Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29-05-2024 21:47
Static task
static1
Behavioral task
behavioral1
Sample
820c0a34522837fa7322df917dec1f6b_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
820c0a34522837fa7322df917dec1f6b_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
820c0a34522837fa7322df917dec1f6b_JaffaCakes118.html
-
Size
461KB
-
MD5
820c0a34522837fa7322df917dec1f6b
-
SHA1
f1e6aabdac1ad7091f2a45f89b3cf1f97813b497
-
SHA256
95963e3970359855e0e08764fe608601dfcb7eeb9ea1a8176f655fd8be2deb5b
-
SHA512
15d80c4fe3716374bb53bf05220e910d7891ca74c1bf6c1035dd80fb97486a16b5a3a3c21f8b82e735c767e3cd6087bec941c96f51f1de2227098daee3b25d22
-
SSDEEP
6144:SysMYod+X3oI+YfsMYod+X3oI+YDsMYod+X3oI+YLsMYod+X3oI+YQ:d5d+X3F5d+X3V5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0BCF3F41-1E05-11EF-83FC-5267BFD3BAD1} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10fa57e411b2da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ec489e43473a244b9ee1c1a82d01181000000000020000000000106600000001000020000000359e85a8ce2dbf109dd7059e59712a8cb4814fd747c77e5f86cbbe3bfac873b0000000000e80000000020000200000002959e8d085b70a4f9fd7448880b7447c5026d0409049a0b1abe6ed2e8370f9b92000000013fb4f04f2aefbe9fcbe19650863478c6923e137ae88bc160917e3b0bf3ede944000000013ff8946101c27d1b8c5fdce75a52f04afbf6f276a9ef99a8663037f6f84b0e9672ffe47a6e55c6cd4f17fff9dd9b985d1129ea15820a5e51728f3a17b8fbb7e iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ec489e43473a244b9ee1c1a82d011810000000000200000000001066000000010000200000008cfc3b61348f2e81f92e0b441dbdde0ad62fbbd58479ece99fdb01fb9d3d1c5c000000000e80000000020000200000003e2133ac0ce63669e816d2818611aa584f0363b476aac7abe657cb21981aaea190000000112f2beca23c8edfc9b426331de7b71f7d6636db4a8171880a0fac63f7fd9ffa6e18484a415d5e01bd6a92bbac19255fc8ab643fac79c257573f2ba323731d72b73ecc14c000085ca457f08ca64d35a6bfb819da4718380b20d819b8c417b002c317e7d3c88e35fb737bbb5f541c1a7d328131a69dc59c5e33107c6527809b89f5ba91941c6f5b94d528ead8f8b6395340000000107cd80016c55b49328cfb8ad0cd96b7307c78801927ebdbc31121c396d5a650a8b9ca6fd481321d4f8c10127b514f68850c83fac2fa52fe870bbfbd8cf10e51 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423181116" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1964 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1964 iexplore.exe 1964 iexplore.exe 2224 IEXPLORE.EXE 2224 IEXPLORE.EXE 2224 IEXPLORE.EXE 2224 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1964 wrote to memory of 2224 1964 iexplore.exe 28 PID 1964 wrote to memory of 2224 1964 iexplore.exe 28 PID 1964 wrote to memory of 2224 1964 iexplore.exe 28 PID 1964 wrote to memory of 2224 1964 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\820c0a34522837fa7322df917dec1f6b_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1964 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2224
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59f8d1e70a645f2e516b2ccb1f17aabc0
SHA143f40f5ed490a439db81bdd181713479cbfddcb1
SHA256b4b9bb7d49b1bb13970b52f578ded2b7017ac5196d951a3f8025173f913bdee4
SHA512e4cc32e609152766f922715b28fe2545679b1dfdb3bcee2b0a41d00e22cba7145a4ef9ce4ad9c15fbe49d0322d707b6c48260cb699154ea0a76f80ae4637b1f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b71dedc4f03d55c462131acdde5fdba5
SHA1a44a7cacf73413b97032aa7c86dca9f10ed89e85
SHA25694df61aa8dc6d257a13b6dd87a3a7269594697effa3cd395ac7456a48bdad0aa
SHA5125e2c9d560d61ea611bad0c13b4d29ecf4dbf48e0d936bed19d4bbfb01bd0a7425ed0ca0e2747250b2b79aa219c4393a636891108d4c35c147dc9a7c3d4dd19ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD521945230451efd1ee5a77f3d5edc223f
SHA18f095c91bf1f7e473f1a8c6d359ded55489f3a3d
SHA25653557f81deb69b24e086a45b86aae594c443ede51b8f24ce5e3511bf70572df5
SHA512b608ca420e825647d815a0af174ee58add3113cf63f36c943885a1b0066c5c68e8cfd2ccf1e541364b09d7bf6250a52ff158f02427bcaf7948a6dcf1479d962f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ba34827981ff82ab316b15e3567fe53f
SHA1638f187e65a8e28f3ab3081f6925931aa64b5e2c
SHA2563780908501271963d6634726d47ca9183c72d7c35af162a3609e9a2612fca60d
SHA512032c636495a3a501d3cbdcde2a550f65757b3cd8ff41d501ca30c4d9b694ff61c74fff222ba88010a8bb11dc340774f86eb32305af7b92cb540badae21f3768e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD544b70481bd71893316ef3ec5b112c6ad
SHA14bb34b71b52ce7fed6b24ee56400b7455bc44e1d
SHA25608c98d1ca001741daf106d6f385391b87a66ebda4ea03470954e930e53cb5703
SHA51223c92f32a8c00fada8bfaa8df5104ef55975e7a62837d65bd735eaad171ea42522e6698558a0cdeadaed43db38e63856e480dc4a280d916f712491256e13fbd6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e7af22fde7815c088812068bc1be2e72
SHA1c1f3c3426ebdfc6b0cb5eae699264a05907bec11
SHA256adab8ebbf6530ec1bd7c78fd798efcf4d27fe295941cfd756cb3cab508cc237a
SHA512914ec62d9201f22fb9c4d6a440b8a1693aa44d01db226762b0616f52df58f8af6eb906f451cad43656579d93c445d58287911f3ebe78beb73bfd72ac3d94ea2d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50d82137c135a56d32d938080e0dbae9f
SHA1100ea2a3f96f8e73073eae9a829add6304886acd
SHA256a9be4ad0728aee4ed8a5add6fc7fd585557bee1ae7ccb39e3e13a66dc325df60
SHA51214f0308509850790dfe3ac806d8fba89a3883d7967bd79a3facfd9e6a02141f623b47c464319c029f19493f45b7c1e6a9c4e54f0a63ce283cbed371dcda065ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD579ae1192ab3a5dbe82489e04aaea3aaa
SHA1a6206c694dc9de0288ec9a2a5b29d2a004a4b237
SHA2566a456cd28d57b56744f9e16fe1c2fe6d2ce3c9d640a671ef2d64479dadd1e7bd
SHA512e39a8bd0a9a50a08fd97d33b33fad836c998eabb061446c543773b9953a269410d89d0e15a98c29a52ebe2cb753e2b9ea0463659e3f79b032a52bc5a32af4744
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b87016897c7080977283e3f9e83c46e3
SHA1ed46c3abfdcf8c8bdecc32b108889485815bf3c2
SHA25669dfe2570701d89afe9f4d702aaf3c70025d26a797e8e8423348906b8b20171e
SHA5128cd09fcaca1648f02e03e3e84bfc350c02d0bc05511ff737f36815a5a124bac2285f6b0bf633ec88ea3219a720fe0dd1e510bfe814a7b1585fd884268f300496
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52f0674070d90de4dbdb0c5e454088bdc
SHA13c611131d3ffc7babbb2f20e71a9140969a50e94
SHA256d524ae24dd518f1240553d24f344944c3acc14af7c297bbe39eddfb3e3554452
SHA51280070ce57440ead71484e8918a0fed3be04831fd092f75a5217188db5ed3df60a8681f8cedd3729e5ae01fd79c8370b05efd42ca751a5b6f3f237d4233c6b461
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD585d9f709d548a68b9a9a6844388e3831
SHA1a3d28fd439eb863fd94af115ce04c7c1034cd644
SHA2563e2499beb5b74de699d32626db6aeaa3665b918360e50275388eb50385e312b1
SHA5122fec970072533b4e93e8e51e205043366fc48db8edc62958aa2d66fdb1eba5cafa878116fa2ed9f86715cd24ad6d94f5ac3220e2b241cad9423225de9f6151f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c6410aa2a4781c171e81e84762632351
SHA196bef16fd18d5d1a87e4de77c52fae558252bffd
SHA2562ebc0abad1772ac3b0896a678bc298877130b0861620919b90d3b7289cf3a83b
SHA512538f65ce878185675157b33206c0d812bd5c45bdc100a8c0a8f5af4a786c8bd0cfbf45139870ae1f2ba7fa7bd12f7e5b4c1db6bd3e04ddbac7719e5c8b0b553c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55279307bab5e13ae0af7308dd07e775a
SHA120b5cbc8bfc07b4fade4a2f4a797b39a8d0ff89a
SHA2563c4a21e3466e41c545b0199e000bb17c63c68ce3322432ab7adf10479621d0e5
SHA512d85719198b59df1efa3e7057c3de2ab9fe899808ae2f5368c6f7fddb9329aec3653a54752ff444657135b7a53090db1f33c4a33cdcaf0aaa486719d8feed71e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f01874f2b500c0ef6b878b3a26180aba
SHA11423b50e6842fb94ec7c0a8062b16e71434a8000
SHA25696cbb1eb887fa1a6bc5d393935585c0ed4f6644c51662ae3c31d9c5af398b6d5
SHA512dd681351172ae08a85f5dc028ae18ecddad575bff4e9093b3157cb46c9686317edbbb6e9255e3de4db3a4a1bb1e356d55ff8b740b2bafabd615e27efe7161b32
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f741da9bbcfcd9f0ae230155eba55124
SHA1198a6bc7ec6edd99104bd19731c9ecc2e6e59c28
SHA25669b3d067fae89b57bda2fbf10add2cb0e06d560e2e2584fcea831ff1ca4add9c
SHA5121b4da908def3c062b14db9d131f86a3e0be383625b6a0f0edee6b4851502bc70f67293d20201aeedbfdcedd106d284bb528bf3972df8ac2d185073f06b75b5d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD547dcf615e32125954058e44c0348826d
SHA101544de4020aedb6cae10542d703d2208ebe0d99
SHA25625af696cc99d73d0e3af188b74d0344c9df7dfb143cd7d502fccae86f9bf374a
SHA512f24a320eaec6d4e30ed15bd7b7a87c2c2d4a02edbe7b8931998db7d69773924d9dc3e03659c7970c66f645d82a85b37b1227c736411086ba70aaf19216e03b2f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5063e8bfb999ae136a91c153c66405c72
SHA1205d507c18a439334eda4c1b002197f6585ea3df
SHA2564d75b1baba092e37ec9ff581c157cbb0336b723ebb2415436793bd2837ca1aff
SHA5123e75c3f31eb267a3f5618b92851557b1d826546c61c9b60d2b4d1c2f1a7f6174c1c439c8428b4a21316c8a122dabb8947f0f8536ae26a37bb6d2e99b71d82aa7
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b