Analysis
-
max time kernel
134s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
30-05-2024 11:29
Static task
static1
Behavioral task
behavioral1
Sample
84130a016a503f06d38fc43c2c643cbc_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
84130a016a503f06d38fc43c2c643cbc_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
84130a016a503f06d38fc43c2c643cbc_JaffaCakes118.html
-
Size
7KB
-
MD5
84130a016a503f06d38fc43c2c643cbc
-
SHA1
34b204146382cde2001adaa2fbe734e66bac1364
-
SHA256
317879cba418a8f5209a9439fc82036667e107978ead06de81fa110524195a15
-
SHA512
94c736644799f9e32a0bce4cde479c93b30fee37222d01323007f942885cd23b9dd7f62bd42ab650fa401fc603a38765201b52831347bdcd3378c70bde9b4129
-
SSDEEP
96:9B9f+BDfO4qAwNj3RwdMCCdFU6sSgoEetJNj8jWMYqNTSfOnjq3ZUtBXs0:9B9fo8tgbW2ZWEMJNj8wqofOnjqJUXs0
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E9B98DC1-1E77-11EF-965F-FA9381F5F0AB} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000121d9006cbd184b4df25f1b7b92ef38aa43d62015ef6b11714537c2caa04a709000000000e8000000002000020000000798729d2bb36569d5e4edf4e4d99fadd209e4daa7e066644f34d6b4138dea159900000001f5ba5739e3c657c7440fa804e2be097742172cef53dc58a8279688e2939eae2bbc3e51fdfcd8aba50e3de4ef491628024d7306256d8bbc38c274f643933c63cfe5489789afe24097d637a0cd34d6f94712c14fc7ea94bc249458292b0508371a4a0f032c671a33c0221e92313c68f9be47d004315e4e55de81d830d54aa19d65c4705e1c3ea47d31ee14dd9d53a655a40000000cec38ce88afba932d230757457b94750546f130a054106cc1709b98d3eac4d07924b1e5c5d42e389a6e01a8d997304554463e0843b53f552f1ea6ea33135a5bb iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0b540be84b2da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423230452" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000001b2a847447b724f0b0dde3d0635bedea46e130410c5077126bf107b252098889000000000e8000000002000020000000176bcc3808d009e21b0827985fb73df3ef193a043256b6f8660e91dd7004e0f92000000077d46b1619567f0baf0073e6f14e3b430f733dc81057832b3e9a83bd60098ad340000000f4d62489cefd829c855091b92e2a03319e02c4a0a4045ae6a78130755512597c8216921e6578c49e202fdd09c1f1b4c26663f3da5bbb9491f47da342f98eb651 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1264 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1264 iexplore.exe 1264 iexplore.exe 2216 IEXPLORE.EXE 2216 IEXPLORE.EXE 2216 IEXPLORE.EXE 2216 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1264 wrote to memory of 2216 1264 iexplore.exe 28 PID 1264 wrote to memory of 2216 1264 iexplore.exe 28 PID 1264 wrote to memory of 2216 1264 iexplore.exe 28 PID 1264 wrote to memory of 2216 1264 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\84130a016a503f06d38fc43c2c643cbc_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1264 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2216
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD571d53231bee157bcccda4601098af1ae
SHA11b69ad207778ebc2bb839dcc564a96390cd5fa95
SHA2568937ea67dd80bb3a01598be43d1016fc99708d47afe5a9b93ab1f32ab302a1d4
SHA512413f4c3003f33b6c1acb61c2922ddd7a93de3d6fe1187146f22dd5b431785e672a03cd4765c5890fde95faf72ba17594028b9cbf1d5ae9306251077e1fec81d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD565c5f2a3f07526d28e973afa6e2c4179
SHA175c3941042c24fd593b9d607a306fe9ce4f01506
SHA256531235c65d8f7f7abc9c11dc0ee8980d60fe1002b63a21453e90596bf00d39ce
SHA51296e11799876ca7fb9de79bc5df47bdc85211f2504ead36af413aba00acca7a25175a3d70dab4f6c6c1a54babced94bac6c53e3cf1aa1903aa14e860d7108f226
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD535f5cb18320b695d6b724bdca70e654d
SHA1dbca2058a72bc4288a9e0bc79199d8616bd6fc16
SHA2561ef412a62a61cfbf431c45c46af82436f48d1d08db6afe1caa16ef63fac06ba0
SHA512bd8b58d20e9a3f662c72da9dedd59c8e10c79dde4b4f7a7ba56b466fe26a90ed64ab5ef2679d50152f7852209831c49c541632eb2034c13aaa625f3b47e70c0a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56b2dec4a800cd86a932aa6a8321ab861
SHA16b40ad6f14413440433a0b59b57239b19e5099da
SHA256614819f3886062fa11f337507ec459b247ab195e7be8b766ad8ee323cf45f409
SHA512984dd68d1e0d59f4eddd6fa27f150081630fcc87c99ac227559abb7e66013c8b10e45d00a79478a8fbd871cc4ca60798d5c7c8167e4cd9ca10649c2679b91982
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b6f6ee092e9c4c84098f2d83246eada6
SHA1753d1b9687f8ad13c72c0e1c4124d47c04b8cbaa
SHA256a1776d005018d11c2340ba1fe693423bef0d1bcf04f05d8b00340565e6899366
SHA5124f184574667a3aa31e6a75c6bffe8be37ea39d3e659c3966bb32bb1d1d04d3cc49de4108b7bc923d056f069d0f4c6aefbe01ffbc111b8ce76a5c027276d3ba5d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5237e81b7227ff71bbadf4e07b7a247d2
SHA17170b2955a05b3525fba1ee31054e3fee2b35375
SHA256850bb564f35dc78a52d792a6fb21237d7356f714005d44fb3e6a88b01461d254
SHA512ca8cccc803f3c8517db3ab3a6fa33478217644603d88a88586f131fdb5c74a01e5d1dcd8861ef08c928d6ad30b1f9ecef1ba82167e952e5283973e032568eca3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a2a20acd545b50cf423b50e79cfee133
SHA1ed9e9470fd5570c834fb2765684889d6ab339556
SHA2567a17e8e7b350f053787b700fa34a68d5ba7abfcee3e29df9516cfc17653b7b2b
SHA512053816d61df25c3e3fd93d98cb924812909097bee8c0f1becaff8413008e86120d289f7cfd5022264960ea6bf2a23dd2cea606224052cd3a9febf8888108e24f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD584db7b2423422d63e4645e843fdf1208
SHA1fbc607f546bc49ed91eecfb59dd5dd4abe84fc87
SHA2561d3831c2fe447156dd7115c9f186e7a6cfb51c773275d3cc017e9f02b07f5794
SHA512b23a0bc5fd4418e2444562e3aafc4edc333987de33b788c874f709f3dd5e6763ee4b4e38be0ea08986f2bab194078264c9ac4949c3ead51c06c47af49664f520
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c44b7ffee8fba2babcb97e2642bbf31e
SHA1737ff49c989381f6563227355c23f42dd5923217
SHA256c2b51268789d238ea2336a80588c74cdb17896b7368a186bc3b8d59d347e8784
SHA5120af13f3cb6580aaaa0c2db2217f517806ff219f74ab601d999e9f31731c7d20ca9b8b9a84da3c448567ab648787bba4dc90111c9ae5c409f932894ac1230726c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51f664f228bc23f00675a832c1f0c366e
SHA1a24d703fc2c39e9e0084686c6efe2c032633c2db
SHA2565b55d0ee4b653ff1c0c54a9baea231e0702b85c0a3b1693fdc96c7a90c8cf273
SHA512d4c8efe06e9890710f6bd49acf61ff79b4a61c70bedae77035ec3f7a513136997b09dc8aabe4633fc81fcc59fbd6ba284f349d905b4e6a055185f01004bd884b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bdb9f7a294312311b74ca95beb150b78
SHA17f4045f1712d50ec3807d9ddcdc9fb27b2f8c1cd
SHA256e88815489e2e59d3621cefe966d8b8172bdf23a9ebe2527ba05437fea51f31a2
SHA512a6997d26343d4f1e4bcf4d4c40b5ff9e7cdd8f640ce036c5485b559f26be659f7392191ca89ec238b291d78f776b856dd1e88875b76c60ad1c2facdd644b61d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54f38104648792f588dd7cd5fa0dc01a2
SHA18150493d520e42aa1b1ce036f61eb92aefd1834d
SHA256167addda22fec4a7e80e9ce972b673bd3055b30b021457862b4a008dafd71b0f
SHA512b028996d6852427d4b23812d8f7703a9d0642435371356b8c6c7e8beb2eaf93fe8c6f09bafeae8a329183d281f8c6efb74d931c46b38717aa3fd651af70056cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c50f3cd36f3218cbc8e2313fca98479b
SHA17a3f58c6ac67dd8bcda842bd8598fc185fb46efb
SHA2560bcdfec016376b954425c891ff3271e7c94da65f49545f5f6fc61fdea4bf966c
SHA512bfba32c3eeff7ab570c9d8c0824c13e4995d4375d8a00990dd9bd49466fbd5f98baa7afb3a4a12a6e7627496ac4cb24dda86593391fe433666ab5e8d6ddd434c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD522d8728fc2da7bf6bf30a5597ac99351
SHA18331c96b9ea220d3981c3bc5311d058fa1d3e209
SHA256c6308c64741185331b35c3320dff454c6bd4a61a5e1856a8aef05a16c332436c
SHA512d30d97851256e719137678e9155eb47394461f9b781fc7208357fa84536ae1f0b1dde4d103a5a8ad41a8c936986cca505f9485ae480b72dbc3cb2293fc9fd4ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a3e30fcd20e695f1cbb7e75c29cfd453
SHA1d4270f63eadb623200b2cd4a78748b2b89c9b069
SHA256e4f4404b89b9a68aa1f1436938405a9efbba96c2be775bfce41ce777ba7ecfd3
SHA5124a361b7f30e69c70265585ef4dc42736b5e17ea84dd51f541174993b361e352b68ce4fc4e00599a5eff9c9e003b667d36f6db87fa27a7297a5855e2399cf2f46
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD556cb31c1f5fcd21b545ac327a3dacf6b
SHA1e516f5f381ab963f030658c62203bbd28af22c3d
SHA256b5251079be8c94471b9401d84756b277a82618d95c3c69aec858ba697a66312a
SHA512fe04307a9e8a578ce63decd5fbfcabc2483b008838f0f661c293d4b015290ec1926801dbf894c8833d0ef8d71cf2cfb417160d0921f8c1798c3ccddce34b87b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD519fd3f98db8098f00914526dea7d38fb
SHA1b891a21e24fb86c681cbd016186e53e87d6ca2ab
SHA256b25b0952d8619c3842310456be4a1910f198bcecde66edcab2a5f8c16bd7804d
SHA5127429013abaae4659772f842ead5155c1c8eaeaf2a970f5c08dde7d1b4e98001fc755df0f4cf050b4aaad2b29ef96bcdbedd98c7b2bdd34648f3ebae4828099dc
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b