Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
27-05-2024 08:46
Static task
static1
Behavioral task
behavioral1
Sample
78916057e3e6fe52c7ed5139c646e154_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
78916057e3e6fe52c7ed5139c646e154_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
78916057e3e6fe52c7ed5139c646e154_JaffaCakes118.html
-
Size
69KB
-
MD5
78916057e3e6fe52c7ed5139c646e154
-
SHA1
39d8547c7a340363dc41493a94af3b6f8060f6dd
-
SHA256
37d413e561b97ac41c16a2f143dc1a75105710ee363384ad089ebf770d807f32
-
SHA512
b74aba0772437c8b018987b109d186c6fda76407408a28602f186f1b140757039abef9a4aa22b4e026b56f2017e4ee3883834d8f8a15ed9e2b7efc31ddfcbe0a
-
SSDEEP
768:JiIgcMWR3sI2PDDnd0g6qnaoT2e1wCZkoTyMdtbBnfBgN8/lboiGhcRfQFVG8s/k:JoXTTNen0tbrga90hc+NnhVJ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000fbc16068d5d3fe8ade53a74d39c28098796fc2aa84c96abf01c0d9e7752f72bb000000000e8000000002000020000000083683bc0b3157742a9d7e975f4f45c9a6caa968d21729b72901326ab6c2fbe220000000e54efa6c59a190b96a570fda8d1967352b65650ae71ace989869954543c4c46f40000000bb5f3e9ceb876966e9a775a0b7039840eda527025dda257daf14c9749fb4d0410809925290d77975ce30d2e83b621b3f3abae23d530e6fc5133522ef6facb519 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80e8997212b0da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9E02DA41-1C05-11EF-A002-FED6C5E8D4AB} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422961459" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000001ff5c21cf2cc987e2bb36d95f5f21c0463d077fee4075572aae25ba8842cfd28000000000e8000000002000020000000bdf7149833d5e070e161a4945027b4938ebb7043e46cc8e3ef5749424416724c90000000dcf17d9ac4d19374f8d1bfb9320d308edb4c745a4f4c33aed133923161f7d4af082fbe535667d7d3427f54e356be4b6a841e34f627745d99044ea79ea1b37c7935e53c90f383213915fcf9371eb4d1f844c92d0e76bc110626c78a867aee8faff7bf90b1702f3520b0f791e4ac9a4daf68ad6933b32eb6d4779afb0fbd1a10f0ef2b5a1cf2a652c180cafda77447b24b400000005ad835879b6ecb8c84f287a9bf8f3567ef0188c4f74c7fac2511a219372f6b8dbf81b24308a92fc9127beb6bf1ad7e1c062baa7c2d1fa95c626980fa93b4e30b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2548 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2548 iexplore.exe 2548 iexplore.exe 2224 IEXPLORE.EXE 2224 IEXPLORE.EXE 2224 IEXPLORE.EXE 2224 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2548 wrote to memory of 2224 2548 iexplore.exe 28 PID 2548 wrote to memory of 2224 2548 iexplore.exe 28 PID 2548 wrote to memory of 2224 2548 iexplore.exe 28 PID 2548 wrote to memory of 2224 2548 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\78916057e3e6fe52c7ed5139c646e154_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2548 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2224
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eba12b0befa3c5906ad943fda56a956d
SHA1202e879a147188de3981c8ed51be2461f55848ac
SHA256e66461001188f7326f6c1437c6795a1fa971106a3aa25a6916a6448dfc076778
SHA512c867088862df37d810e2819048120952eedaf26dcfc16440b2ec7c7fec4a5ae9f4c89dcf763e2ec200447390074650303d9502cb1b20e97f535c667a93df7e15
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fe7f22b5f89d242be50c4cd5b78dfecd
SHA131cad951df2932aed90d8e8e03667618288f1dfc
SHA256e0737d7d2c9187386e80f98ca2091eb47fd7b264baf80ac9b90ad71a69458b26
SHA512dc10da09ebcb7bb0c50fc4b102dfea4fad5e3b66a8179a2494cfddddc35ce1f80d5943d9e8171aeb413016885df2d6fd79411965925aec59c75f018aa4865ffb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58d09867809e0b44e4d5b9a59f67b6378
SHA1fb601171fb8ec7577600772c4cd69ee937f66068
SHA2566381af269106648b715744884b5f52764a54e47375eb83e2f41878a36356f9db
SHA512fe04a6bd278a933024ecae564683103687cede01f52f37c6e42544d35dc668504235926e3e8f5eb118f0f527e061395fee3ff8ea9d261915b88c5be702586096
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5584d4f34cb6c839116e78b7b334fdfa6
SHA15cdecf4eaa5cd9d5d628d531bb5581392aa52dcd
SHA2565e70a16583bf7625115252458a6f1e06c2d8a588f1d53941cf3a41822b6b0b06
SHA5124eb13398bcdd21d4ba10e40e942ca76514a9da20492b9530f201477d3093cebe4aa97630cc2812e1a791d66b2ba91c80dc54164b1dd6a3fea793534f77c587df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c473548060b00f667a6e26b419935025
SHA17fd19d902d76dc51098fa8568a1be412401d2d46
SHA256ace866d2cc619f32133fe75a9bf5d8c0874353948fb683b23a4788b15dcab8d9
SHA5129edede516f019a77d2eb2e84cd9b57fdb9db93019b931f105f20ca1030cd824c529d2a45a4fea661bd53ad77685b5d90d4d7f655ef8b849d367bbf5c84b69fe4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52cae43ee372365b628e36071d0456cd4
SHA1697c4d1d0484b3912219a1f0071facbb7426723d
SHA256572e0bcae178fa4502df52303c6c0ddbb0e1e35be546abe76bddadfebfe0ccbe
SHA512e5846dee5b2df65c3294785679248764a7e149237eea2c4dbf0479adcc72a2c716b2909ea38981e6576badd926adca750464ca08bac8c0893ddb2a4ffab02804
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD501d0304b474044dfa55cc6730b5ff227
SHA1ea032027e27d70bf7725930fa94aeb44d51f0e41
SHA25639fd724dfed480d02fb3bc89999e76aa2b08260180a09145c651d06a6e4ba55e
SHA51244e3dc350e3c5b5146be0fedd06d3f004d934a7a0bc2817c4d0852f5151b31654be4d3b46d348f9fce46ef088853c60d64188340ef992289410ea0d65e3bdd88
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5534659dcfaeecffdaeec7bce23f0b544
SHA195059da4658829a1005850ae57e0773e00a97eeb
SHA256df79dbc4e06dc9fe24e5a254c1c36299f7d04f51b259033eeb2d3744d6c625f9
SHA51285e413df5a2a4988e5e0e963cdef2c98584b935610979e847d41ae38d3ba12b68edfc483c974532c5b5aec6e956aa5bf596ae0271d86e5618b6401c02160732b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fea75df25e16b2ff2785ac42880ed972
SHA180653005a71eccefa040e1ba5975060e10f26052
SHA256a6b89426d30e5980314f5ab8424d62f0056d1516ec45d180bb4a8f7c429feb0a
SHA5121e42960c4979b7868ea127d00ce9f749ddaf3b579f5555a868917ae62608329ed143e629a987f4ded6b89aeb90ba0dc45140b9cf6a364028e95278d19924a130
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a02c143c81299f4af245227ef54aea59
SHA1b5d8ba84bf3933d6780c7dc0342f33dc53f07afe
SHA256f3d489401f8f734527c5a3ea2074492d8c9c24a5a57d6e07009b0bae0ceaea31
SHA512539e8bc9cb326401810ceaf7ec701c45c19fa7c7b1fd2aa9ac6b4808cdd604748ff03dbdf0771087da999d14762bb135a9b614a21a612a61504637eb574f9950
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD576726c52f89da61cdb33cbbdf9062fe5
SHA11d6aae041dffc7049fffa5a881cf698a43ec9c70
SHA256b6381b281f2eadb866c0211f0d7d88c277a096b9077e1895d395d144a74a575d
SHA512e06dcc51cda18b3be63941f9c0735466f0e21050f7d5b06bd15f5991b50483e18bdcc0420fb2d7c1516384404d98ca3ac3d124a0892c3a88222b1e7a01c0bc54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ba825ad8d7495e78216932c86d417908
SHA17c41534c8bd49307c5d698146308a4efcfe4f08f
SHA25685bc8e91ef2ce897959c56e73aea473b28f3b7e8053989aa7a584c20f194d4c2
SHA5120c7e7eff519d3dd36acae6baa7ef0dfb4103761af5e398bd6f1b7027ab8e7c56e8de50aa6571b71649df5742b816e2efb6ad595bd5a56d69577662f0521782b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD521dec4b05f6fc5477493b9b0d69d2204
SHA14bd0a3735c4b3c3174beeb49e9d5459213b7fafa
SHA256965d7154509c0963476f026cbef5dfaa185b944b1af9a30663dc1c055d304b98
SHA512b5c7ddde0cce337553fdc13a0c5aab9daa18ab2511763bad3713f12d9231b17c9426556886de0b2902c4ef5be9d3825d3293968be3b5ba3bb5010b62b031fbe4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b3e914efa674cf70abfa7a04389bcbc2
SHA18ab3cc3a6d23524eaa83a90376820fe6a03ac650
SHA256a1a3a64b53319d340127eb746d4ea2884d49700fc2710fc0d6b63dbe03640cbb
SHA5126033b033cbf946127069b7e6c278bd3fb4021283525b2de9c56a8005221a0d7342b076c10ca2a54d8a81412c0e7e6b1b4609e5d446da61d3feefbc795493fbff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51a49ae2f485b79553b105a3df2185569
SHA1ae39cac9ded7b5eb5ff1ccf4c0129ee1ca9d6220
SHA256cd7c5e3cb878eb745b11a7bd924fb57ec95f644d0901ca65d0730cd3ec565f88
SHA51225c3a9c5ab8e4f990c18a7c38aaf03afea157b7a9f9a58d274beb361c43721c3a2905b9313d2222681e8e9bd74471b15ad5f0c63cb71d7eaa7ac35b842ebc1e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d159006b45b18b250f3f63049ab1300b
SHA1c240996cb58c8a210452bf67d92f726453d33454
SHA25620e7db3a58db750c2329a2a80b854d18b24a610241e10d4aa8d1d945a9c064ac
SHA5120dd968f11e61015fd5baa50e378649eb0267ffcbd7efbb572c4dce6876cd7698a2cb80dd0140b13a0bc9ed742cc973066caf0a223c3fedd9751710ed0f9520a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50c413bc687c5028ddfcdafe51a45d242
SHA19364247a71ffb001503a181dc014590b142934af
SHA256b1a818f8249b65e12555b8138eacbb7de7bdfcd432ed1e91b0873fcd47fece8b
SHA512e0ce33bcf764b183b7bf7550f3c9162dc9e81168046dab8ca318949e7806091ed807e093993f60fe05908664bee49f6c645aafc2c3349cfc365cb87bc8a6ceb8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cfdf832c6899d77721fca7b38dc9b204
SHA13e3c9f0c805a6a432830ed07d66649e5bd52be22
SHA256c75b3e5e7f19ebd6ce8d716b0c1dba261ed827d2080704b0c041028374e4b2a2
SHA5121c51e0dded5a647a6341346f9fcb485af96e8bc970a78b083476b0b743bcf8e63e5a82e9b08b7d623c3a1b64d56922d8b689347748c136b54e99d06953240624
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56a7bd24e47e47386a3ddc829e7006802
SHA17997c6da74df204d9055944dc86ef57c2dd1536c
SHA256c6158bea463515dbd080220e05c13b9eb4b034703fb8fc47a3413ae91be352a9
SHA5124f5c0ed68c0276f8029f0f14d1be156c0406def0355a920b2dc1b1646b867d515a520ea68155bb2451dec60a2cce14640b9c98016f23ce236d0f9316c1e99a8c
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a