Analysis
-
max time kernel
140s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
28/05/2024, 01:22
Static task
static1
Behavioral task
behavioral1
Sample
7b395fe5957602256079a8be119f2228_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
7b395fe5957602256079a8be119f2228_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
7b395fe5957602256079a8be119f2228_JaffaCakes118.html
-
Size
18KB
-
MD5
7b395fe5957602256079a8be119f2228
-
SHA1
6c0f1eac94967806084e9614991b3f9e25823081
-
SHA256
61b601abd583d5e9a7def89c22201503c41949f8c8680dd4be1176209229e2fa
-
SHA512
5b5c572f3138d2bfea20441f1ddb55fe9e7e82252f375e0b8696ffd07ff4c501f95ec47a7856434255ec45e17e67f080cabea71eb3160025e91c4382999d3fac
-
SSDEEP
384:ziQbKV9isyOVBD8c83RthLBj9RfSmEfP4ycbp50JZTOpuOv:zitXyOgc83zxBhlSmGP4ylJZTOpD
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C723A0E1-1C90-11EF-9B88-D6B84878A518} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000f23e84802607a173c5c8fbf4fad3093dce4ce6736fbb6d15d1a1295a388dd3b8000000000e800000000200002000000058db5bf69229f3437737ed24eb7cce81b09fb34aa7f24455035d8deaf24eb84b900000008d40689ef83ece02b0299eb130a6d072e951075618d2d261b4093311eecab6dc0636ca2eecb10f2be5c39feb1f3a12d0e0075f463fb853ce5306b6f5ffab9541278378f6058323ffe744d360b9f2715e5a47cb173da9b3ec649f197d0a84a705f856154c755df31c2571e8e0d1220008cb017d4ae3d705e3a85a5c49905c17dc6475b81a650cfbb450c7cb2f1c7b5bb84000000067dc875412eeefde67175a3d85a7f6510ad6cb40e2c33a302f08d9b34162bd2aae896d3e9f6f9ed08f5dc25922964e875a7365d4976a1244b66366266894267e iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 106fd39b9db0da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000008dbd762ba9810c17c2a13ddf6865311bf6dc6882632974318036f272e4b604a5000000000e800000000200002000000023051064a93a9448a2013420b47a4a7984da91cb1b0a7f7ffeffaa72d59b27ba20000000cdf42fe14e76edcc5f579631391e8ee206cca30ca0c8444822703fa78d64ddcc400000004aeb1b159c31cf839ae24592cd2808a2745d0ae3df91c176a187b05acf4b6a23a89d3750b7a3e3d861f766d1d98f86dafc45211c4482ae2292128bffd77e8a03 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423021233" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 788 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 788 iexplore.exe 788 iexplore.exe 2272 IEXPLORE.EXE 2272 IEXPLORE.EXE 2272 IEXPLORE.EXE 2272 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 788 wrote to memory of 2272 788 iexplore.exe 28 PID 788 wrote to memory of 2272 788 iexplore.exe 28 PID 788 wrote to memory of 2272 788 iexplore.exe 28 PID 788 wrote to memory of 2272 788 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7b395fe5957602256079a8be119f2228_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:788 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:788 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2272
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52ae9a60b8dbb7912bb572ead6586e431
SHA1627372f7868bcf1c0877006b3393be83557bdf2d
SHA25632bb1df83f267a9e4bd41868394f9b9de2227f9ffa1541808d8048a780506060
SHA5122f6db0dfafd0527b92c7c413990a0548e1b037a56d9f75af933f57bd3c0834e8cadfd42c873694e88137d8354081ce74009bb1378f6aa81ad98a37789cd4d887
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51c49723d4f6c796f7bc26128b42c427d
SHA1ad898e4b7f67e3374e77d388516e08728f2305b4
SHA25672f9344c1218a214822ef1fb60a786715337214df10e41bb634dcf8e160936d8
SHA5127fd428800b16edca6e0e1ffc53cd9b8776cde5f6709e1175876e2d1bcd48185e201098814b007c4be3249a6dbf2748a47bc27fbf9bd547df9cca30201fc46e45
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aa30b9c448155337cef8cf0bdd8be0a5
SHA1667adf453f03a8862d6a2a7967e5c1a4a3e1f3ff
SHA2563871c734de882f8f6a63f6671293ad660cdd6d45f9ccbb56c7d67fe37b9f8e27
SHA51247b7b9c80d4b7446cfb4fe7a7675a2d95ecce0036d582af8f231bbcb52961f825779c6062aa74b69a039f70df2216d9dd27bb3863340bb180d7657d8e5b7a725
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD573a00f099fd746d64f555f7f186aabba
SHA123e1d16ed631472b1e93ebaebad99d431903974e
SHA2569001c3d2cd7204789e459cd4132f5e4ee061f7e78aaa2bb0e86dda71c3cef620
SHA512ec5bafb167759a1dd7c41f10341ebd974b9719ca5ff3ea0d278285ba35ea1078f2130801feb0d61824ed64507353b654567b822c48a15bc11960a9912b5fb051
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eb676416876ac39821c0d96019ec3953
SHA14b3ddc101b8e9a1b1a3115e22d66d20d3321e715
SHA2566a2c741ac32f9ae2640908e741f16db774da5a0b5c84a983eaadf085d7d32a18
SHA512ac071d2975385c1ebcedc3289d194002b5d156d96a343f2555693844f87f71512a82425d7b40d8ad9fb91807bc53cabe1e6689577ba69d5e6dc9e9c77a3a7971
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b9d8335dd377e253b1f0f42aeb60cd06
SHA19e5803d2be5166e5d929b32c0d992aed34e0eb3d
SHA256d85c30aa6d88d41432438051fe771d69ee60f40cc1122ebd2cecf30fd68ae83e
SHA5123c1388ac2e09f1d076d11735fe1375dae7fecdc3cb0c34f12330b7b0411e0584f72d46e118b80d532e0262d418f45e5336a23530c37e4ad6ef7ba867fc807eee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55887536d4075cf40b8ea7dd1a8f7c701
SHA16f383cf43e61b7b0cb616f6efb7d0b1b3d58fdf4
SHA256ceef775ee4b25e605aa67d9095ddcda26724e7126386d85585f4bbc9aa52b937
SHA51281f97c230e5d738d71ca1655dd6517ba39ed354cb7ce5e1cacd23acbdcf50c7155fedc6aab5db7fd7c143886dc170758309df038a87567703a5a8f73fc269fe4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD597fb55f1d03730e2f659a5a858b6895b
SHA1a6ca4656e75096a4e58b8e759f0137e7e26cbf5d
SHA256cefa4bbd0eb4368657d49cf10a121cb89eb5de0216a8b918d75f2d0ff4bb3837
SHA512e003a48a98f93d319baccc58444d96f6d8e65618999dde894cc37ff907cbbb84751228b278d8a7bf1ac53c704daac166da7fb231f97bb2324f1c679721937f79
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51a6dd6e124a5bbb841934820cadcc6cd
SHA1a033606113e16923b820f01710462b37ec7ad225
SHA2562d7d11c8055c5ab7984d7911fa7ae36293847a99f1404201af6098666ec2287a
SHA51297150712fd676da0ced993da7c4c6c8eac076122a0b2f1bd126985d6e8aae5034bee85070a7c0e7c0419723c2ccdee18a052ae642e2dbd3bdab37209647092de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ed52b700cc1b873b645a80b2264056e2
SHA1646ba734cb8cc299e73d844288ee95d4ec8c2660
SHA25619c6941d41b4e3dea63f56c8d593c99fb1d35eae9c22a9ea02256278d791343a
SHA512602ccd6734e22cc2c4d276f174a99cab5407cb4498304238489653867e9d29daaa069b358354be49573e729004e5d7b00877dd05a692cf24f600bc2e14ad6e60
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59b1c439dcee24c5c312bd7099abf7221
SHA17b3013d4191fc5047811fab6cf3d641609a8b261
SHA256aaa17281ad7430d5f3bb2d6b83199913b7b532cc6644a8d70d75db496be4c4b6
SHA5128ebc758ea630d13e55ef236a482c4c1f6eb0849d841186da7c4bfc6901bc974e0b504b92f6cb66b7271fc82523b1cb25a13b0b996fcdfe712a9e04246c085d98
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c93c675ac619f99603a2fa0198e51b96
SHA17de15883cf4122d86a7aa6c17afc5129564091b9
SHA256bfb4babb2cb167c6452aae8a920b3e7d4d9179b5f66600586c4a75a043b1646c
SHA5127f409fd653f338b9098b27e84fc54e0c48c3c8fbb8d21ae2ace9ad9cee9df7d3b8ba7c38ea9a556b5128fbe5dca79764fd539f54fd3213a03f94377883257fce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD518ef20469cf9872f08f0106c49c54715
SHA1c21213167ff5b2afcacecd2e2c09530412daf84c
SHA2567938651679fe0fbbc460407bcfb9a6a288ca2ad3c9ff2ffe29389a57f0c12b3c
SHA5123602447cc36db07219d7afbaffdadd65448a71179bedc186e6abf14083a90fb8beadb0cc18aa96ff143502009c3ec9ac8d9980a2b24bb2f9f2809c3124078a8b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56944681349ee91f53b20ad1a1db9f0ab
SHA13151a7d47940e7c43d1d459e64f7582ab31d11b1
SHA256c257bcafc0ec094685cc5b2b47b2672a16fc42910babbf0a1ef48b96f7da17e1
SHA5123e230baef89c35748c80fd8962ff0f9c0019d88ad7a0086dc76759b5f4dc3d50fbf3597ca8dc55d838a69f08bdf24ff077dfe2e43c329a7d85c01ee131d03c19
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dc1265a4fedb8321af3db6328ea1b608
SHA1032c24fde37bf0c22aa7f3271870df8f0dabc370
SHA256bc8dd7fcd86c6a598abc5fbd91ef4098f8915e825200118223f5e93b1d7bee03
SHA512094a3c3f4b55f74b1fd185a00dedec1a123f91994cd9aae97de5da0d15efa02855ff6c838a4aa48ecc576d18c7610c0d4d83fdb11e2fbb88933eaa3133294cc2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD516715a515265dd8ca298153ee1a8be9e
SHA14578b17c3fd9241e042da0c54a11a8a3648af5cc
SHA25690c6fb9157e1398bf144d9ed7887be988f24eae510eb2b81e00c24610e5336d6
SHA512cc3e6ac282a68ab28c38aba77d20b38412fda21d1ea548c0f995abb084a970c205554f4057bd4cd986b622d86cecb621a4d6e1fd69eb12612bc269adafd1e9b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b95f151238e526117abf5b96b51c7b52
SHA17c8b11660ac718f0916960e0a8ad9d82578c1635
SHA25629737f8f246419eb07b3471de691bd1e026947639e2b90307ab7ec75c3e68b9d
SHA5127dc5e54203ca51e23b0faccc6cb0811b67628607652b33d9ecb68f7e0de85d7605beeb29c83f10a6e43a145c429af68f739419d049cad0979b3926694fdd01ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58ea398f6662f02e0482caf56faa1af7e
SHA1f2de0796be9d8ac6de4072d367af7a685c4a061b
SHA256697eda745b2e9d5ed12b1fb0ea45bc2ac03fc9d71973901ba38cd5f4faebe5b6
SHA512da9e5c681929a5a9a2c95ace6a76befb38b31e74cb029c89892e6842a39fb35a96189d3bba564722a9b5c8be3c78a9a04cbc3d8e6c659d31994d7993a3adbed6
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a