Analysis
-
max time kernel
135s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
31/05/2024, 15:29
Static task
static1
Behavioral task
behavioral1
Sample
877be31fea9478acbe2c18bb8f448499_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
877be31fea9478acbe2c18bb8f448499_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
877be31fea9478acbe2c18bb8f448499_JaffaCakes118.html
-
Size
119KB
-
MD5
877be31fea9478acbe2c18bb8f448499
-
SHA1
9a9b41f74d42f969f0722f68708681ac69e6fd4b
-
SHA256
f25510761fdb3f3d0c1861ef12de087dccee6ee1fe490b30859559d7f3495d38
-
SHA512
53670ac41f2627967eeb11c5ab67dc1c8c3c005949fd53776209f623767b3c6dcc875b0c24f10e6f28560cb97457feb5686013ebb5d79fde604747d67074f8c2
-
SSDEEP
1536:SFmrSEyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dK:SayfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d032a28d6fb3da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fd7effd603edb94c9314bc49902fddad000000000200000000001066000000010000200000004a42c32d1370433a272aee5446ab2139d3047173b186706cf1debcafe2e719e9000000000e8000000002000020000000f129ce370727255ae5e0bd81cda542f129ee729aec693aafee481b945bb713f32000000064260721ddeb389513634b4b47f39c006ddd57b4c070a018a5ceee41610021cf40000000fb42d31330693e3dc28048de9c91c14c69c82dba9127bc1a046156071733f7083448b30f5beab4c54c421302709763cacfbbbe0d2cb41c54194f8f678a645fde iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A0943411-1F62-11EF-A6AA-4E798A8644E3} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423331262" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fd7effd603edb94c9314bc49902fddad00000000020000000000106600000001000020000000a795d580097b45c8c16866f171b2a2976e20a4fad8d4a054a67896c833c1f805000000000e8000000002000020000000b31c41ab4659a5d49c7b3c058c9af7db93caeee5996b34b350746ae3285ae90a90000000c14106f554205c6ad507ec58113c4af9cbfd8fdd311a2c30448e2f58d0973488fe008513612e62b609df77a47f77f64d4faaf245c6754154c12d53053aab3e7ae3abb220e1d3b99c28f25d75b3fabb565924708748565160157dadabff9af9ae81eeb1b43db5a4eaddc682c11c10aabffda6ef3c8d2311edd49c0db409b5512e6e80a4c0428fea605a561a4573599dfe40000000c7dcfd8822a635e0571d52e009f0349167c82b7508f7265b997a5a347c6ccf5cc824bf638073675a14005a02efbe22d2f429aef1596e1dd69437075bc42740e0 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 844 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 844 iexplore.exe 844 iexplore.exe 1828 IEXPLORE.EXE 1828 IEXPLORE.EXE 1828 IEXPLORE.EXE 1828 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 844 wrote to memory of 1828 844 iexplore.exe 28 PID 844 wrote to memory of 1828 844 iexplore.exe 28 PID 844 wrote to memory of 1828 844 iexplore.exe 28 PID 844 wrote to memory of 1828 844 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\877be31fea9478acbe2c18bb8f448499_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:844 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1828
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56ee1c05fc307c3d3072b7ae9644c3b91
SHA1a674fdf236c50d9a8b5de29501b3cb8f2949a9eb
SHA256ac3ca692677e67168eaee0b00b884ebaf44afcba69da344a88b2876cf96f3c32
SHA51212ad9dd2bd871376c52442ffaf4ec12c73e359ae4d7a3ee41533c722e54b9f6f5547f9077a2d45ed834610b45062b2d5b43635657ff50bda5b21442c86e1a30e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5779914343d5662826837f01b4180bc88
SHA197879dbe23b02666cef60444d40e2f6188216ed2
SHA256e0de19872205e0261ed1526f4fa3a170a08ba6547f514159ebfdb82873a70566
SHA51221f54d237b3d4dbfe0807201708fe45bcd0a737d0aff77efe8c79687305bf7147e9754b6cb08f2fb01eb5637298aa5fceb53660553e7cb9860ebc20bb94e250d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD565f8c8720abb6f90b863f250c7ebe65d
SHA1cba0031261e1620f864d2451639f339353637f23
SHA2569888f65181f5c4fd866395f803c134338506b8e50b99018effa197c46f1bc80e
SHA512d9f217da3b0cc4cfc4670778d2d561b555adbada411a37cbd9129a3abf15f17f5ee84c429276b42fa1e8133949c231e359010aed1b059c6175832e5f396fe357
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD501af33b7d6649a77dc4942f40d812172
SHA154485dc969b48cbfd37717b5b166ad1edb4adc85
SHA256e320dd3f2aff964d4fe2e7abb576d26cd6a77413b6bba9099ab38a12abfe7fd4
SHA5127fc5e4468cb41c91d444c601284c3d12a26356f4fc0c0420b390807a6aba9ed4353ee02ce6457cf60ade777e498439729df255f87efce4a668ac922b55e4763f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d76c34fddc32bf541ff7b41c4cbfb621
SHA13dd18404ad70cb615e79e17094914dd9d3b81971
SHA256c9e908925c99cdc68f062ed466694c5255e85fc0793b881e5edc2533cc54c507
SHA51230e57eac7079cd34f60ff30e95e88803aaa873c4a2f6abb8ac470df0361060ccda6321754fa2ba23d84ba0f87df9eedb933b9553f5a4a469cf1790c1f6e94539
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59d9eb6bac8cef14dde1f99a7a3dd09b2
SHA1fe75f3e4401939f9463073a3646a47d2aea91a74
SHA2561eb15167848d64c4e637ab265e9b3ec5fcda44d8712a943ada52db82d06f8400
SHA5123b0330c09830413b4be15def48e7a5ee7078a4ff699206d5a5f78b109894710cc7122ca7acf4615559243119701397175bfead48d5da2d204855b8b63e465705
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e3595341c73a3b76387f0744d58dd950
SHA1cabb5f5adbef9c08a2d586d7a87b5931c4d9d908
SHA256fd3bc5ad4c455710724bedcefc8a1c5e064ab0e0f45cae775d2305492dbfa099
SHA512519b97de11cf2cb47d5bf528892b0994e7b22bfa2baa935f3f5fad26293691d79be5f1167df263db3ea39a74e5981f92b1d01f25677bb94c3636c9bb8380f5e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58eba9b4a3c273985e28faeda5c01b2bf
SHA17278f5816a3e797b372f6d870ed0cf9f374d677b
SHA256e5e119a88adedf53791b62b322932735e89f605d3e7f117125a4953f43a594e0
SHA512cad32a066e3dc92a1d3ca858df50f89d4e5392d1bcee690ad8931d05703683e702a08c51653b30f33f0ac5277b157e9fd7f3ff5c77b181aea573d5d54d73b8be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ecf1ffaf25c49ead1997c0f68af931ea
SHA141117b61cd09d593a320b95b2427b22721848a9a
SHA256c0d5dbde856f0c6c77b668234c135613e79f955e9e67234223089f218a6fcb32
SHA51278bd9338c4df2eae89ef58aba0ddd35d268df1d87969178159b57a7674526402990119fed98b7517a7f15b4cae036d0c253b0be64d85d0e7b2bfd3745b7311de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fddaf05e393f33d631ff797aad340a8f
SHA1277c9dffa74e4bb9e861721dc72acae703515863
SHA25607146c8ec75323bc65fd6c6d5894abfee718677a88dbd57cc520cb4bffb271b3
SHA512537bd2d1ece1362bc852e8a440a0ebe20872846e45d30c490532eeaa5816c2e7f3a74ba97033d85af921ed952787795ba6bf4fbdd42960d4c6d9dc2a5f32c64e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cde7b1b79bd25c4c2eef4bb5e4286d6b
SHA1b03720a00867f5a31b1fd76047f8b61f0d52b5e3
SHA25661e65e6f64953d130680dd86f1bc5a18ef6bfec5a382ad57a8d615b3a0ed3cbb
SHA512ff814a0fde620228f81d719ced9e50e8ec4f6f8a9d6825964cccb5b90415a021b9a196c120dcc64ebe90afdb74d096a24755b96566acf11bf3722d73bc6f90ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58170142f1589e038e3503e52c3c1952b
SHA1247b9b216ef9bfcde14a4cf4ad71dc96552a665a
SHA2566889c44bca26121d1a74da2fe40335786d4987f681de7257452f364cb6218946
SHA512d85a752f125f2387b136ab8bfbc9388d9c1a23cf36210744d8a2efb402437e18212e1994e0c422def84b00138f802bda1873e1c129d9f14e79a99e43366007ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d068d020baeccc0d64025b6f5ba88693
SHA1e51ac8240d2baf3b240196a9c32c4b7231bfe84d
SHA25607af944721ae07502e7b4430ecfd95967ad6b440dbb1e89726e7e1a47a75d917
SHA512f86af95206fc4859b5a655b7d5eb4e2ce1f1ec0b2a1ebf12d3de00199b3b7dde8e648714547abf6e73267379f15a659918031d44005366217bd799e0b813c33c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a8daf9ae61d5b123bf27849eda383f2b
SHA16aa494e59dc1aefc1ea9be1455a6495f580c73cc
SHA256ba4e33021920adc16d9de4ba245be0457ad8daa85a1bf86be1624fe331f5297a
SHA512fd51fd72e11ff52b5085ebb3e9df73c0b3f55decf169435b58923589b96a2737dd0799b3b31ffd07cab211404823765855650cba819393c8887d78befca06abf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50bbbddd57f423d87d8931e17387525b7
SHA1f41c64fb7f74f149550c03938eb74c77b19dab61
SHA25645259118166f559bd7483e81421673b85715edf4f2946cbd2789b5c228666fdb
SHA512f2674f4ca8f3391dd67099258775d6e01f1c635947496739b0f5f4e1d31308559b273a92d445814e8373d33af3638f35f88e6d55eb99d6b8291821f4bf416216
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e8076081f98817cff7c80cefbc9dde6c
SHA1a222959cbb741fdc78cb43daeafc2bc350b57058
SHA2569dbf4f774338307db8a994802be1eaaf357296faf9b671b149f4f322bb25852f
SHA512660f7d55cb4e40bb93899f748efbce4048bf6945ed9d22556c5ee4470ab4c259e3f0f7fd070fd2084b0610e57818aefeb4f294024031f71552b0bd6a35231fb8
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b