Analysis
-
max time kernel
121s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
27/05/2024, 19:34
Static task
static1
Behavioral task
behavioral1
Sample
7a450f21672920f7b43681ba9d94d629_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
7a450f21672920f7b43681ba9d94d629_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
7a450f21672920f7b43681ba9d94d629_JaffaCakes118.html
-
Size
9KB
-
MD5
7a450f21672920f7b43681ba9d94d629
-
SHA1
e52491db54bbc318836a9cf16d220044841ff272
-
SHA256
42b19522994e0900e90971b4e67d3ef6278e7774521b07c582e077e8c1b03c30
-
SHA512
f4911bf7208424a3de9914dc291fedd1a251361ff136a1e644de003a78abd96954e1dd3d2dc4c73d34e08283adb499d5b8b0e6a5bdc65246508d083af12665ca
-
SSDEEP
192:aHst3Oefcfdma1CSBcFL397NdcAGRoOQiP8G:3fclma1CrFL397TcAmoOnh
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2DD7CBD1-1C60-11EF-B2FB-7678A7DAE141} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423000355" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e93610000000002000000000010660000000100002000000025f47bc5c9db1e4573ff968fe08c270138b7884b0b6df9c696b879b737b1e21e000000000e8000000002000020000000349a8caffe1935d8128a612eaac7b9e48752249a3bd3b8dc3d2e560905ae491b20000000c645eef9d38c01f0268efb8181eb44f67de57cf472512753db9f179f400169ba40000000c2484e072197a6feccd5e110dc1fdcc9cf087d4d338742ef35bdaec65ef7f2740d84c755fcc2af1b12470f6935aacad401d7cd8625d4ab0e94ccd90203c13629 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000fb9c9170ebf1ebba1bc9d655e82ba41fe20d24cb6076a669a64b112dbe322b9a000000000e8000000002000020000000fd6c9762e66524d7f3367d25625bf3045a43aa4fe6569606f148da8367c46ca790000000063d6bed773e44baff1839a14d7954adda661c2aae37bb9ebc90355e3a86eee67dea5d254025638de6a0adb666a76165bc7455665363c9e26f9c3d83a353bacd0e7231bd4cd0d02a1769674aed1fc80496c96cf377a509e08e874214653206d2961db617463523645f2ca62f83f1f83c4275b91270557af9ed7f8e8d8561e76d473bd12039ed778281a5773be60c54654000000077bbb3c41b2f23bbe2a6311af09e8a666c8dbab0d2d237196f58253fceb8f697c5db97c105b85298a8db4420567ee8d33a3debcd3a867e9c46448c1f12f25a51 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80d373026db0da01 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2164 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2164 iexplore.exe 2164 iexplore.exe 856 IEXPLORE.EXE 856 IEXPLORE.EXE 856 IEXPLORE.EXE 856 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2164 wrote to memory of 856 2164 iexplore.exe 28 PID 2164 wrote to memory of 856 2164 iexplore.exe 28 PID 2164 wrote to memory of 856 2164 iexplore.exe 28 PID 2164 wrote to memory of 856 2164 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7a450f21672920f7b43681ba9d94d629_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2164 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:856
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52b542f92b9d2d8dd00a62bc0fb60b287
SHA1be55512f2ce9e0b4df752eeb30212738084035dc
SHA2569396a8e62acee75189f56080ddc5855ac687c165eaaa555739a8401926a4560e
SHA512be3f73446e1da3d7eeaa8b40f11a52bc216e5927a15b1bddc395352bcd51d3e33735f01337f09c4e593da5df325b57d76b606459d608f570850cd070a19a7331
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56207a0c36518024ac8bd785bc588fd50
SHA1848e22c88d0b3705b2a8ea7a8b7dcfee76a5cdb7
SHA256b3a1521c62c87ff01a32d0deccced3f93bb531e3b44c7ad46be23e0e65102b82
SHA51292d1b2b54cc0bcd66cfa34c914c8efd18d11bc07d2da522bc596bab49849bf7bf4a84e8a8761cdcf01e1850d9d7fa6ea5f3a22b60d7bbcf4d7416de549a2a78d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52816732ac187c597177971a62e5dfe8d
SHA1ffe9622a40cd5b8186cc555a154c1d0da257622b
SHA256a65e5c09b327d62274f82cd88d44c3b7b78cb85ad0b7e7bca834628af406008d
SHA512f86b290b813f2ba26c00dc253d4226eb64b0eb5078a49f2a86cd2f5842f217866e688877e6d9dbd47e04ea9dbc321aeabf98742dbd561f4bf5cf870e9019d629
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55896ed8fa049ebf57fb2fdde06a5dc11
SHA1977e699219fb419e2cf527d9bcb9607838c73506
SHA25654e701aadbc32d2553f47775a49746d691b9307c0deaceaa7f7bf7f6571c5e80
SHA5124676d02fccf8e45bf9441fdc361752eee179ef795ea2cece0f4ebce20aa4ed80140b49e2a5e7af0aa90eca9b66a0c6082602678275cc2ff83ddf6030960ca84b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58bc59d550df8af6ac449a20cef9043da
SHA14b1e9e12fd4d4f770b16eab1de537c610034825e
SHA256c4b639bb3160121a66eac6dde81f8728a2d75731ef9cfa1ddd8a42a31cc54ed2
SHA512da5f675885d5facfc78b6dec892cf931e7fde984311fb2e6e7f13ac633a21ce0f7c6c63d5b0f54c2996736c56c80338f639de29a60633e53f92d2d8e92117c48
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a738ee9365a94c1d6abb9a6a53218248
SHA1b9c4b46e56c6e1a9f0d3c7a2e7f473c2af07073e
SHA256cfa31ac26a9c1106eb1a9c6ba508d75ba27060a99c211ba7ee764264405fb314
SHA51222c7a648d095bc5a1a4b0bf28d9a5f6f4b4c60de6e5290743620e22d935e509a4c0e843e768e4b6aeb787f26608da28aaa04f0e09309918904af042a6f93b2ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bbc3c44023c99f402e7fe15df342d0bf
SHA1e8015cfc9eb67a241d51fe941d1de18d0500d031
SHA256aecd3e7bfb4a1c770567e6291cbda3014dd1b92c2ba577795c938b371c6a5a83
SHA512559ab271b5dd72c1c5e5c9145f2d876da2c1ad112160c51f9ef0fe4962d1f27012f94e83535c8b834348dbf09efe3ea8be60f563947287c02434a0d53c5b46ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5baa0d7f8b53c6518a30c20aef2dde66f
SHA1b3fa904f0c4516ac29724ac6d8f9bacdc8903751
SHA25636bf032775a101941084883f0014d28b3cdabc66d72b0bdb8825dd127a2f7b59
SHA512c3ebe9b2197c9eb41f7c8778604ecb66eae0141b70f95f4f34c983dd6220b00d03e4987d14a286a60488769214d4619873cd49b81c4fbd895c3e7386d9d4d998
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bcf39f7414e94c6ee3fa4f197599452c
SHA19af0bf59e581b57678e5b55f094e9c61df5f2da3
SHA25636691057e017e5e3a93825850990cdf66d5bfee277ae15a95c18b76811e1f252
SHA5126c2674e529800942782c69448682a6f52ee37c1f4fb9637c44396daaa403fcfd1fda0df001d0e084a9d4bd251c18a256b1ad3ec4c31feedc06dc98d657a21eb4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e2cc2cadc74cdd12acc6f6f22aa7b060
SHA1c92ac87f9d437b488fbdd52d426de9a5675178e5
SHA256792157aed4782509d06d542c9509aeca6016ad219b48fa6b4b343a5b5dce5b92
SHA512193d099f404057b57412cf3092ac710e5110a96f7c16bd04ee2145900d1f089f6370be569fae983124d95b0502fd4c2a5d145268628c7962179dcee20368b41d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53dcea17ef6284fa2d5c28a1241ac54a2
SHA1d333102c85385a8de7c76aaf4d5bbb5026e1b2e0
SHA256ecb9aefd7c26e78418b0b01cb960d41458b57349ff543533209c9bdfb911009b
SHA512984684f5ad5fb9980bce98607e6d8c8716013542937d6a2021b8ca0d0c1c21fe0178793421f146bd5da463d5ff9efe9f6ff477a750d843937fb477f3d3cf12ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ee92c38dd6ddcf1ad33934b30720bac6
SHA1a7d513233e5e5be4979480996a2888f10384281d
SHA2561159233812da417b525ab101d09d155b4d76225b10f85e4cb63998f9d6a042f6
SHA51280ed9f5ee2a7823bd3ea934916322fa8496302ef08cb2523912c990e2d8fbf37d19ab9474452f94879f250ce10bb3151ceec9d34b59e13ff180c03ded23dd2f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ec14fe9cd540f1806ecf9d79269b9dd6
SHA1815551ccfcc21803c7c91acead9a411bd321fa47
SHA256b4eda6a632fc897af069acf45524f479b4996a3b84916affe77d44c440b26f4f
SHA512e55e956e86193b80c67f8d8104e05dba207be16eeb13dbaaf85d207f0590d5b6de88d2747b049f308a7732ae4f2b86a7dc2ce427c7d5977b59b5f57de8ce0950
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55a41261427bc446e2c3733deaf4d4eeb
SHA1a750a1259688ef9997c41633e16d85b7d890207a
SHA256c96d344f6f68977f4ce4cfddd9c7825f66742ec6aef48221103c147cde9bddac
SHA512b59a3c425e2c66fe9c60cb84ce7f9fa69d03e3dbc9c251d163477974e6b84af2eee320b7608b1040e983f743a6d837a6bc0012e948da79a909fdc8cdfe7024ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55c060d9b3ea33f0fe3db4678063cca88
SHA1aef9ee4c644445de2d4b96572186e7da861d2182
SHA256df9c599202a57267caa1eeaeb43dab0238f18e56fa9d8e2ea74d9d461bc89482
SHA51277cb4a54e4989f1a1c65f344faf707d97f55dd34fdf8d3e6950215205751fba9a52ac811f08af0c47af17ace2ec82866947722a06d2e6ffd7d0f75c47cdd8579
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54b2d0828d6b5daeeb5cea15f016b5ab5
SHA1c03aa6b413cf1ecb284df2011ebc97f203160b6d
SHA256d781474b71950ba6ac639330193a875ac921381617c7d7d1cb13f77d5597d940
SHA512a51ad6a4b2fb53d7fca7be6bdad3a6fe52bd72895f07cb39bb1c0d5abde8c64bdd8723d4c4818608f9fda478183b79ae04939b09c55c3e1858c562f3bc5e6ebb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD572b46b15366e24bfc912ae918750768f
SHA130227979cc1ba65fa435ae5b9af7456978550978
SHA256a3c4642f2fad5e4a58db3347cc906baaa806b99852209c981f0814d3d6c48ba6
SHA5126e180995e0eef7cf3f502d50ac329e5a2150f94d3573f0ea2ba7d7a83ca988e828ded20682b742f88b04f347dc46f9d969b5a2dc8e14f42058352a87864eccb3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD519abd9e35cec1e9c2221782455066f06
SHA1f3e3fb9a10b098ee02019909da64b3b0bc763b89
SHA25620114dc0463ceecc336e26134e1e77dd248138afca5211589d26a39d9a6020c4
SHA5129b67a0b5d0cc86594be8e3b3da053ca9a43baab2c93a95189bcd7003fce0ab691c2524382629e49df8f22b987f371cfb712f9984213dc3fa431d2af32e7aab72
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58e9d0af11f22c6ab4ad816a4978fc76c
SHA1f18cfab955826bbc3f047e600be5b8f858b9b2f8
SHA256606f4626a92768bc633b55c2a18ddc5b67c8d90f7baf2cb3ea7066bfbd859991
SHA51271a28f4b1411fe7a6cb04c96c7210cc774f7397939abe45c75cc7b00d13484d14de4e57e929c431723c37926febae5d4a6c8efe37c247536980f713cdaf40c22
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a