Analysis
-
max time kernel
117s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
27/05/2024, 13:46
Static task
static1
Behavioral task
behavioral1
Sample
794d157b2b6a156ce8c428decc66d384_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
794d157b2b6a156ce8c428decc66d384_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
794d157b2b6a156ce8c428decc66d384_JaffaCakes118.html
-
Size
6KB
-
MD5
794d157b2b6a156ce8c428decc66d384
-
SHA1
47a8e8dc77b8c9fa1b02c5170bc5e35a1ab40a1b
-
SHA256
22fc34488af8c5ed504096d78d73a885ef98bad7fec1deb6007f11784f567244
-
SHA512
7b8fb7b8d721936bdeb5333127f7436aeae26c161821e441321d95488d5f3d8c7cbe69065c57040c1406877268302795277b86e7b3008a1bdb81bfd8f9b10388
-
SSDEEP
192:IhUPTNPa2EfcwjbhlhJALVWlF2jIwjT/W3K:EUPY2E7vrKU+jnO3K
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000df9ea414aca64813ddb2c66f6888dd382d2be346386e6872271284e9cdce1e08000000000e80000000020000200000002870b3fbac80b2526e0b7c4d9b5fad4cf6c7467d934462f35d4d1fdc40ddfb6890000000eb254467b7c3dfe3b83cba90f16978e6c4ca78a6cec8db59cd65251a924cba3d50edd4daded5ba5d1f302eeb8afb20a761ecef2bf196628f6cee5594e8983a4f8b9664f7c231478a75ec10c245c9080ccfc02d34a24b82df681188c1216683169dc610ac81d034a3d45c964a1ac58c482b530b5a9b0b781cc73c964101a19531f885e565cd62773606d62953dd1f1d0140000000aab9b00d786153b47ba0a24986b314ef02a8c81bfd42cb82616ca3bed363004bb5beab6e38feff2acb979f4571c9285611e95ca4d6c1fc4575168a3f63d1585b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30b4e4633cb0da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422979474" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8F310DA1-1C2F-11EF-BE4D-CE57F181EBEB} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000008d520b197dc371e8c4f95c28b426c95313ab2d936631ed1103f3483365d47413000000000e8000000002000020000000f706dca39ddccd82c520d4d0bd83169b2d3c2ae269718faa09fe7b36475c304d20000000ba533f1e1f5f68ef1badd19ab843ab9f2e2014185b66328eb5a7259223051d0240000000d422ca2f4344d9941d09ce4516f19ec7a1fb08247dbcb39ddaecf9c312dc052d36b1b6b5b44391195ec21e4b234a391ec235340ca7022d63ce02592d64d1efaa iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2108 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2108 iexplore.exe 2108 iexplore.exe 1764 IEXPLORE.EXE 1764 IEXPLORE.EXE 1764 IEXPLORE.EXE 1764 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2108 wrote to memory of 1764 2108 iexplore.exe 28 PID 2108 wrote to memory of 1764 2108 iexplore.exe 28 PID 2108 wrote to memory of 1764 2108 iexplore.exe 28 PID 2108 wrote to memory of 1764 2108 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\794d157b2b6a156ce8c428decc66d384_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2108 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1764
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ea2a7d59ff6f32cb50e52ba49ccf613e
SHA161917c753c7dc43ea9a1b881c67a3a631c8af57c
SHA2566524bb817164cf3a501554344ef944b436ee5e3dfab53cd26de65e823ce30ff5
SHA5127fdb33005a2190b33cf1a7241d3898b9e491489903c12f1ff452816014926f2ada1fa16c04d90069f88dcd4ca07dad31515a41164c8422a44afaef7e51410db9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f5b545b6db771cd197083174ee1da791
SHA1b8689c72aa6c1d6d783ec9a13728f2798f434918
SHA2568eb2900605c9ec26a2b9cca3b91a5595a247ea8088c3aa9cd5f358f6f377307f
SHA51298c1b0256fa4bfcefcd09f6fe304696a4ae6fa0909ef2398a9d38975a0a65943b119fb14c918096c4f585a8431bd449f202af810b2d26a0755c6f874ff7ecaae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f2b3eddf7497c301a901312a459f1549
SHA1de53a1176d6b264bb74cadcc4b0a025c14d9a11a
SHA2560089703ffb5985fb9b2a2f8bc62a09623d0c0eeb9ffe101e8595d7853d79738c
SHA512877deba6bc6abb5389dc583d79179a52cdb5e84218622a2235fd15f434228e133e8d993be6d3bfe6b12423dcefd8a312f4453d6a5f67bf0b9720db4e24bd43b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59786fd10b73152adf2bc73d2ad65e402
SHA10576460513f42d05d2ce5e48981bf5254311e9f2
SHA2560bfaa3bd370bc82073c6f2feb84e8d8c55ac332fa46a896216ba3e90801cad0d
SHA512b59dc55d7ac41b347e01e9e7dc0b4d9e5de6dbedf4b6b04c65849a482065670ce333beca86334f0a9ac436ab0bbd56b53b5ddd339a3d55772a616ad9d9908143
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ba2000bd2f06a2c88276e07628ad33ba
SHA16e5c85d6ac5d8f5e7309fc5503d23a7240f79563
SHA2565bdf2c9c98fde61ef8b1327d76231d0895aa55ba3876b52993093f27863f4539
SHA5120357539205118829adb77391390badd9ee6b7f93a9c31534a5f99c411a99b60cfcb8605cba1f9eee8c2875e31f94417a5f4dc33a61997b84b07743a8101f7f14
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53b9e0775b50b841ebd0c85525ca9e1e5
SHA171b4f936606cc6eb037055c041bba4a352d7b973
SHA2561b9439aeeb06909a62a8eeb3f9a41117b3a1487b85a8fec80e16e35f1b5e81a7
SHA5125d38aa6c4327f612b05cca8a5d282c4bb102b6c40677031c0cc1ec6de953a413ed0592f57139e448601a80b4bd1373d040bc66bab33a4964758f91e459168f50
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5367f4267e4ba4d9cab2c10c015355385
SHA167f1cd80323e8ff2b782b7c10ef098698faeb19f
SHA256e98fb257dc57bb842d89b1e5eb47d7c459142c4aace6a4c744ca8bf1d111b562
SHA512e52528cad60b76b99906960b8f89b81310767b7e91d845f4d7b142742632d8a7a45948d8ed7b292c9e0090026367860b3e1dfccdab100a69143e69ed86e47a14
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5674376ba50aec5e1e3599e3b1de8d4be
SHA1b27011c813a9b854c04db17459a79c35fad6aabe
SHA256d2d9e1000c59c4afdfa015bc3e2b1e6413e133210d96cd7a3ccaeef2cf63519a
SHA5128a9a884a98063d1313e00b0bfa4dd1b9e5f34ddf02d11d4081740f779c6bce273ffd4fe908a447225c78d22c90d6c67d91f55e8fe8907e8683e674b94374d9f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD521d31d7765673e7c57aa8ad25e56d218
SHA16ba721e19afed85381ddcc0b326fd3b06aa1cc78
SHA2567de9ffa9822a93c64c4e56b215f762b72f1a6ff16b34a2e8474a08fe5b3fb42d
SHA5129d7a4686a0dc7ead40a8ed3b6ab21c5fffd4e3aeccfc2cc8bee354db6ef2acc7d32f5bed101641cdc05a821ccbcff36c4af31ac5254d635ccb8590a90cbd1385
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55a9e92475f6a9ee46e78d8f913968efe
SHA1f4d4379a0b44cec2802a55a4c583e10983b62525
SHA256d22600753bf6ac1edc6ef46d1fdcdbd9d2f4cb7fdb61d77f7147a9f82d0a067c
SHA5124f3946322c671c00667ec071a5843bc11aae7697845979433adba6cd2533bdba63bf46854f6c0976311066b670a26912a9ec948e47afb432758c296f912981ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58119780ed2886a7c555a6716a7403ff6
SHA14ac7993c3950bfe68b82fb3f286799c07167de21
SHA256adb50ba0c8b0a8e38e3dd0ffa809332e7b9a1c201ecdc081b2cddf48353ad908
SHA512d93f2a305f629cb6cfda8423d3060cba06249689a65c666360cad38be90066127bd914cfe804f27b5135b894201659138ad67b35a20fdf18623ad1c3cc592ce8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD508feb463a50f5e652462547776cf16cc
SHA16bbbdc72fe62ffe8aa2743b594e496cf46b17192
SHA256be6afb71e003bdfef15d6e024dd2d64540507b0b482893d5da152d66a321422d
SHA51221eb7e1bea02574f344fadf5cd5df5aaccfb0169a7d3abd5b917b6b5fbdd1f33ee06e75e3ec6664c31b067423b4f28a966dbef3677a783705782fd8d37b874dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ce10a2398e433f7a6dae0fb8236f86c2
SHA1dfd9a0a6e5cdbdb94b9b76e088e2c4733529944d
SHA25685bf1ae580e1039b04e61f178a9bbb0aaa00242ad3a7b6b2c3eb3315c93ddaa6
SHA51295f82a7ddd17ad1b062d7ab273f731b496a0b2171be1b28b706dd993695cb9dfeb89ea619d13d91b6aeae8f7759eba55c801138d705de8b69cf450641843e39c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54384d02584382387ecba024242628745
SHA1365a192fe5600ddf8807ebdba188eef36d8a3ae5
SHA2562e873733306c9b01cab29b1bbcb63687f623a9e760835b7d0c8c96a6eac67a3d
SHA512c2c13f5768727a52a2db5886cea3fa1cbb49ddb9e695e27c24f0565f940a0c58bf0f29abba463827192574f3e2013d5fb2ea077056b88559689d80d643f0c25d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58c5ab7f2a1839b7c096264d408db88df
SHA118c25e40ef5c8649b1f18ebb35580d526d8d9838
SHA256a2d1c864554752e8c33027068eb2cabb488615837f40a8cd597f635896d87d55
SHA512f827a791bea7d8c9020239b5f99cd461b97f7299b870b4b076e7717fa3c7256f13c18a93b74de5221590fa16ec4ef7b89a305ac915666df448da5559f3b3bb34
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f67bcac38793995d4dc869ddd8849ab7
SHA19f4e9d9613d344e9381af6cf4424744bf0be3373
SHA256cc0a509203a4ac2a451013b42fed855e9731e907757bd084dba04758464ed13e
SHA512843ef774b0dfde965eeef0fa11e978228266c3219f5e9246397d4f9c1684424f0ebb8d56bf4446116926a76a901a3caae388173751362a28d7d493ed6a371609
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD552a5e8f427f87e208084ba1969ea803c
SHA1d71728ea31e0bfce2c4bc46430159f659577ce18
SHA25690347a5305793f2c9ff0177ca0ffb547ffb8107a68ba44329c2197ddcbc3bf9f
SHA512fedc5d94efa0b76651c002339a691e51e7b022e8f62cd7be2a07f7e8df2b8d89b4a105360bc5ab7a7fa1445f443e22de36b93f1029b3afa732156c7730c0d62d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5239ce1cfed9253a9f848f58a57593610
SHA119402b6fb5c1ad610c3274105666eef3f3cae664
SHA25666d2a1a0b64da0e3e9b9cc44ffc90cd69a6b49ec21810190c43e88caf050d4dc
SHA512c3a6325a392be797a44d04c02c7e0f7ca0ab29683cb67987ec758b58c8ecb37c70042ec1cd46ed4743d0cd13fd975a14656dbdfa2e96a21a27b875469f8048d7
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a