Analysis
-
max time kernel
118s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
29-05-2024 08:06
Static task
static1
Behavioral task
behavioral1
Sample
800bba081457f2546fcc56cb77526a53_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
800bba081457f2546fcc56cb77526a53_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
800bba081457f2546fcc56cb77526a53_JaffaCakes118.html
-
Size
4KB
-
MD5
800bba081457f2546fcc56cb77526a53
-
SHA1
458b95ee2604b7d8e22e4688ec305611208adcf2
-
SHA256
3ecc3a0ca28a75f68545e64c98f6404f58ca13f9ba2b959ddb915907209afc9e
-
SHA512
4aa18589cea8b18eaafb381e9f77a20fcf56d627f47a9e4d8bc69707aa41a58f230851adca8771f89614d5cde746b6dfe6697482e3b4a4d31c6b2a25b1eedde1
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8opuixOyu:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDd
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{64B2AA21-1D92-11EF-8F47-7A4B76010719} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000008ba1adca431c4dbf37b9fe2b05c77947807f5e9468c3c40db1b15ecd362ba4a6000000000e80000000020000200000003e9ef976cd3aca90ac9d4ca6164a1c4d336b91c4af73bf5c4de69682391f668a90000000b847f4c28e16108aeebf5c4791d216801117df4e54dc430a5d4ef926c6f74cc17c09e87f8410b93c95dbb4abadfa4eb1e13d2e94a97a1510b4557368a1b051af59fb1a8eb571776ab9f0e921fa43aee0964fa5545976999bc099ac70b57f08876f8e092bdba4fb16a73755cb051f91e6956872bc5eff59a9510cb4e960c71ed85386313026b9bef66cce9166b2f8085d4000000099d40d3e20c0392068d222bae5088543b2a9f40e5fc9617f22754094ab9a4f2412eee2dec2e75556627de512a150c15338c357b35d91e90c2fc66ef4a7f34a56 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000d37f5680f217aac1f272bed37ce6f1b283856d23d925c8281400cd06572e60de000000000e8000000002000020000000d0856513f4c8ea587b407106b9f9bdba0fbb29a6fb84fbb8df096fc9d6f0d4d62000000012ca7ab213d48f24b27e8c782a2e8c1cd77a5f37a6f700c02181d491d6ecf950400000007650a56c71043568a3f6adbcbd65c7dc84a4f696ea4504b4790ed89aa99d124c049fc11af3f7853354b2d0adde54858de689e1c5f79f7256783c495d5c754b00 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b03f54399fb1da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423131874" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1700 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1700 iexplore.exe 1700 iexplore.exe 2616 IEXPLORE.EXE 2616 IEXPLORE.EXE 2616 IEXPLORE.EXE 2616 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1700 wrote to memory of 2616 1700 iexplore.exe 28 PID 1700 wrote to memory of 2616 1700 iexplore.exe 28 PID 1700 wrote to memory of 2616 1700 iexplore.exe 28 PID 1700 wrote to memory of 2616 1700 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\800bba081457f2546fcc56cb77526a53_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1700 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2616
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5beb860bf1ab6cc647d61a881cb45986e
SHA103a13caf07ea9a3b95c408d28c55d682c255a821
SHA25607d7b66a5d1067e691208046c9ed7444005f8a9accbcf57c08014a46c25c3775
SHA5123339c9632f2ddb13f8ae7ba72ad14aff2a467337f6793e8b414b16f6690458518bae1b795b77481c311078285f70c5c38d83c42688637d0020faeffec008a397
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5de4a82db3fa59b5db246deaa81041113
SHA108c878086b554c215f912f7d07f5d226d0c0ac89
SHA256c0bb20c20f4787a5011494b31dd00625981311d07e0f12f3d8e8411bdc9c9ec2
SHA512def4447ee455fe631adea2efda1b8c2f9e9b22922727bc8316be214da10cc08a45e8649252d6bbd5c9d4214b457da0a8d8da9a3d8caddfc79c9131d1edc20476
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f89241934df952d0c2b449687c580b49
SHA1920e706fcb40dcd14339b32ba6770707e24ca5ac
SHA256bf24c347a1ebf2a67bfef23f054625bbad9581a83e9be310f58f851101633d2b
SHA5127e2ba47e8a3343311caca68d8170d2e9b81cdc31f3cf048352984af9bb099c67315576dc960029c64153948375ba0e6ab216ab5ae4e16fc69dbf7c71c83d4577
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59d525b9d08df3a26aec7b52a54786868
SHA1bb14e4adc8c73597e5afd36e4f47b498dc1a2c3a
SHA2562b04cd4618ffbe8cfdca5d8eafc06a7c6bb1500c457d5ccc90c10766a0d99089
SHA512e07764c2e8abc79ecfd700b07e8403a02a019a654027f69e056268647a6f5c66c5d86396e5e8e6390d7d8af7c828df5ae0654444b0e9fe8c023c2e9d55d3e25a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5988a904fd7d0cfaa12c6f351e47ca1ea
SHA1d7f05e79123aaf61126c60282b9bb12031b6521d
SHA256a7f4ac1126c30b974332d243e6511d0a9765c9b8a8c120c3f045dd1245f38309
SHA512c269490a58200943a806d06f5f8004b4030857e287cbc87ec0638a7d2d4e88e9bee33822e31223416cd179afa3421270e5be4d303acb239197748175d625a755
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD564f9363d99d0876649dae94dd68ecdb7
SHA1105edb8991426ec4d6c854992b899cc5eb5da696
SHA256bcbffc4c669d23da25ddefd170cd17022965472c03852c6fac87879700e27da3
SHA512014dde94045616fbcc12290eef78147a5441ac3e995d6786483679a1267b74fa3d6d7ded745f70b1652f87d940fa5a4f232661ce6678e7bc1acfcaac0e4252ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55fe7cde042191b55975f0a035a6120bf
SHA181ef26270ca1ae9a9da3e8fb3d09547f9286b6cd
SHA256a28dce44212bfba196b2e163b1b1e7427a528b3ab1b70efdc89e5aeaf4ec9f14
SHA512691a966ed6034679773fbb442a3af3911b3c2901573fb58d450f19b6f8eb5a2e5751996a7d02ab62d7683254f7df8de73540e3f5c09b609bbdcabca89e9531c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b3113617627ed3d9aab004b202f5f224
SHA14a675baa736d97a4af61cc6f67002613868e6c40
SHA25614c011510abec3bc597e0a758631b5f98c3482a5f08a9aeb86ab12948dcf6d5d
SHA512fe500baa598fcaaa88c179086fad4c40629def308a55bb8c5d91fc4c52f9069f66369374860a02eb76586d598e1923e4d280a3f08f7ef552add560926dcb7084
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD523972bd114d358c008a196e12c3a3037
SHA1cc5c839f6b3e2fc2e8f612837fe4658401078bc5
SHA2569707d2ec5849f933595f99f7d9f24cd267e9629fd03f956047d9ba81a3cc4f8d
SHA5125676829a75ac6c9e60301fcd7f471878202c718c4e8aea051583248a0d05a6e658f29a297678c428c27987832e62322dc8420bd2241760f0713d17a1ebe99047
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56b5425cf4ae5de827ce79daf4f512513
SHA1b849296979096cbe97952f130f447a898cd84547
SHA25606dc57e7ae9aeecc54bd7bb6ccf148b34fda6c8b403bc4f76a53dba7c8b379a7
SHA51211ad9ce1e5a035201224d7bb9876311222921498479b2c27b04dfd804574c974a94b10c97981b977e4576222a9ca04158bd4aa0686503f1ae5e55d0fb48afd69
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cf00965bfd7075e1591a666305d74d17
SHA108ff964e6930ad20d75d003cb8fda532ee997513
SHA25647b986c86315218659af8040da4ee1f208d4ec7f257236d8a342b762b4230d62
SHA5129491cf9a8350a4a4e6139b8ef58713a09b4ef6e6a0678c45a3eeee9831b3b82e02870c8254f2f4bd7aefc101533a68cfb65f01559b9877d179f08dd8032cf4d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5db6b04d23440a95f2999ca78d1e7ffbb
SHA12bfa9ced36fb8454ec018b189c5731e9066877f8
SHA256864af513cf0905c3de628b0b071e38af110c49ccdb01f36d4076b3c6f49d0a83
SHA512b2be79dac928104727a7bfc4eb0e3828bfb2f2cc28aa9a91b346ca98c57e5d93f518b44cfbd3860d581d6c714bb55ab89c8a13e3a0f222112029a288b2f88e1b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD578767aa7083184179c2569fdc568ac08
SHA1949256684f994a80dbcb0dc5c0496968d380102e
SHA25679ccfb5baa4dc7c4d506b1ba3c96e471f0c407985a423608600b0d1b0ff6e8ee
SHA5129d9576a5169a50bf11976c24c211b88a5a16e86c82199755d65736f575a468935ac71d4c6bac3eba21f1e5aa103cba59de1e9bae37849df028bb9eda50b81b56
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e61a2fba678aa455cf49d72f5ab33dcc
SHA1769dbc3ab9a90e35c4e3669c72e8d10907614ad5
SHA256a952340d92ebc2480933e701e6447c20fe356f40e8f4de0a10aafdde172403c2
SHA512a6e897c9022c5e4193048136b3259d59a369074ae14464f1f2e7e93f2d994487c58442d68a3189b9489edbf37f013ffe4af70309c3bb5faaedb5afc32771ebd1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a009541f28707f8038af9ff3b95c2c69
SHA1ff93a9b3056be0d2962d4979ab33afc1421c60c8
SHA256023d28fd9bcfe602e0740ebee82c17321c674a01555d96d8c49bb4e27ad5b951
SHA512e5dc48e310aaf138250ac3a708bbdf518e6fdc1339d86e0d4f4a0c31e225a380da0078e09e1556c27d07925c94f4826167908fcd7b9552ddd4bfcfe184c72ebe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD561118b412d7c010ba00becd18bb8ec88
SHA155f9c3563152a5ce74baaee5f8edc1e62f98e871
SHA256b2c04ff990f47c81db7893163b77ff7573195ed64cd6dc867a8502d47744c44b
SHA5125c9b4c48040caf72ea87e3e19e1e7815b73ea94ef965b26532a3ea8f57bf762913b650c80535e2ab5f1ef4821d8c72e48e9a7f635d517cab8950ccc866c1e91a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54173908898fb6265ea7c321921a9744f
SHA1c1a5182e82390139823cface7c13488c9afd0df5
SHA25603e1e90f544dfad24941803e2f39eab17482fd0ef12bfa0fa0c46a444648a141
SHA512b129f901ab66e89045c99c18f6d6e66ae7d3b86ede617d86045a4a5fbfcdd75062cf62e118d92c2c8f5501e9f9a1a26c9d26031c9baea57f1d00131fd5c03794
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51d958f9f5371aafdd85ff1912085130a
SHA15d655b46feeab41a4d4d5501f4a92e5f31024ad5
SHA2565ecd0719603d97baac4f58a2603644ad245a6b5445ce58ff3437cf94c5cf11fc
SHA5126b1bce881ca36782f1ad2a64d64d96705a3d80cff178f18ec4fe18565ddf3785ca5c740f629cf3253df63693aadd3c580370c68b6bdce071a7d290223468df1e
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b