Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
30-05-2024 11:26
Static task
static1
Behavioral task
behavioral1
Sample
8410a98815a95f73bd790692e6fe1faa_JaffaCakes118.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
8410a98815a95f73bd790692e6fe1faa_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
8410a98815a95f73bd790692e6fe1faa_JaffaCakes118.html
-
Size
59KB
-
MD5
8410a98815a95f73bd790692e6fe1faa
-
SHA1
04c696b0bdd3ce5669edc329ba107a63db175b1b
-
SHA256
85b68f9bff344777d2d250870c90a6ff87e2d9b051e58cb31a345a542abd2bfe
-
SHA512
7bdeec7341c474e979cf35c46e8e6d68c24039519d0065b7242c0756167b54cc0cb0672655108db500354323d0f9ca5c8591cf64e4a3335b198ccba970801be5
-
SSDEEP
1536:GmV1cSRVSf/XJC53SI438sk+unGDVFGkQghcICl9griHR9:h1XsTDunGp2ICl9griHR9
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423230267" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7B7315C1-1E77-11EF-932B-4E2C21FEB07B} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1276 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1276 iexplore.exe 1276 iexplore.exe 2844 IEXPLORE.EXE 2844 IEXPLORE.EXE 2844 IEXPLORE.EXE 2844 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1276 wrote to memory of 2844 1276 iexplore.exe 28 PID 1276 wrote to memory of 2844 1276 iexplore.exe 28 PID 1276 wrote to memory of 2844 1276 iexplore.exe 28 PID 1276 wrote to memory of 2844 1276 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8410a98815a95f73bd790692e6fe1faa_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1276 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2844
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD52a4f451affc30b7c994147bb388541f1
SHA1fdc7c69031b8092695b956ab10d92cd2bdc6f9e2
SHA25632e30eaf32e999bb186b7ba0400a477a3220a293c7457cf181a974d6de0231c5
SHA5129f099600c9290e866065931ebe6e2a2f989661e4067c28130fb9a42ac16cedc4e9d522d5bf501df6ec0e288cd29e0c97b6d2e96db20f88d945d29ae47e392a6c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53f43938e1cebd7a8e678346309ae2f9e
SHA1556194b206797ade59b54bcadc2c48b998d0071d
SHA256ab4c65d5fd0c67b2a866879a1ba869fea79fa05a5bcd52358c159c6a50d412ef
SHA5128a58521eaad61ff09518bd950ed4766230e6c050954b25d99180291c7e931dba07a6c2a623b155559ef12806c38919194bec0ea596c55a1eaaf7911e20902fbe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fc613d848a8a8d6edf70167157455578
SHA1676028b4198665b98be1d0a4fa260cf524881a3c
SHA256ce97efaee748b4201f22cf8f0381b7f1d6d21426507c45fac93891f0f507fbc8
SHA512fbd1f86088ab030e25fe297e45f81c12c4fc95d593aea6f1f29bc8a7fa5767a9acb1b2dfbdeda1c3efd27548a5a400adc82e52641f0fe55e4faed33380ff43c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD505c9b08a4c747c6d328fab5ab26ad49f
SHA10805595ca017ad2fa05ebae926ec8e15b5836fb6
SHA2569c462dc1bf17a1e9085513336ce11558059bc457986991f885ae3d000c270c0e
SHA512c13680a3613321ec37152e92ef65dbc252a2eaa3c61a7ef2946b02fddf78f4371ea0127952b6ecb849ad1c473034fc4c83ad8e328e49a5d34b6480f1bb63fe5e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d21cd6ac23165cbe34b34431b10c6bd1
SHA1e1890cd77499a842fa0d6538fefdef9469fe4d1a
SHA25621d1555bd0f2903ce9414dbdb384543929360871b701aa24994c2797b09a12dc
SHA512b29e2a1750890e600da3fcf52e74eee77028dab122a2e796c656ec001a53fc649d5f36a009aaa6ae38fff6d9e4ba37ea4dce3ead7e669affcb23c32171a70e84
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a49464bb4fff2a9e8bee9356cad048fa
SHA11392df8970f59b0953cb5ed8404cf3cabc0a1bcb
SHA256d8cbd1118d571d97738cd9792b53f9ddeb77ce48dcd2d1397b9f9b59caabd065
SHA512e27309c479e878f4930a86798f47072b46aae73abe6684fad4a579def374b512e6d1068121a7b63dd64ecc19e6850f4c12ca0b673658e7ddf97eb6b6df3d0822
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD587487bca543dd0b2adac466e913bce59
SHA179c7590dff1314541e9aa767e89e6c3c6ded1594
SHA256fbd32e39e1da61ee600c2faa831fe6a161a593aa7696a3fffc8d61ea3efcbaae
SHA51254a59284b8d4892d86bf88bd52aca0f43f60a7cf1fa3827a72971fc26f140c3cdb446ce31c3209c54f89712e1c73d45c765b16e5052d7a68ba8f5d56032da9cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dc7adf8212a3132a2847d07b862c91fb
SHA17f6ad741b04a7495a68ab260b993681b28221308
SHA2562bc4953faabb793c8551e3a514e18b96bc97c2163d78764f35f2028cd050468e
SHA512f63c1a7ca475f21377c484b863baff0de42e5ecd92e4223d02c5d406b74ddc49b24d2b50a2e788c8edd37e8a153c88e41467a7d71a9ae80d5e124439eb1c9b4a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52f4bd296db928876dc586f38e2f6779e
SHA1dc8189a9385e8e12abbda2214c1b70c7ccade8b0
SHA256a774a98d627e5bc3f97ea8f8099af7080030af710795b74cd46eee7297d02684
SHA512a61d0c0c474ddae62c6090ab0f454b35922d7fdd7be366e9b0494baaea5b24df1d045e2e009fa3baf1724b32549a0ab2fd51d113c18ab459df110eab1ef4d7f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD580e408553acf9b22d97d2e5c557bdb6b
SHA14241e0b7c8baaf4879b07424c421a57e9fd52633
SHA256428d40e6449024fbd3d97b330ffcfa643a1089e0f2d36b0f6fa8042ea1e7bff0
SHA5120670e96a54d6d847bcf6e214189b4b44ac80fc3ba71d815ed7c989414b04640e469b8d7e217e708ff53e71a0fe4a60bee3ec809c48866421e46c8a0805df5914
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50f7fee10a222b5be7764cbc61ebba2cf
SHA1c0083463ebc6ccfc130397bc22bfee71425b9433
SHA2569ca28c5473207eb8d9a28d8f26f1c4a2cbdbd1a0c212ccf7ec819861f81ff9ae
SHA5127014398463aa65fffbcca7d7ffb8246ad48a3ce1657e065482ce8d82741ecf8a72a1ab15e696262196ef4c3171309df8825269dc7db24e59a5cd03947b6267d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD576641484c40ab937687733fe842ba07d
SHA1d014579e02bcf8ccac88c4d888d16b07ceb0ce60
SHA2564aa2950e8d8c79068704acb11de803a6e9fc07104062bbf1efb7a45d51a02217
SHA51255753b333423e0fbddd7f20ae931fb745e0389ded37fa5ecdd2f4c5e6a28815fe23da96cfb496691d5d879627067ba5decc241ed7882f28877e89741f08c8bdc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD504b7e8320012a62c87204fa838dbc27e
SHA177c722e43175ba752ea5d7c2ebaf6322c5600890
SHA25695884220f49c8764abd4a8e18a642faf3adec4255d9445d83d2a9d1a1540725d
SHA512ec093cac3bcd09ea372d1b2bd227100b5ebb41c38232f4b3b1b34c4c239bc97ad82450886c477f87ef6f3fc0a389f808d028d5c8f44385150075c6dd7eaafbfd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c2ff969f8f2bb67f545882d45ea5cc24
SHA1dbfc6edc8c9b3b88c9fa42b9ee82aee1cb6c40ca
SHA25611d1cb3966a5f38ec22ce32694f2dc18b02ba017a53ece66b1e28761dca0b9ef
SHA51201c071b1bc3e4d6da4a132f33fb7c1e04cedde2d0a50c0c4d99d9aeb5fffe54c37f78c26d03032c8e80d9758c848a9f0fc94064231589285d8dfa2b674e96e4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51796c3823789a5acd02813e97377fdff
SHA122b6dc91b47f34ad562641900e331928b58e0ee2
SHA256931766918ebe0f0e923bc1f7fdfef444b238a98a9cde1f65bf9f710dba601fc5
SHA5129546b8955b0f540cdcae1adbe835e3d95e09ba4ddb54f93f91a5ae45d398e8e32a757a5fbb9c2281e417d7ff17bb0c3d3803479000514eeb81cdd3c69ce6e284
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ea2258e6bf1652f916218e0e1a35faf5
SHA14e5d8e5cfb90d7e1a19901ace4e7fd8fce9474a8
SHA2565c9d367b3fee12d49bdd35527b1188b64338ba62229bc615e9b52975a4535768
SHA5125cfb91a2494751f23f44ad517b64e003d8be343eb8523285215dd7a1eafc22370b317d026b4e90c5fab74fa0b599ad9024b0b2de4dc51773097fae8cf665b33e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52794dc1958f76f792c93b1c173c3eda7
SHA1a53d147ec9277f45207435c66ed17f9e9d30f0ad
SHA256a50d749e7ec83f57568571e4d14a179dc4c1176ebb4190ac6b33c5cf445e9ef0
SHA51266a601f174777d5d4f2df725249350dc61e39dae22d7f09585ecf4b4f82b7f78e7c43cbb4267b2bf15096a6b7c49318e591784744505f09d5d3bc286f129fc5c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51e934aa8a46b6ef10125211722d01fb1
SHA1979a0f21df34ec3ffdf06878417d586b7725d65d
SHA2560017e7a467bc0df4b4365b78042d434add4f5d7fda53d7619bd2a80b2f212cd5
SHA512874d209aadd928442cda11311cfb35c80faa868fe0f99b1e191b835b41c61d1b7782da0d3ea4cca3148277c5f6651516ee60226175a8792ffdcb500c6e005547
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57312646b5349d11ab8ff55c61a26df98
SHA1eca312ec08cb30dc06d27651eeaeead2421fdf6f
SHA256b39b9f8dec1cbbea2a019d1ad640b2377c1324492091c7094957722696dd5460
SHA5127086bd72bf4e431c2982d32e2b9c2b6d1fbd78e7d67ddf2048f2b94bf2d2b75be97702b309621efd1321e12f62aa686e705f0951c452584607c41fb7335ee1fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d8479f425ddd3768a1f4200dd0649225
SHA184573af5420febb7a5449fe9e34981a1485569f1
SHA256dda7154f16cb8518954323420500696cadc844852c056e08133c39b752dfb253
SHA512a7ee99e68953de29df975b97c7eabf32147918e41a3e1dbda3895bcd93740030503f56cfcf89303e0e41c9381aa40767a590829feb57c165c58dd2462a9124e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD543bb8b5db6e0a034dfb422024b0684d6
SHA18409b7a8c36beb491e48fa0e244b3e8a51a9c46a
SHA256877fdb4cf2f1a62305c3dde50b00eca1f07b6c31377ae7cd4a45d118ae8f8cef
SHA512beb3a97b7462b714b9bbbb1811b88fec0602908bce226807f58db744695ba7b03249b4c47fe2535ad2795b5d6fc3ad81402ce61dd2deb0bcd54b19100dbbfe13
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD567c8bab028c01f9cf12b46c7c8b07ab3
SHA1947eb71a9f1eec065fc554d600c16ea3bdfd9035
SHA2564ca5dbdfd3327b938eb3760ccbc3d85bbb52ee05b15b2fce811ae5301cf40d56
SHA512b4b6979010a8c58dcec1069ceb7bf800b85dcad0329aa0776ed740a6c7d4581dea4e085ad7322e83af33d51409708612b693310b30fea59444a184072604a3c4
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b