Analysis
-
max time kernel
117s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28/05/2024, 12:04
Static task
static1
Behavioral task
behavioral1
Sample
7ce20245771d5f3800c15a19f181b829_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7ce20245771d5f3800c15a19f181b829_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
7ce20245771d5f3800c15a19f181b829_JaffaCakes118.html
-
Size
68KB
-
MD5
7ce20245771d5f3800c15a19f181b829
-
SHA1
89b4ddbe355d6f2f9a4082c206c7da6bd74485b5
-
SHA256
38e0d8c0cbf334860a9cf043df46d524c99919b35a36db39798dbfd7a0c10fb4
-
SHA512
b4783c427e05b944c9a0bf26c0c83f3697170b410d94d614ed36c074bc23afa1d061b451d729c7b3aea65eaf8fd363700fcef2134522094ce5dfe2f351ec6bd5
-
SSDEEP
768:Ji5gcMiR3sI2PDDnX0g6ojkvLCr1wtCvPhoTyv1wCZkoTyMdtbBnfBgN8/lboi2h:JtvYLr42TcNen0tbrga94hcuNnQC
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6012f41ffbb0da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4ACE4911-1CEE-11EF-9201-6EAD7206CC74} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000012d30b96c2718c4c8bcc8132f813a67f0000000002000000000010660000000100002000000058e5ad64da8cafbb08bf70521d1df686875a13b7549b8dfe6ad7d6caaa1fb3f8000000000e8000000002000020000000f0a518509d1774de67878af497ac0eff93c7595d5cf73d2e6b1e154199df747b20000000060a4967d7f8ff8ce4abd771d3ca43a7dd4911addf74d67083b7881889b8129040000000097565a26b515661d8d749b06c12481cff1e19afc7c0a0dbb9468b1374f91e8a7ba46d6bddbe4700a0d47125c95786e3fb6fc5b51ed741db3cc652b0585691d0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423061394" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000012d30b96c2718c4c8bcc8132f813a67f000000000200000000001066000000010000200000002a1044367b96e17217c80ad34243340753747abd02214d95814ef1c84b4e2605000000000e800000000200002000000007d1816722afd4f7ea866e6c9a8928ec8334b1e9464fff844465236c4bd0bced900000006eff081b629aeebb8a0b689534cea43c55f4037ffbe7c43a967c202e0736d4af112f5875d0149b923641181852262a8649796bad89e4084f6b6ac35f0d6fc53a376397b4950e37c8f9827b0fa9e2a5980831f386790e5dede1819df1e25d0f4267177052edb1ee41ff30cfe723d26dcca992e50ab76a3170960da278a6252ce3b5c6e0a86ce4e1901816631032cbbdcc400000001c2447e194133f2a96017680847f08c2c60ba1bcf166d8eea3bb04cd4bc700062f9a54820404c51466acbe4f7da20d7c48ed0fc6ff3abacf92d89bbbb259c238 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2484 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2484 iexplore.exe 2484 iexplore.exe 3016 IEXPLORE.EXE 3016 IEXPLORE.EXE 3016 IEXPLORE.EXE 3016 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2484 wrote to memory of 3016 2484 iexplore.exe 28 PID 2484 wrote to memory of 3016 2484 iexplore.exe 28 PID 2484 wrote to memory of 3016 2484 iexplore.exe 28 PID 2484 wrote to memory of 3016 2484 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7ce20245771d5f3800c15a19f181b829_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2484 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3016
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD536957cac072a19929cb0126cd2d48d3e
SHA13db5ef519f7b39ee0ba798d53a7861353b37f084
SHA256c1ea416cda1d7a67807b2617dee200e159b930c901022bb73ca0a5a9b8d83e37
SHA51261ac7d6804d92907a82231503124806494facbe746460dbe24eef15864e791432a025e5553a5492fb025970aecccafee776c1d65569f2ff3ac1c6e647fc3f251
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD587f0bd7378e2dc539635d5f18d48b0cb
SHA11a66e3bcfd027e27e8f9dab1197827774783ec34
SHA256c81af21f1492bcd15e58c7dc5ffb9fcf5ea0cdc42d61c6befa2507adafbe9c19
SHA512f472f42aa8989565c714003cdea002adea4cf4da9fb643358d5c04d8439ea31127781eaa01a951e57ada8dea13661efdbd96a801f646a7a42c7c67326412269b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b35af41b585a3375f1342371dbe9f674
SHA19eaed4f073971e738506fe8bf5597e3197fe64c4
SHA256d765b9db8f6d6c1d487de88497b08b69fe9e0f6392fa6f22090708bd4c0d12e8
SHA51223940b68fc7120ba9a0304a9835bf324afbc66ff5e8c98fb45966d1959f54b0d9495eb3fce35203dfc8a2f01ed4380a5ac6c121b3bea03c8d20ee45ca2bee0a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD567ec8fdf500a925fee8199d0b3b37715
SHA1f0c9a94bace5cf1fea1013216c3dffb1c5b2375b
SHA256220721dcd20fa46a8c19d79f18625fdfd2a8c653397400e749547e7a436f0104
SHA512bf7852aac1c6f3a49c76449b2cd8c610531c39a2a954c3d6ce59776e7e05e6a6bd0da9d27cab426edc25b66f4c2d1f16b7e3da2fdb3aab368bba0e2495389200
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57111573dc6b37777b26ac1d68a43064c
SHA19049522c7d60558340bf81c5aa6c55b2fbd6d799
SHA256aa16f301178110442e22511fe3cd3bba0946e9fe66ea9051bc101a5015a3ea9b
SHA51293ad6087307b6ec3157b5c856032b6de75655d48c9311224f60ea5de91f83337b8be5d11751e9bf13f8a6fba663e2c36c296c8736a339577deb62aac26f6f220
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5090a52704d46c4c1314b904867170877
SHA18bccc952a42805c38c2d8184cfdaa17d809b0e04
SHA256cb2c3ffa2f8e73b456956356b74cc8458a0a766ca616403c9375e0fa88d26dd6
SHA51240652d24ef72ffcb086b5f4fc83a3d7edfeca22f3ce1ff1b09ce82c5fb3f4bceca3f28da2c1a2c9db85690a5aa27ea7742986489ff501326626830bef6dc7d79
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5792be7f53535a23dae875bf70e3f3b0a
SHA18eaae195978f19f47fcfcfb349b62dac74ba6101
SHA25674b8c0c8643b5c798c2205dbc938b5fa9f4936b4c123a41efd646e000bb7e19f
SHA51249e02e29bd96ee7742a7d8effc8e30818355fa61f45dbb3ba963dddb99e80568ee91e309f47b4caac1659ae6554e74057254867b50c9794f7dfec48590b46080
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59fd46671b2906ef3b49acdc13eda3542
SHA1ae8c64f349ffaf4d82bf89db7de44905f152fc33
SHA2569da15558d8218afdfca64bc901cef1571d52e7ce3d797b100904fbf1d0417da1
SHA5127ea3240214ef612fb95c03089e03d669349b14f7c9afc7ea341539643485f058e1a7e1181eb073db1a4739dc8eb1d81d73db465e21ed7a2e1da54143947155f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58b4eb9be9d665d6b67212558358d595f
SHA1c01cce59f80af7f4c707e798f51d7c0d0618fd5e
SHA25683a6106386fc96c7fb96dc0640fd9043f20eeb69527647e710c18d4070aa76af
SHA512d62a94bcf39f5b33e9be0e0554dd6ce71ab9dee7e4c193432af7f588195ff5b8845abf758db6c6ab61ed81bc6bbf916d421fb46576cfc4f1e779ffce763cac88
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5048935f79d65f1d0d579b152326ac57b
SHA1486eb116c1204bc95f99255dbb159e4c0c281a98
SHA256773247925c049f4d9d94ba0dd61e888096cd25cdca7339eee8c1695162f29b09
SHA51275fe82dab5796fc3cea75d577943c5cc06cadc00affbf1e573f6bc980a0425c990e9d8a8dd46fd17480e999912bacff12a908cb562fbb9a6c32f2facd101d82b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a99c4dd9a7e6c42110b01a61d1544487
SHA1e548b9e48bf4d341d83bf7c9052753c4fea66376
SHA256e7fa8c6fad392c34eefd56c76bd8d5d1b97fea1be6a55a29a68d25c304407074
SHA512f19a777b77a7e2b6c32979f875198a5d98adc9d10f79a5874cf9c9f5c1bbd5479d55df17363162eda749eb5d134a06389897bf890e933183c28bf40e2d12d562
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c6e0f887873949c8ce9fca99c26f7a4a
SHA17443c4a21098edc9ad09983b5bbb118c1538685c
SHA2566fb9f162f51a177436ae786e4aec8c3326eac59590be37283e409cc69a63c60f
SHA512a89b937bb7d23195897d989f0b7e8c2a957d49cd58beb41a16c103959db4a5c77d4fb1b910297f82a38ae6cec839e10cc339d1a6f2c6de43698aeae9f3eeb9eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD503af798a6b3dd2890680745143811fe0
SHA1097747ee822aaa887bf39951f86969465fd0ac99
SHA256328a5513600554ce6ebfbd77c6473a7b465d16a42f811ce82678e6cb3459dd8f
SHA51264c9920f36d6802100c0cb849079df77c50c3ce3a3a4118941dbbec811cb349c8247c12ee96886b4823618fff3e7af71f635f9570c27016965070a3b408c36a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59b4639f2f92c8bf26bba1c0aacdff128
SHA1955ddfe7c752fd063fee285b2c8aa32992ce3407
SHA256079cc34f4050ade61161b18ec6d2f9a6d258fbe8bd1d87b7e64575aa4158841b
SHA5121aa5565ef663c56e85c7e24d04710d7b9e882ab2b4d484eaad88188fc776d2b2c568a9732ce6a5926f9913828f8537d879be967ee82b4bdb3a842a9da31cacae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD569e8a231d802188356866943c8b1767b
SHA1bd1105fdf57f9724e7296db6797f9830b547d950
SHA256b4be5399b0b8b038c07f48a17fed9e175da127884fec9890db25699e059efb07
SHA5127fe4c809c475db26e610f1d87b9dd693193f8f81d73d5674e6bab8953d35e0287f07b5e3a616784ff0129cb1161bca9a4410b1dd8bfec9b061765a40c5cdfff7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5edff92e3ed0a885d7998fc30c3da03dc
SHA17ac8d6695c31a0fd80f97dcaa20967a4140c0dda
SHA256308c66b40e2aca791614d0375479c80a9387678271edf035272ffb68e8964feb
SHA51286c993243789a9b344f47df9987958ff3a8c4b792e3ec0447a9fff2015fa4d649c6cd83aac60ab1ee2051240f103e225de3e4987de202c307294b9d7ea339567
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b0f89e9ce3bd25f9e7f79861eda80754
SHA1cc83d910cf37b208450d9caefc009d51cf65ba61
SHA256710d6b46ec10c444e7371a391c9ee047923216aaeba34a8b0f49757edbbb082c
SHA512ec7a02843be4fdccacf9a9be895631202556919519b7d85adbea4b4ae4356b7b244d08cbdf8caae0bbc0ac9e6063a2702813db4c1ecd8ecee26c33393aa7600c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53b0c870162258a0b716780fe5fd57820
SHA18d8080aba24a4c64daf787e39dce1668fdcee468
SHA256e45e10025092d282f177b4cbf4c40cc6e113a23f79a12ea6dec9aa088ce77c80
SHA5128b19f3fce11441d58e13fe3ea2be0f5e1b5ec80868967e41303a2f967b4775a41c5c921fca86918200ce65be8161f484b446a0653df1f20cdf9b6d71cd155769
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a