Analysis
-
max time kernel
117s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
28-05-2024 10:33
Static task
static1
Behavioral task
behavioral1
Sample
7ca5a81e2bace3947d614606973177cd_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
7ca5a81e2bace3947d614606973177cd_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
7ca5a81e2bace3947d614606973177cd_JaffaCakes118.html
-
Size
67KB
-
MD5
7ca5a81e2bace3947d614606973177cd
-
SHA1
3a0a03b1e0b983844dee1ef7dde9a021074dc6a6
-
SHA256
7c2648ac2dd9f7f9d1ab7f219ea15a711b31a869ca9f0af77a32a11df2bc8b1f
-
SHA512
93b7132af8882ff7981410367e42d35cba47ce842fc7307071609521c3a9eb6569b7aae55c8a81f172b4bd9d57d794b24d68ea76c8ed351739e021c09883fce6
-
SSDEEP
768:Ji4gcMsSZ8tN99OIsZcuGoTyfQCZkoTnMdtbBnfBgN8/oygcR/QFVG8c//IjkK5M:JOWWTePec0tbrga6cuNnzIjv
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C791EC11-1CDD-11EF-A4C2-6AD47596CE83} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000de8e5e6668deb9698438192e36d59f4e7ebe12f724d81147f9acb7bebdf52a4b000000000e80000000020000200000009288a3f591b8b44727363b1c694d0504dce04f31893db4c7d2c9f333efbb598690000000c0183bf02b0f298ca3962c1c803ed05646a368ff591df3dd6dceafc6ba2d7b5cfcf6f6502ac6edcf57284e4353eb29d1145c6d895cc5b294e0976de2ac1d3b2a084ffbf37eafa825600956ee8b94f0289d6baaefc66575a404707e4516e6a3b31676a74fdea13663883345fc3d469e89ff3a0845bea3ad17a1e7ee06c5ef4217327c68f911774342cc5ab03563ae32f140000000b29297a2f26644d2330244e7f0fd06db8e03a3c9ef1d5a24314b59680473042a2cba79ffbaa0125259ec6abf22261701bc3987903e637c1fc4860a7c152d8bfa iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000005464bc1708712bd22451d4c71e4d94808302da617b92bdf6a6ed386918a0bf28000000000e8000000002000020000000ace1f8818d64f238c3c56898b8cc71fd5c70de6092a2287551a989156d9fb824200000002de9f12adaf6b3824641b42f2bc5e34d6d8c2d8307bfb54b0bd4e202993cf4c640000000720ce129ac3c9391a21b372ae80448d71dd98f1083f92b8105632994658c0ad6f4bb1b716d4931d089ef01e980d9b97eca421f1a063477e120df37f93880872d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423054300" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0db319ceab0da01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1848 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1848 iexplore.exe 1848 iexplore.exe 2168 IEXPLORE.EXE 2168 IEXPLORE.EXE 2168 IEXPLORE.EXE 2168 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1848 wrote to memory of 2168 1848 iexplore.exe 28 PID 1848 wrote to memory of 2168 1848 iexplore.exe 28 PID 1848 wrote to memory of 2168 1848 iexplore.exe 28 PID 1848 wrote to memory of 2168 1848 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7ca5a81e2bace3947d614606973177cd_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1848 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2168
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c03aba94019876b86ed68b310cbe31a6
SHA1782b3583a092fd0012f2481fcb68d2f76b800fb1
SHA256b2411c4e29d224e2f68055024caa996a54cea08e7df83767b3ed4b96311e615b
SHA5125138eb07d649aa15ac86237164bcd4bee203d4d20549ce868d0314d1adf9511491071f6501b8b5c7d0b2ee81c943a6cc6b6fee32405d79203ec4cc558d819099
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ee405dbac51c3073f9c3dc0972653def
SHA14bba4089e4e0d5cc7d603fec253f4ede18eeec6f
SHA256adaae0e8be18e5773b41ca1ca3f43622eefd2472b347133e73be0d7cd6781aad
SHA512705118ef47adeebea42933acdc4ee99d637beb990affab0565a177bb47dee656d38ffdb04c2dcf5c01ed493ca14b53bcf030d18be890df12a0db4005399a615f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57fce366dff18a71ac79c314f8fe6d3b0
SHA1cab9c904718c5e1f7389c256f6f0c7f4477e737a
SHA256d30dc869d45d9f7511f81cf07d470dc5735871ee8fa1b306a0d8ff415e9854a7
SHA5124e2f238aaa3effb6586eb20a524f327d62b04600df77f5ab39a77920f4158dfeed9d0304a9d3594b7644dd611870cc02da282138de7335178c7f1ae52a2f7619
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5674a8c9cb4a312352f5c560cea20706d
SHA1aecb47292817e65ed3cbc520d4be982bda3522e5
SHA256f45fc38b6188043dc859ae926408fb38b03d3eae6b62a694694608e522514abc
SHA512f465d13feb7a01eed42b9050df494a76be933f1f9d17dad0883fe49c2e70fab713577ccff7e3b64d084e0e697e75bc6962c662c9a1e8e5ccb0f98bce90ff8d5a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a99c6b5e1cda37abe45e885ae293bec9
SHA16a6fbd71631e9d35e7c69ad9cb69cae323b0ce0f
SHA2563b7afcd53a3c5c1e9944fe8ea56c019873917f3450023b329787951e85bfdcbf
SHA512670de0205a55f84df8c6f3eaf988383287fd8620ab37b6e6a34350d062e1bb8c24494e68b5af0e49a3904eaf790415663a4a0b1e30e0e034c968f5feb62e37ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD587558eae4c4f0276f496808fcb6a2330
SHA1fe905df2094ba4232a3431ff471dd4cca35e268a
SHA256bab59815746dfb07433cbf1a4b2b70a57c5e9e2553a14ecb4382633c498d915f
SHA512ff9ea1b3ef8c1662f890fcce541abd94cbbb633187ff9b435486627ed253443224f8e8da32720590390b1a151951501207540ace771043bd7300df7aa5f2aa32
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c98d1d74366f8a973f03cfb8510d51a2
SHA1fb3b4fe928360f1d19dd617f6c74fb6c0d33c397
SHA256510d7806b8b2ede853f8d03b1ef7df48b90f6353b935ce57ce54a940a79292a9
SHA51290189206df669cad74f3400f4e9181dadea0d867c47343fcc6324f76dfb21a2e163e0c11bddb25eed774bd073aa3120b9b4415aeb03566c3e1f6becf894a6b18
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5332c81bd29c9526de5575e2d121e6124
SHA1830df4dce91c5a9db6f58316e884305e872523f5
SHA256cd1e41f61f3aa2c1ab3d5dab4124df42c089e95f99b7dd053cc383e42ab64c7f
SHA512a7fc22958c6c56fb7ecad6eea8fe53e668a41ee9e6cb74b008fb890174b56e1ffc0cf07b54ca746394cf5eeb22d8338773a704d6ecea28c28ddb35a495dbb02d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD501b19928280e11fe86adc172795979c0
SHA1e9f870a8f5bbdc126edaddbb2b04bbcc0a6fb4a0
SHA256f5db722741277c1fac5b582b06264d788314ab15f35be6b841c113f01fdc065d
SHA512e3d3bd83a3ea0c31bc82a3ccc4857e5ba6748f6af118abd8e2549a67339c12637bd61a059e147a9b54fc35b7d26914298d3b8c1688a4f1ff6f2941bcb69064e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD511292915e5d388c8ca984465a75ef4a4
SHA10ce10baf152e53c324ec451789b12e50f7258c2e
SHA256720894cb8082325499c5e65432f653d60d23c7548f535aa75235e7752d78450b
SHA512c528bd441eff1cfc4a0599c4e9a40b5fc255e070544742b98763b889c04958e6208de42c8c2c2ca22714b95e9db084fee7496a5794bc412ab57e8865736c8be6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5710f9bbe3cf5be1debca18c55d49db64
SHA19b969784806fb4ee99cf6776c858fbea0339cb54
SHA2562a3b6b6798412af7b311c2673dff84ca87014e753f7b0fe72e9970a140940a34
SHA5129dbb3fac4486465c2d383dc675dd85405ad9f289b268766b38012b493cd050cbdacfd31ac72b913cce2fb769e2a377370e610b29358312cd93e1f731bd865783
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50886dfa098048759a349d577dd11c56d
SHA143e0dc1683509aa02ff429c7fc20dec75f06aca4
SHA256d37b5f3585b4a969e0cf25eafe19f551cdaa4d5058a683c89748f35c1d5b2505
SHA5127989709911362cc50a0ec0a9bcc934340e8bdb69a8155d6ad6445d8c4cbf9d4f37d4f4d9e56990104a4c2b0d23c2a52a1940e9b07dc1c2d7b2f1dc41753b26dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f82edc34a8c88400682771add2f3d109
SHA18d2ef7e2df89b71e5cc7526d4db884f4147c23a0
SHA256a9ce81c56aa21d4f8b71191fb574d52d5dbf389b4e8cb26be3915fb5d8737df5
SHA512943f01c9556482ad6e9e9a52d6d07a2b69959efb73ad940a885b8adecb23c9ef3787a5e433dba310ff2838e64cc717d22b2981beee848d3e3a47bd0ed3cc9262
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5de7374a546adcf6a7d8582ccd9dee5bc
SHA1f4701c1075d1c55d6eb5ca7d70e3d565e59efc17
SHA2567e56a856eac8b03c7fabfbfd1ce239ef0b8c9ff6d8853b93a70c4af6e75e9ed1
SHA512c8977cd84c2b4647eeb2571f2f666195a0b8bf15fad5ddb2826eab64587f31a13b541f0e55974fabeba472beb1ca538ec6c9e5eb5abb75760d1976ba0c2704b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD566eb8a4e79a364bc86420be09aeb99ff
SHA1b276a4badfeb32b99adafc719a48b814f063c392
SHA256f8df102d2beb4ef5dae773d3a4c234dbf130b1120d8cad6beb8c34f3cf5d307d
SHA512f96ccc74baf9d43735f5fd7b02c45f25c178d5172cb4c2fd6a7df4304ea69e702698b7919d57aa7b3c00374b7a8ce42ef420ed039c57bf48f01ee6f5844d40ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD574b5bbce0878051f647e75a42102b633
SHA1cdd2358cefc671a8cee7af0a87db3f74950a62f1
SHA2561223292e251f0f9a3f32e1ca937a558d8962ffd7720d89223428294f0b810568
SHA51232b72eac4742c13f7ff11fd015632f6420d37f842b17d8bab14d0e27e9102e6f32ec1f1c4d2e769ba309133fb5e478b6497093a435c4794a1180751c1dbee13b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57f820435f73a733f0509ca83b88cc7c3
SHA1d35c9da8aca5e6e6087f0555b5fbc3a6deee0170
SHA256ca237c41ebb017c6bc4be95e521fc469654345d7e4cbb36e83e55543f1006f35
SHA51230e2d9decb9787007b94aa90ee9d7337bf1e9e09e8d9a01a838e03c205c7d7274bb21c3c65035cc86e123ebe3ba88b2524a95ba55097d6b78765c6b483b3bd5a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c45d42e74fe5d5ddb603b92287e8145f
SHA1e06d1e22906c9197caf55d590e11aa2ba2e8d42d
SHA2563f995793b6ef1656065887bf94430387cdf3612c5cf035578140eba921b5714c
SHA51284f974a3577492bea918d09a02bf2ee3d49d31c7c9d9630348b17783dc1ed4580a2978f76495d8cc40a6f2f04ec5e8937249ec3ae136480e93aa3c521c4847df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5debbfee0017047247f3c7fc8599414d8
SHA1b739dc4747d0d6a6145739dafe362f3326271d07
SHA2566533addfc2929bd781969e4d7e9a9034495dc97148082bf80e36acf5c79a12c4
SHA512f82d08935f5a078f4e59e51e3d0f2f9dda134dbbf1d4c83e4e025928472658a83809f4bedbec46641195a9ff662b6ff76923684b0fb1d292019563a62319c5c5
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a