Analysis
-
max time kernel
139s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
28/05/2024, 14:19
Static task
static1
Behavioral task
behavioral1
Sample
7d4572663aad22408c5259dede6d2beb_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
7d4572663aad22408c5259dede6d2beb_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
7d4572663aad22408c5259dede6d2beb_JaffaCakes118.html
-
Size
67KB
-
MD5
7d4572663aad22408c5259dede6d2beb
-
SHA1
0fcf35afe820055b2f2582229fcb81ad2ae5b924
-
SHA256
4fab6610eed0dbd2d323436cbb251fcac091d7b71fe3b88677d55cdb2dab68fe
-
SHA512
56388f17516bb0f5aacd114e00bdec4aa3cf7168bd9e0be210b1daab4d87048ab41d6f0df57e5c512e4425dd991e13f92f1ffeea8678cc77c4edd70952ec2466
-
SSDEEP
768:JioXgcMiR3sI2PDDnX0g6RJrzoTyJewCZkoTyMdtbBnfBgN8/lboi2hcpQFVG8sM:JglTk0en0tbrga94hcuNnQC
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b619a48ce66d8a4a94c2528c512a19860000000002000000000010660000000100002000000043f2573667fc9a7c69f6647a8e8e745b56448a03c891b187b94a91601efc53b9000000000e800000000200002000000017b595af512c9ef7f443facdb78008714387d892918b682102416f67fd43ec2390000000ffb0c783b2e8b4e40c25381757d3f1fe40a3cb5c93a12087f09a9b2f5ae4f28ea068acb5298c635ffa4cb76da89a3cb4d9597762ae342cca67f188a886d723a43a98e32c705c53ef21a5406d5ac639c46ff574325d3be32df44b58ed1c6316c61f9b1f06e3eb35d0b40445606fa1fcbe1ce429c9432c0f268bb3efdafce3e0eabd1eba3a89e075e18923fd75553eda744000000047e3a9d74be1c686a4ca199b25c2e292557b091a84484a8ce4c931ed2af4704aaa2c0fa03eb9c32d0a7cd8eb3643205dd024ccdb5486445ee9a077fc84f4eead iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{59ED99F1-1CFD-11EF-AAE3-FED1941498E6} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0d5b72e0ab1da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423067861" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b619a48ce66d8a4a94c2528c512a19860000000002000000000010660000000100002000000000e25f59f968cecd8bf42ce045159d6d7e86ecae2b3552fb22a13c3021bcc1d4000000000e80000000020000200000004229d1c4bc1d642ef1b97ed76b09bfa5a1f0a12eff8ebda43aa0aad22941c35d20000000090dfdaf9893c835a9e758d331e317b806a877ff80cac2f8f3fa239ec660e16240000000b090cd37aca5fbde4cf61de4b2398e62e7da267321072319d2e6b3b7af05ade70593f5a0bcf1519fe51102a0a18968be04be4443653ea934390323bba7a68985 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2108 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2108 iexplore.exe 2108 iexplore.exe 2456 IEXPLORE.EXE 2456 IEXPLORE.EXE 2456 IEXPLORE.EXE 2456 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2108 wrote to memory of 2456 2108 iexplore.exe 28 PID 2108 wrote to memory of 2456 2108 iexplore.exe 28 PID 2108 wrote to memory of 2456 2108 iexplore.exe 28 PID 2108 wrote to memory of 2456 2108 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7d4572663aad22408c5259dede6d2beb_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2108 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2456
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e954a57ecd4ca7ad4f29fb2f996d2626
SHA11a6b60b20afc82168c2977e7d2a12d220cbdc02e
SHA25650c20b6d1aaaafe8ea7598c259a74251e653e28db87029f489bf46a1a9a916f2
SHA512700742ae2117a30cc3f160691fd1beeca6235b8aba6b3926100536c6267a82debb8ca054f08a9989ab81441ee7d93238dadc8598bb799330157712f4bcab6652
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54b6013f0faef7de32c5757cd5bfcf460
SHA1567f368acbe07d05286e59ce8f4e2394e498ac46
SHA2562ded74abbc273cf6a7e8605b3948e6d148f09560ea16256ce7c7f8abfff3fd26
SHA5127c03bcc2872d1d43675b6f0ddba20d79cbcdf277ec4802538139a642934c738933de0e7b79ec1e34f95f142699e2015528dc2909bf2c4a3bd3731c15ffdada2d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50e011cdda0805ada227e06c70c7d2273
SHA157eebbad487d3f742f44a0c12fc2370840c235f1
SHA256964ab6d662a24b1717eefed152a7028eb6e07d4c6e64f7d0082d4f92178ddf33
SHA512427d1e7950d6da39e8f2b25e590da02f0af33787470add902def1de6433a455b77e92ee4e5ec4fe356c34cf99de1f94cdbcefe8b7660983707e7606bf94a7c37
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD596828cabe2c71e84b5b88543176d2d0f
SHA1d40bad9f146d923bc72a005bad1f262824b3296e
SHA25685c1a9ae5a8fcb766e7edee1478a8f082e89779b6fce9983858f9677a9b2fc1f
SHA51262498081a0ac01e0288d3c58c941ebfcea4454b2cec74deaf9399fb22257d7692618fdee6e77918466ba2e05beb8d31cc22b7846143d0575d223b8c6d46ad0b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD573c6ff9f94556f5c5a3224ffad42d11c
SHA18e7743f43bbac392bc689240a71ad791f8e1286d
SHA2560e1ab228c7ef6ae859dc3d10c8111944298c6554c6d13ee432e792d65b04514a
SHA5125f7cfba7f9e4fcbe67eda3bbb696e2474817005ade1332c273be2b114df479456276ffd5813ae0a6bcbb9106f88f9189bf9cce59d1a33073ccdc731e49a88691
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5773dae1950f20eaf762316f6f02592ba
SHA1f99f0e1afdf3f491de7a9e50f12dc7efcf0aab26
SHA2561138e530aca2c6fbee5594d789e2fd8df32c5443b4c94888cebc94437b1698c3
SHA51207e3beb34c6941315632962cb047279b4c66d4dbd725bd45b657e148c5969898c728fc4f179e39dd7f431b7749fcf3dd459857ed1224e028b10505fa692f4a88
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d661f9b50b86a099d067c0267d69c4ff
SHA1321ee6ceeabeea0ed24d95a0f28d76a94b7389f8
SHA256ec6b4a4d69b96ce7e8e7af2ffad572df0d40ef63d3512e4d249c4b5b9abb59e9
SHA5128a49d33be8def0f702fa9ae217f84fa72036b9a786c0809a6b8934089ab8e08242b26b6f7b5adc113b6cf14bdf72d0a7ba62f6ccff600fd188c46ea3af209b57
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d076db3a1e643040874b4b6e05d23c4d
SHA10ff03a1fd38da979f65aaeb48ceba20ffbe67bf9
SHA256e1aa406007950c065bb3470c66f74a408b8c2a76a1af44135394e5b890a88dbb
SHA512a391efe60e88a891d83374015680f4a19d988cb88e4861777c4bcc863ed647e8de8bb8180e6f1e160a641a235067804e34969f1bfa2281c439f88568994e498e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD584348c1552a79ed32592df59c2921929
SHA186bb4418b7faa9ecf48b936b689768acac1eff1b
SHA256ea091f4fe93c0fd997a31d2c4035d9745d8d59bdf04893c411707d4782a8d269
SHA512a3041ef091b0f3e423ab077852b63f66baf5187e8ba30139321643a73dcbaea765efaf8bcafa6006b03a5e68b50611639f87abba15afa68fc55ade25cb0185bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD586751490d11120614179645bc934039b
SHA1062a287214ca75731398557b0f6396e4056beb2b
SHA256f550cb0f415b9d2b8d3defe1c6dbfbc3d0f0554a3486b7085f3bd475e6c6d31c
SHA5129e3da47c4e0291016ef32fc4565e701525439010939a5a06dee5d7ef8ceb06302afc887a79ca495af47e70a1cb39b12d023862681673bde8c424dfd297f0d0db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD517a67c801e4c33ba4212715cb91a6476
SHA101825c4a64f4bdb7e5467b39392f66e886c13266
SHA256083f446ad6dcb4618676c32307e6236a7dd696cd3dfe1cd189ef0401c939aad7
SHA512caa9705ddcaa27944d6558c04506d6270bcfb806bedbd69cccc10400fcb2b1ce4731b18ebc6961ca58c596343d8a843d49702e1b3b6c8b654be0f030e53f8ba7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f157e235827d40b295cde220364484e2
SHA1b471df15d2a41ca57b845f3b68c7c6a900024a4e
SHA256d1d952fc1a3906c8ee13030eb3cc997262b88436b01edeafb58679c20099a9dd
SHA51259a7d5da7320e5f6b61ebfd7190545d129b8ec61f054b9ef752fc12c3103da4c85de434f9fa89e2883c692ad45c3aee210416cac6482bfdd9501d785d6e057c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51360301158e35b70457fcdb71f7aa161
SHA1cf332a18716d5c75f51159ce3431d9419bc1fdbc
SHA256cd960397ab324657ec6c1cd135a71fd5a75e98ad73e1711deb9b98ca57c876b2
SHA5120ed59fa7bc53ee2a3edb52ae1108451efb51d8e376b5208fe1ab43723a36d970bd8b7794db27a6a51b060fca5fbc4ead9809bbdfc90fb8ed5063d7711f2fb592
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD516e48a1b428e8e49ee8a10e4cc48eff9
SHA1b780b9715f07b3ef56d16cbbb68b92a503496e33
SHA256794a804a95b1d386f94376eeb672d6b751a5d3e4c47faea03daec7de5c391d7a
SHA512dd8b56b749d8a09966e3cbd0704f0dc9c15d050af7fa26865b284672fa50c0d6666aeedaccd4d90b9a1d58568c84e3d0c4460e809121466bcf2a1aff80ab06dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d4a8a90d6f820766bb7e4d6d123d9cb0
SHA1a603d6d303068cfb251b458f437231c1a6f3fc16
SHA25647b26bce7841a6f5c5aff6b5b418d430962d36ea8f8e4abd380753ba7340eb07
SHA51297c552930758ef95434482d97747548754130a348773fc93f22fb146950dac773804806b68b25cebcca0e1b19d88e0508377c00e321c0e4a40435575b10d71e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5483ea1469bc5510be438a2f171b53111
SHA1e06384617281a4b71b2836dba1dc091c77cc77ed
SHA25646fb8d215f9d39a71bff8b47c0cd73ead2db4b712a2178eb95fa1a35931553bd
SHA5120f61385106f9f166c7b5d5c25243146aa2417d3ca9e266e7fd4bd550091a301a7f89cb8449d655787b41d221a23eea9a33f18f09d54c32edba3d8b18f7811de4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52caa9823dc0e7653a678ff2fe092277b
SHA1616d5094743069effc8745f409a2b7b668fa3eea
SHA2568645d6b50fcacf4f2a489a61549a70a1f503f499bbdb3f00e63362d8b8411dad
SHA51248a010252480d3907de87e0205ca5a262d05bd515950a4eb905793d64f9ac78c827ff2b137cdae35af582a548e6227d282291054bc0259e524f1e904721beab9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ad2ce046bbc562ee90684e7d34852e53
SHA1c69685331ddf30666ddc2e91ae4c5787b848a3f8
SHA2562efb599676d9ce04030673816e5077bc919321d2f4c7be331bc70722cae7f827
SHA5126f055d0fd4a2c82e3374421125e798debbacfc62b77f6f8a906a736e3427e3b260262a85a9cf0fde79db59cacdcb8ba76923e1dbcb384730ef3240b05cab4cc7
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a