Analysis
-
max time kernel
120s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
29/05/2024, 10:42
Static task
static1
Behavioral task
behavioral1
Sample
80776d61cad3ef8d137369143d9425eb_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
80776d61cad3ef8d137369143d9425eb_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
80776d61cad3ef8d137369143d9425eb_JaffaCakes118.html
-
Size
27KB
-
MD5
80776d61cad3ef8d137369143d9425eb
-
SHA1
4d2702dbb96c27f6ec8eaa62e4c74d47dbe68f59
-
SHA256
3d49c559192f0f2d1cd5cce6c35e6cc74d46805606bbececac3509d68243cfde
-
SHA512
69c98eee893f1a7ae0b8c71a0392d36f0f0c48d3f737227336a0a34a9d05f8e3f8b7bda0b7ce3f144dbe1c6dc59d31d74ecc56f1d33beadd958ac276e1d7ec3c
-
SSDEEP
768:ynmQl4i33ikEIIc6IussMgDemFLbcLHE9RDFXJMZ2ZLzhQnS/:ynmQl4i33hEIIqus8pbvRDFXLFb
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e93610000000002000000000010660000000100002000000023522230d066d0481220313d645830ff4e2bf5527c30fbacc5f54c9bcfaa1259000000000e80000000020000200000003ad2976c993157f7fb006ace8d1bd75c1e68bff381d7a51b4c1d3e9de057637920000000505c14d7477ee9dfa7297231f7bfe66379e798ca5122b35cfbf5ea5ad75baa9e4000000055f9b58ab9d2ac69ff840387216ac4df187ae0547ab6056d75d37604aeb50fbfa29c69ed029bb11a5ac3af581109b19d9356237a182409bc0e5409f4d1b1df75 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0b593f1b4b1da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423141201" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000b5263296af340d6fc19a26a9f2a71976325247806a6f4ca7d7a1c9af37ca8076000000000e800000000200002000000049d0845b09ff986e2008adf772d9d8ed2961f710de0c1288870189bec48543f490000000549dac77d07044cee10c231b7b9d4d138c427f5ebf84f9419d3058fd055688be2cb24abaee057d1475a21a431a8fa8dfca1e449b0989008528b07e361efff51fc4dc7c7e70878318a143e626d991f57bdb7e0583372b85cfc6755665611a37967ec951a28d281cad0af7b66bad251932bec7114a378fcff5640dd609fb7b7c48a7f063092a2de40c5ef4411634e6c058400000004da7ef9f41cce322ef21f147f21d51cbc1686a12e294a52216632ae7a74f91dacb261e2c43e33311ea5fec92c518ea90ccb268ec121ce535a7a436eeebd72cef iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1C9B1EF1-1DA8-11EF-BAEF-F2F7F00EEB0D} = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1868 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1868 iexplore.exe 1868 iexplore.exe 2956 IEXPLORE.EXE 2956 IEXPLORE.EXE 2956 IEXPLORE.EXE 2956 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1868 wrote to memory of 2956 1868 iexplore.exe 28 PID 1868 wrote to memory of 2956 1868 iexplore.exe 28 PID 1868 wrote to memory of 2956 1868 iexplore.exe 28 PID 1868 wrote to memory of 2956 1868 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\80776d61cad3ef8d137369143d9425eb_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1868 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2956
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a9dead3d673afcbf6cd1295813f47923
SHA17f9f7c1df9db297444cef95efbfa7911a5ef8147
SHA2562d98e927d06f0bdb568d16de57e26686407ff37f99632716fcd9ea5b3a8efd10
SHA51229b03a7ce5557107f6d109d2be528d4e8ff9af1ab63aeabdf4d84fc2d7c07f0eb2e60444f54c2eb6268251c0da0137b189a4be845ad8dfce7dbfe72aa5d52bfd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5736e5942a2350a2eeb5f493b6fe4340b
SHA1548dc5a219e2ee917b1a37c7158c91fd8610e08a
SHA25690fadadad96d33de103da038cdb02cf030379819bdc6a42f1248751b05a92c8e
SHA512eba8e5bcc52101691a9b7d11039b8d3710c254316ae065c7b3863985e5314259fc70dc383e36937abb0c3b1d3b9fea2bc61c8e24d32c9361e34e5b7c9715b7c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD550985ec1a1b9624a9120fade91cbe6cc
SHA1f60d1d7c92f18e4e1a4ab213d4092cedb4c42e34
SHA25635040c7c3dc6e717e82aa7b070270a5c2749e9d4c6bf7b2eb3568b2fcedb2605
SHA51217ca554812cad5eada15a7207c0f66705e35de7a73eaca968c2b33402ffb7f13a5b6c918f25a4ee463c037f4eeb62d36a4ffb72411255cf85abfed15174abf38
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b124fd4620ecf625acdd33529a228e9b
SHA1036f6a5867e35447e9131372da23bf2645010851
SHA256e3d4ca531b3e8d33e2604495bcde8b17b2bd0a458e838674ba0f59538a6a00e7
SHA51224d95dd36cb61a3ff15b807c3c94d12350803c3193b12a84b072b788b9f169c1936db0cf735968ee4c175bf107fdec229b5256128ab194d42962cb7de7d69b8f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55f8fbc849978cebd2b92afd07373ab13
SHA1435573fe1ca96aeeeb4614451df22cf9e1a7672d
SHA256ce37454cdbcc607f2566023d0ee960fee375ed31f8392ee08f04d2ad01cb3c7e
SHA5120b5671cd0946ee76981f692404c20007b22a68466a278b73b45b59e25a685ebc35e8fbbd32c1503d481446734e472e98da9881357c9c529b46122422564a3b8d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54989e512179f37f674ac44783e2338eb
SHA12d2fe354fe1af33a23eafa3da17619a635b0d93a
SHA256a70731c21ae161a7d45fb9473b64f5803f5cd4657a1012efa6f6c47607a37f3c
SHA51207d231a5e3b2a647ffe4fd2867b2b14bcb8db46551025961228329ce352a35c344aa5c4bf519a670e0d9d0daa7a6145de22bb2aa5d826df000caf91a01025841
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5212270564b2254265b6eff37884ae43c
SHA18ab2153d5a295bf859ad4d5338dd106ffa57a3b9
SHA2569e496d725a35921e7fc0bfcdea98178548b0cf36993a83aee5497e7a8f734e5f
SHA512923d7cf05c670b093a7b7df926e174b2762daa57968af8a68c23fb9011ba93b9e7778ddc391ebed3bad42fb71741b2c8b924a11086a7ae76cd643ab335bf4484
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53a03eab231f202702c5a2dafdaddc678
SHA1050c8727a11b6b4f42d253a4f7deb8758ad2da4b
SHA256cb2dfc891891aad40f030a93e0476889309734c5f787d1495b192561c8870274
SHA512b3a0d4284db2cda25e4b6cc255572f193007bcff6c51b503f821c2d3a2b95376469e8a437f24a023d9dbaf5c6d3e05103eab78ac70e8e1713840152d61dd60bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55f1aac586d6e440bbe63d378e0ed5805
SHA1b8c711cf0e82247eb120be8f7234a64ad73e7487
SHA256e7ff1f7544c7d48b1b52e992dd1bde85e8ef69f6737c0e1ea1d9775be9144a67
SHA512123d499e52496d008663fd8a8d9051b520fd83c0a2d62d8e892b59981f4dbff625790ab60f5cb51cef8bb55af5d15e05797bb618766500119147431492bd58da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e888f8e86ec44b388a602a0d05d184fe
SHA19a30e3f6fd8add29d4556aaddbb6e03d9bc870d6
SHA256784ad71c453d8ae5a9403c8b225bbc317975382e4a357bfbdb2b0dbc2716f02b
SHA512e70ba5e55feaa09c6103ec55bfbede8ff21a5fe39ce8c7854f55c6b4b19594c77ddd5e0090485cb0d8d896df461fd8cdf7da9bd0b91b0bc8ad15672a58b65c87
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD586642c34f0d2c0998b6eedf792501cec
SHA1f09334ba6706e69e7169ad6eb54b2972fc03ba64
SHA256fc0e300f699e70e1cd6f814184d54bda7d9e5764d25fa1ea574c9535b679ba5b
SHA5129f2f73122113794c6c45b13fc1747a1d2163c186152db0579bba4a2ca2e73ed031436ef67d8a24a773d4e7d1eb5e277f974f4c24ac4bc2dfc717939290db2b03
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58d823e9fb5cff3babc6d51db59bf4375
SHA1cc0a2c5ded37176aebe1aa16daef57d1add262a4
SHA256f6bf200d8db89d507e4c71b3856206f79d6a981af052a2063e00dc1d6a39299e
SHA512f4c54acbdade5545f5281f06a722a28d411b89ce250a90bf6c4aae36a452e7f27341eac10a25726ad795d924c0e2e93e164ed8b98897d95870091e11e2b9de72
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5477909d744814e16d31142992126d38f
SHA1bfa135aac2d0523cf76fc0b9315238cc818a5a70
SHA256e796d891a82b13c79262bdc6d17c4c58aa680bae34f8456884ebe40e94f3d5c3
SHA5124ced6436b6c93053bd62513708653523f9237b4bd9220787247db6ab29850587f4927139b0c9a88fcc03aa9f029325311add27426c534a18b92f51b41cc6bf09
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55416c4e9d20c0a5f8ef070ac5c172d93
SHA150165d9aedc3aa796aa7fa8e9c070f37fd55dbf7
SHA2568eba916d9ad18f023f9857368f73950f41ba9481930da3a86d1017e8a214b8ff
SHA512a09bb06c83d4336b08c96a4f361186e552f9d5608e4567e237744233c33b24242f41e1d14098accc1df048ba22093c1818d6cd8db1b3715232019b7f96105ee8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD511c254df8a7d56b8529ca30607bb7ba3
SHA10b07c43c0539405f390b53f812b22fcc8c052519
SHA2560fb8b0b04f4d0cf6e13aee3abc7df6a52968c80f4d9275d9733f3d3fd9875a5c
SHA51202879e7456fc15f4749b4bc33d8cb3adbc7fae39a1da3f938425c7ea4fbb0b506c9adbe4eecc7f78045c3d4508a96d0e47daedfdf4972c46ab0e778c749a807c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58b37752f67043f3931cc3cfc42ae84f9
SHA1e2de5d9408a0ab2873ba69997c3f918d0de0154f
SHA2566cc02682cf7f604364a9c4086e418514c1641978e938ba11f28cc7b32637a1b4
SHA5125c59b48c3bc4cb9ed8ed7f558baf458fb408d685b72a5b3cefb828e1b9c26869cc6a179615b44830ce11da78c8a52877d3d65b707854c568fec5069fa9913498
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD576f3ee7c2c15fd67d24996cc4d1a4615
SHA123fa7d11d4e89fb15bf26c40b2e09d77b4eeb84d
SHA256ff953f2c3b028d5eee97d9632f126da37c6b9c4c21a7f7039d5647ec17a348bd
SHA512194237e5b1f9c85743dd35a1bfcc93811005e33fb315fc446c0c29d7c3783d7f9e072d6942b92edb6072127519c50f1bd430a1bc53f245f15b7aeccac169e9c4
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b