef6837026379e7b6f83e0a9d0d907739226b316960a931bf1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dfc05c19cdc6921eb80d4a7dd9467910
SHA1f1659733bef61582ba687c872ea1c6f2d64ce6a5
SHA256d012d250cf76c17a1956548c65373d7e306888cd478e2f8166a7e01b90b90576
SHA512e90331e3d717c0d518f4547d15beaae4137e3c2df10d46425c8e7d8a734b88d789ec3a4b7ba1b2eccec3d56c47d0faf8e118a3cb0fd6f82bd50bfd064c507f80
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5de5557b859f3cd3ca2aa310ad7df062b
SHA1de10e09f5b88e8a413666f566153ff292564005b
SHA256e5e977a0a1bf540d207cc003e69d68d420429b200ce7961e5daff1dc37629c9d
SHA51213e70a6c4f25f986ec0eb4c070363c697cf73bd9d3ceec8d10600eae87393a5e70f2284ca26e6bc154d5899f4f8500887f45a4e57483593b7d0ebd06d70c2d15
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD520621dcc599118ce774df145ca4afac3
SHA14a85decf593f94872b4ff6b0504a7fdc73f20fa5
SHA25632759274acc10136b9af12220b55d76edb7139dcf51ed22895ba809f740aa693
SHA5123980f8ce61f400c0b762cec6e2af1752e147a91b9d587e610f84c799dcbec142bde2859ae395aab28228c50693e9eceab2030292f5655e03b2aed394a1e525d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dbb2140f05cb16976fd14d3eb12d4a5c
SHA1aa0761f698a888bcc829ac1a669964adbb20014a
SHA25606e20bd5be63f50db6cec8b759383c13801432a406a60ac2dad802a950a3dd97
SHA5124ff8634ac88e94d2598b36423e7cdee78ed6500757816b53f0a416124a2dff01e423abe8012b0932f09095974ed19af4dd2ae8da841ed8c621f470452eb2a94b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d6f3fbe6e6c08572e0db2070b9f885da
SHA1a262e0b1016c6e29922437f8c903abd4623f3819
SHA25617b9b2c33aeac83a18c86399743dce410c7bd3d7a9f33db03f0daf98330bcb84
SHA51232b63603bacc3c32a04177b1c4260177320844b37e328e692efb5be0b348644ef68cd23fe9722dd907625f56804570e0f36165a32df483a13be7c77de5220a78
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53ce1e50ad40f85b1dde23c7896282681
SHA162c418f6f0e1288166bc1a2d508d31b452f41fb9
SHA256a6b0cece5d43f7c2f557aa9f45f5f26fcd06d78970fe2a866d18f8f503a61910
SHA5124a84b6213a5fe47f6968a97ce01bef7905012fb675190385d970eaee0247f8307ebc16fad33d12bde54b52d58ad42c16854ce356275e3b258c2c72f7aa07ab1d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5980b844476efe62300345cecfb10b3ba
SHA10b390845be79dae556c09966316299af9edc957a
SHA256438595d72f57049a8407b200b73626b1d4d97327c7decf09ede7f3eec2aed59b
SHA512a1749cf7a180086e075595ab81cdbcf9ec13ed8f559a44bd2f38bbdee50e817d4f99d3154ca79467c19529c6ee56b7da6c4b5a0eb765a5099979c6791574428f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5773db102834ceb4f2b1fc9d9d3addad7
SHA10e57a479d0406640b19ecc0a88f48f0d90e3be59
SHA256ce101573dd69b2f57edab924c858ad50fc83264f86d1f5af70cea11e22754eb8
SHA51224db47b92f100dba706cd7bd6ba565676194c40bf7a62a5ce8a782dfb440be863871d0be9fed9343f6fe972417749eb0a98d1779652f6d413998ae67db76a8fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5de07e8c03b0078669906e70d0067a94e
SHA1dc5144144672eff049c41ecdedf59ef0b36382ae
SHA256c27ce7c3f71e308cf236dcec795080e1b92f93f8dc250ccc651765dc0549aa62
SHA51295112a0f32a677d76da71818213b980cf919af964d18f5f069e8df2c581248b2cc9bf68d77e591928e8c043578897c51f4b75127f9bad5e28a4e784868fe42fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57c5489e6b17c5b091dafefc5eb9112e0
SHA12ff518c350fc5414c47133093aa60ad0e2857c4c
SHA256a495609f50484ebacfcddac805819e2316f4337c2416dead6cd079edfc2fb385
SHA5121a401159b225d8c57d6359bfbe31d6ad5387153d571758e7799093d3db18dc5884fbbdd4bf4f8d07363daf307b90820de2ec4a05758807c51824d463fb3dabb1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59215d188858c16a17d3bbfbadce7b39a
SHA1ad84678abd8432231842b1c2188ab6a7c6798911
SHA256b8ff7d12ebb5c2028243f36361d58613b168206a283f606031f171ab6c341907
SHA512338a26e18d20fa9de1c01e65a132798d66570c3c6f1cb5d3b14e62f211a89532aa4c655bd7f8a8f5726941f939aeb629ce7777b7056358344c7e0c579b59339b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a5964d1c96ebe6161e5fce81e4d7a6a6
SHA18526f48abce7a9d6819b1a5926ba569f6dc22c47
SHA256889b1b76be70db323a1b94360ae3a43d3cb81e3f50fbbb925c9893bea4aae32a
SHA512aad17f86d7484bef0a59952304115395956a114a9f85761812e5d87a2221099e7061f2dd8f401715d127e4c4ac82d4148f52adbea786fd572ae025e603d50072
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e6c8d189782af678a7c5eadbaa528e35
SHA165d0339ccfc4c0c6d94985eb5fd097cc1ce47f56
SHA256dd1f4e2beab560dad5f10b55f1f003f9a3499a1d413335819988627f42b96ae5
SHA512298501b713a57b51b73fdbd18b0fad1ebc6ab0d73cd0b6ab96acb3e5f291e2fedb6ebe43a7b89878bb65c7e4138414996b6e974ac04c21d8c30209aecab96375
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e8aa80eb01de09f5b037e185ef204837
SHA18474d5c2e9bcaf91af1b8cf5be711f54e5a662f9
SHA256afa4479b6154f0f9d28af89dd409685373c0a5bc4156352b620b502291485661
SHA5128f48df445536df5f8cd7111c18a58c055b5489cb2d9b7bcdd12d5d62715b6fe2fa6453ddb8d6928f0187788e631664936132b6a484850e8f101b7851b17ead41
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b50af49cd44fb3953d46f9c7b78e7e55
SHA14d2ef05c7aa2d12d8060c95ae9a80fcfc4197d08
SHA25656c8552852d9a627ddb02f3aac3d7b047b31e0e08ee6b859011aff1133dbe7c2
SHA512cde443c21bbc38ed6d72e6b6a290f596cf58d72a52a03a29882740207f3284c38753f447e3ecda1b12326b754ff6cc1a2bea8f8eb2629896166ed158619f5bd9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57994e0ed8100f4a3c7621bf084944537
SHA13acc8a0bdc932ac11ad165dd7e8349ed74d9afb1
SHA2563798be4898be7c53914d79723f825774b4776bea73af90a1678a69213327f4ae
SHA51296e0431962e8d559a65d392e5d1849992dbfb91d3714ea94ef95d54c2f7a58b4f1d64ca5362b198c76a2d42df4165c79671890bb2a49ebcc88f1f9603f285ab3
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a