Analysis
-
max time kernel
133s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
29/05/2024, 10:30
Static task
static1
Behavioral task
behavioral1
Sample
806f1ddaa7de6e53e15fb6c9c9813626_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
806f1ddaa7de6e53e15fb6c9c9813626_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
806f1ddaa7de6e53e15fb6c9c9813626_JaffaCakes118.html
-
Size
869B
-
MD5
806f1ddaa7de6e53e15fb6c9c9813626
-
SHA1
66beb2d296442dff8232abd58b51648b783f320b
-
SHA256
e9699605ff9da6d39d6c0e831e36dfd87345c7594ba97c1bfd99c45dd1506ff0
-
SHA512
f19c68374007da45b06b11bad97c7acfae1fba3fe1dddc19ea4d96715ee29ee2719953da582656c691564fb6cbb25e03ef4e63c71dd1c68145477f5d27fc66e5
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007ea35edde9a37e4a8c4b74e02f74f865000000000200000000001066000000010000200000005408519d44b362fbbc8ea1eaa058541418c5a3d26adca2088aa50a8701efd0bc000000000e80000000020000200000008aa175c14768e052f3b20de6d9ed67138652c733815d21ab18875e65afc0718f90000000c3f9b209cb429f5073282ea52c7e3e6c12e9bfa9e14f441a7dbd88a88c180c635aabec242a2e42fe9c8725f420ca781f6654d0216174e2a0a535afba9d39c6a2c8a0531e62aefb8d9286002b47e7f55237f661f9bb1ff102a14248919c7c3d0c6353b8a9764c231ef0720f67835a3c6f99bcc1459d1c86f01b80bf8100683a3dc0a562ce20e8a1d84430fa8c9b8b680c4000000073fe42143a03096c314e50c5bfa883a98bc74805a3f60444d29a628591d9245c309b38291b28fb72ffc69cf5c1c57d6de511c738a5462af431817f3d6ccd2a47 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d046bb55b3b1da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{814D5BD1-1DA6-11EF-B7A6-525094B41941} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007ea35edde9a37e4a8c4b74e02f74f865000000000200000000001066000000010000200000009d71aa0835ae003b4b1596d896a68da97ce2c08f93c9ab1fc9f268ddc6313c66000000000e8000000002000020000000efebba7ab1536fda5860fe736d4e8821c5cf2647c87e49a9d7b4359dd2e7dd0420000000ade427953416107e364937146f7ecd52481cd964ef9ff52b93e3e877bebfc8284000000020476686863ac61c10d1397bdc86fb8a482b72a05bd9118fbb0ccd9c7a23fa2ef9991c67e0bac1d9f1a43f9b17e210b891dc34ba7368eea663f4fe4cd28814a1 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423140512" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1304 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1304 iexplore.exe 1304 iexplore.exe 1820 IEXPLORE.EXE 1820 IEXPLORE.EXE 1820 IEXPLORE.EXE 1820 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1304 wrote to memory of 1820 1304 iexplore.exe 28 PID 1304 wrote to memory of 1820 1304 iexplore.exe 28 PID 1304 wrote to memory of 1820 1304 iexplore.exe 28 PID 1304 wrote to memory of 1820 1304 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\806f1ddaa7de6e53e15fb6c9c9813626_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1304 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1820
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c261d61a15e27bffafcedd0047223b06
SHA1a197e3baf6cd166a8c19399920c431def18da558
SHA256d454fc1dc6f008481e39f18df7f93c486cf5aba668b7b5820523d64a06c20654
SHA5126d1376df95f7f291bd3f5bddcd405f877dd3da2b882c283db900e3b92fb8723ef40684ac605973cdba59e0358cc70eca76a599f4080a029e0c33cd52298341c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD570d693d84ee54ab34a9a2e9af12ca036
SHA1b08c4bdbbc658c74b159a5830e5d124e6283a9fc
SHA2564681dedadc016b3f7ab62b5fe4942a08489913dc802703ba44d10620d46a7100
SHA51296bdc5fe08381e2ed9db83e89dd08035b4a5b55e49838e2f2b5403fe5f3c96c6fbc6aa3b4ed0b12b5e9eaf4624ca5df25faf2562c3227f1858155be1066c42f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59b844765ab3375b38245ef974607487c
SHA1252ef103adfe4a309afc1a387e57ced864d07250
SHA256ca0726f880b8ab19d3b19588c89c3aada6a24b618dea8b57ea4250e8356af918
SHA5122a6ebbafef2bc1386274efe09e5f04f8147244b36abb57c973149f4c5f3e78a892cf2d0190bbe28820b6208ef7cbf3534b0da153a7bc127aa16f871fef114046
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5551d2566f507d1d5ab72e381be7c8f61
SHA19ef297abbffa2dbdafb8569fe133286586f0d042
SHA256753047af83eab4a4fd0fc3b5e5bc2c3d9ac48801b8525e17f970d96d316b13d7
SHA5124f75e3b8bcfcaae62ed31bd6cc9af1d7633c122b62e8660a7a77ddc0253c79a4ed4f2a93c31b7f493d7878aef436a5a49b6ed7a354dbf843b9c6f37ee4ac809d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5221b185c343ce937547cf65d2845cf68
SHA15dc4ecc79c4a63c18306397e1e5ffa580c4e71f2
SHA25658a87485a0539d5da5326136ec2be4c254ee324a6fc5d22024e6f02c2a711762
SHA51272567e8c3de6c01bdabf6088eb11c25444ce18b9a7ccdb2b178f899be894674923600840d59a1d60c1dd647c544cfeb52e24b785e085aa7cb078219a4a429dda
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c5b466fecfd7eb54b58bc8940ab5f4f4
SHA1f9fa16aa00832163303d17291db2df1a6247c003
SHA25638076b1b614fdda809d5edb011c2dff981cdf2ee8189542b6391b7c8787399c9
SHA51234fa0e90c447664a9311a9959d662778f326f9c443c14052b293951b1d974f0f3e3d36c6c1fed8218437ca8ea683718ed1712991950828ae2b8ead83a1da4a33
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b5bff225d600e8d8318bf901649350ee
SHA11f6589922019a0e9a70ef5e9a00509f01f04567a
SHA256436eac0a6728afa740115a9eb3bd0966922896cbd26dbf0a7540c5c38731c1e0
SHA512a9e1ab013770199956cbef8735d0c37d148f802ed8a490b6f0b1dc64b191f3cb1e05c025e7e9da67395a9347d7615a25ba6f72c8325afd23c640d9dfd533f640
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52da2349f30d28d346139043f294d13b8
SHA14538a5044aae5b5eba4eddb22be6021a6f1bca41
SHA2562301075774a442de162b44402a191439eced54a768df3350857c68ba2812bf59
SHA512a6cb269adb2e599971ecc61afb26e829f94e9fccc4525e451d3f5872aca530012514f0ce6bb403576a9dc025b7f96c0e31b0e5b6d2d975a9491685ffc6bf3472
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51cac125d3c6e920d2d25b49abba9d0bb
SHA13d689e54d502719d06499578a00b3646656fab34
SHA256088e5675395a9744c0560602401caa17ab9f8abd46e585b96a5b17a9fb1ba961
SHA512d389c76dda57135bf8ca53dada8a90f1d7f797b4efbc2e6a39ca5115ebd3fc0e68e746e0282d5db7df4bb90ffa885b8123f94b752ae616dbef1a1107292de41b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ff842d4fa5a3741a88c590f5590bca15
SHA1f26e03f957db7b49f56aacb9d7050bddd1444285
SHA256d2270a66315f0843e3e3e9631ce806addfdac255aae0556e658170fd20bb6fd4
SHA512621685f96456d1d428a49e7ab56e61abd4c913230b3299403c4473c41383aed7364892c84ea34b6246c643b47841c80ea887e7f44ca747dbcb33e2f4fc04e15c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD563f92e91568b2500efeee6fa53b7fcdc
SHA185f44574f6edc1bb2d29b5a5de448d6c143c43c1
SHA256c0b4c1436236206e39dfb3cfaff6d2c3a25f4af12581d77db06556a6bbf83ea3
SHA512fa5d6b7101f5ed740f6047dec2c4c542821297375fe3bfb3f92028f30ffd392de21c5371c4e79eaa6c7d2e703dcb300d57e7f4160bffc9bdcaaa82b34e7b2b11
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5365ee9f93a2b55bc204ff83af888251a
SHA103f485f06f431c33f2657c9a65eb27ea57b9e3f1
SHA25644c8bf7f580c8a654334953f3e0d551af3829f605d9d3464c7b6b8ed10a6d486
SHA51232d7e4133ec63885ab2d07e811011058c8bf7f8b97284fb5858f7867a189ab61202d1957851154d60eadde2e9788094ecb5f762a544191145728f56e3a5962bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a976bdf0667a5542e84623db51dc758d
SHA11356eba9164acf0ae88c507402c4285d5ac70f6b
SHA2566b8e379e22e2fa13344025e6f7e09773ae86ca534b3586fca56d82df129bf1cb
SHA5121d9863de0e20b22f01063a1f951b5d24ab7809bca5cdb1434b0fb83aed35a7b0f8ad2011e6ee04062fb42e2e80877301e6697c23d8ef15a077f07a5bfa2da2f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD596fe8c400f4dc9a9ba6aa40d2eccdb88
SHA11a8ef8ec9f227510f906487edfd292c75b6f7a4d
SHA2563c12ee683fc1482788cffde046f69e2acfa5ea2eba0169ab9afc0e4780cd2b1b
SHA512db5692db12f295998bc2c4d9cedd493f908e144daab25ee0d4c2fa7ab9a31c058c9fb3c31ff182a736a4c00c7ee5f5c934b133ee83dcc8435532a5e3d905514d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5302f5f59fc21e896f1d7c666c1a415dc
SHA14fd09f0407f040e842b275279f8f928890a64b55
SHA25671459a4faae268638cdf51512cd6e2a9744ce03f11ddcc3bed5ad0eab06c43b5
SHA512857faf3dc30ddae6c256985f6da414d7f3eb1c8eac1be2203c5aa45227db8dc5482cdf12d00021dc2e6f05a5e2a74f77f35017991fc0d7cd414b309080906ab0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ba6fbe8be47b4d7a17bd6b6440e56b2d
SHA1bbe63d7d39d0a09b0d656e57e8892db39ab47a94
SHA25677f91778bdff127046e67c7a27224e1b987762c1af87a60ae8fb93befe780c6d
SHA512d034c9df852da8649dfa5f39f5e6da5ada6528957be19afaae6f159491ff2fbb4e3ca39a5426d179395db92d396a61064e45ec74c81a0167c2ed8f234cd1667f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5261fbe5b5323e514879b5176f2c4853c
SHA135588d261a16ee6e9c27450e461791970bbf5fb2
SHA25646bc846c4a725816b819dbf8fe0b1bcd5ac8023547f378f2ce4e0008be878314
SHA5126b86b2dd24297d9c77e5124bcf9c62d684cc58fe6e32cc0e2ec5cfa1ffed87c98f1fb61b1f803d9f5f18641f2e06f02eccfa495dda63cbec8a383c4eeee50340
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55d6dc50765fdc7f44d5b30ea5ea15c80
SHA1e87cd3250c663ae153c5e1cca34efea4b20295e5
SHA25641407468fb1c6be7b429ae96c2f444395e60c81ffb960a0e9e1fbbea03b0e2b6
SHA5124358906e14c67bb7cc9c35bbb0a73deda643e949e0ea216def02abfe6efdde911ae803baa34f911fb97a4e88f410a89fe245aab3ef1ff405acb32fdfa8f955d2
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b