Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
31/05/2024, 18:25
Static task
static1
Behavioral task
behavioral1
Sample
87eaac7a389e30ef0955389fe27e1c7a_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
87eaac7a389e30ef0955389fe27e1c7a_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
87eaac7a389e30ef0955389fe27e1c7a_JaffaCakes118.html
-
Size
460KB
-
MD5
87eaac7a389e30ef0955389fe27e1c7a
-
SHA1
4a04dc190d310b6f6efc45185a6e094b0cf207a6
-
SHA256
d66022a83cc8c288ce41eee6a3c39e9179190178f8ae33ee3a993e3d9e7eeb56
-
SHA512
8d2f8c6fab16ef307bfd5576d0073e6fb7d4caa78e29aab5d101b616b3bae0cb8e7f293dd69bafef744bd9ead94d1617e44aa49348c79d566a8a835491914223
-
SSDEEP
6144:SCsMYod+X3oI+YUsMYod+X3oI+YqsMYod+X3oI+YLsMYod+X3oI+YQ:75d+X3U5d+X3q5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000e118739dccda2f11414163579a35894575c03d3993608ba62109fbd7a55e8b9d000000000e8000000002000020000000e9a1cce4307563c7582df6c69b17eb6853e932b5c8c88fc1dfdef1f29abd18e820000000858a8a28aa2941cffbe2d62006afde63b6f0a9e1511948254a63482dfbe2372e40000000db9698ec93aacc0486d6792d4728cf8bb66df48a17c1ce2eb7f9c17a1221d59c568cddbc9c6147bba36482042f277c6fae4751e114e5f0ccc7d44c4612ba6b0d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{288AACB1-1F7B-11EF-AD44-52AF0AAB4D51} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000efa5425edb7a3fb09abb3089ad880ce12a9119ed527866b9709c081ba466938f000000000e8000000002000020000000bb68e2d125338826f806cf8c0e82cb564536fff7cdbc37ed8b69ea119ffb1703900000002306d095190dbf3a6a07b56f11a750a2057ce8670cc1ec32ac40f5dcfb304616f81ad3293f852ad164a9d1ffe8d5c70e881254887fef58271ba988dfe0eeae89344589a576d550f1a5649ff4e748a32293f17ce34e552536f9e1f8d40b3e11c0bd1e4894788f2937ca8d9ce2303a2a070e281ff15c7343d13cd2564ec0986ed51ece6546943e8209cb0546ae0eb2623140000000a69d515d01ceecd7080663ed04fbcbd007474c9a993b27cd7203b74a3bd2ae31f62b93c0af1f0190187d8498c47e3d1ff4a52dfddaf1409e13218997772d3176 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a07f1c0188b3da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423341796" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1964 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1964 iexplore.exe 1964 iexplore.exe 2956 IEXPLORE.EXE 2956 IEXPLORE.EXE 2956 IEXPLORE.EXE 2956 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1964 wrote to memory of 2956 1964 iexplore.exe 28 PID 1964 wrote to memory of 2956 1964 iexplore.exe 28 PID 1964 wrote to memory of 2956 1964 iexplore.exe 28 PID 1964 wrote to memory of 2956 1964 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\87eaac7a389e30ef0955389fe27e1c7a_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1964 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2956
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5582d32902d12c98672fd0e16dfbb258b
SHA163c3fd86c1cdad584b2c16954cf2ff25fd210d9d
SHA256d85ade06775c5ac40827b6f78004ee5500bfc8315e9d71d8798c4b994ca2f9f4
SHA51233dea46cac441c4c53b8053c2891902b293e1e3d87343e9e2fd2fed448ff1da2f6c9883f8ecaaa8bb9145d5603dc744fd4aa2a4c433f75adba10c981ffcf1c15
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56e2cf52855d070c85869039f7ac85be5
SHA16cfbabbb0d329b289d82788877cf7653dea5d595
SHA256c381d3874f06c57ece9897153bb7cd2aa0e05474e82d9a0a3b59a7d2fc5ec0bf
SHA5128a3f2ae3cb5762e1b5c6ffe62b7bdf8e0d545b088e75410689d7d60597bef1a28ad4c11c48598c62c013fd08b153f287ff3f44d20405a3aa1c088225790a55ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD591af6be28b6c5a8907a0130e180c2972
SHA1d511265ff6c72132be498499ae000b55526d0c72
SHA256d86fb3541435bac606c4452c6a3596fd1c05ee770706db8c89635105bdb36f61
SHA51218333e2367a679d4f64722750552e853c0465b6ff6fb62b8f6249c247685f17d47ecdefd1e3d0d9e51081ecd210576be96af9cd928c3366c477c4e7a331f7852
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD566ce9b71c98818548baee117cfb2a912
SHA105f77d719f3e6b799c93fa5b2f61b45508355af1
SHA2562e570d1636ca8ac5311431b895602da8ece56b08a1b0e06fc69aff52a0929630
SHA5128b4370799ba0a41cf12c001a80739b1a4c7b52183149f1deac9f905684c6486816d1dbea8e62a51ada35961c194c13a0ad8dcaeddec7a26151816b7b7efe9160
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD566db2dad0a46b2eeb34e1e7270f50a0d
SHA1109bcc419f9d9e6bcd5eb6103d4eabef8447db74
SHA2566032fe1402dfa93010a91e100866782af610dc8578587f4f36b16cd10eedd292
SHA5127043cb3ae3faf2e5136b258c765cada2da1c9c09e8ffe8ee890fb5fd0ef890a3fbfaac30d422610461a2676b9feb61167159c23407c5298d088530d9aa82c5d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cac0a6464f21bde0a11ca55f2eb38e8e
SHA1df3eae265da797cef440ad2e10c363ccea0902d4
SHA256b2b15f69004a4455aad8eab7928e2e6336c860506e9a6542dc5148f4d697be73
SHA512eee06cc4098cef005ba0be3a105b7bde5dfadea5c782b367de138f7ac99fa46d7a08c32e26b56fffc95b535eb9340ecba2448cc6f0d64962a9ec927c04912beb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57f68d0b1664929fa3c06033fccf24171
SHA1ddf3e07831f8a0cfbe92b3792e937b6a8326dac7
SHA256deadb4b7223b0e25c66c9ca861c8a7849c661e0492ac5eb8de52b8a8f42c1c4f
SHA512932fb81a26d9c14323cb0afceabf46e00691e08fad704b6da1bad008a8bd7b8eb1070749e960581a4fe0db2003c2b3c9e766e4b6e853ed91f1dd892ef08f2a4b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a10e393684be1cb7254f9a3fc441d470
SHA106a25577a314022fa0f6b700da0518468f79e5e4
SHA256138b329c03e1d376b1db535a0c11b1c3e90325449e7965a6e5d3726a91d6d9ba
SHA512418c2b03b705983bbb36284d71eb85cbbdfbc86adb1e26c17b773ef98bcd3128b51e87fd8909bef05c224b14f1712c22b74edd4206ed8b69a16dd7a3130aa8b1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f9ee206ac68afaeb1100648535119785
SHA1366b8112cc9f0bdbed8bb0a279f064872d48c9a8
SHA25646efe2f22fe00d197e3790345b1d7e32125273dacc47bcead8694640c668a04d
SHA51287367c6dd715f62cbede25b23be4c1edbc8bd8d399f556821595c6fe2eeecc757fa071016361e45ebac5867d8217ca87a99c3644c1fc1abdc4d71020adec9e8d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54f15aaec6e09f9497f0111a953298081
SHA14fb3aeef190450f78b4a7dc112abc997e9c673ca
SHA25621d11b98bf84809b2523966d6f347c5075533c0cfc8eab106bab1293b5ee5d15
SHA51239e8f18491be112675c009f6cca4811626c404969856405477ad29abc422cb42b7752151a63f6865ddedb89af406744fa51b0a8898e4bc7f11a67db7122ca4ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51eb33377b78c2912444a468e44f48bd3
SHA12d1a00af6b7fc16ad0685bfd3eda00b959f0453a
SHA256a45b6ef139dea38fedce3bb01db367f519ac1af7aa9eff1ce2d7c63be0e18133
SHA5129aca9aa3ee5333bd073f2db0d07641339a82d61feb03fb1ac5b5220ebcde67f7c90b8693b5311af23a4a7793a9b05eed9f0cc506d32703ff5bcce5502b46e320
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a18836cbd75c113749845d415f9ab970
SHA169dfb84071fc34899f15822bf1d4fc9e94c58242
SHA2561f4c0990b1caed2c60537c72bd0622307e1c9f2152bab8d8801478db6f5afc9f
SHA5127797eb5504cd21bd4d6af9281d3b4218ceee1fb25ac0011bb13082b33802b1366946b473a3174bf699b00bcaac9e7e4c7826761bb40168f9ac0d867c7388d8e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f0d60b31ea2b00e7722ffdda993f94ed
SHA17e1ab0ecba291da8bcbdabafb296da9f0934fb6c
SHA2565961a9269854d5ef2bb586f60ae733f977098dc85339648d2b389a0d06afeae7
SHA512857295edd372f8f8dfce5564335f6f41a634a00701f4a56892be804d4ae452315813add979df09c50e1e97152c7ff8a9cf7ed06bf75705dc40f027fee83a5813
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ea167f92d81aa63df69165d403d106fe
SHA10ab6fe1325753cbec04e705c0a6c4e0f7ec80f14
SHA2565a4e3a8b824fb2c2ef6df403f21acf1efd2ac5107aaf78ddebb766d0797d0b1f
SHA5123b902dfe64293b47eeae645a63dd039862e55318f9055d610aa0bf3b77acc9b70e70bea57e7cbedb1c9cebb6571d072ac0dceabdb5cb979ad86a81bfc9b8736c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD550b506da5c4f101a0a98351df2b13065
SHA14ae61fd3f1d0efc735d85af1c2e4cb96cc0bde95
SHA25637db9a8b4a538aab1c6b13638126b8e1a8e96600aec01e8b04745406ba0e80a6
SHA51283852f6c120d636b03b2f9d3060fdae352a417d861382d9b5ce0e3d8d557f7f7a82c9c43c620996c4247fea052334d9e9efc5b3e20cda6832f4da30e1bb4064e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD590255588b093248e5f16f5d32bec625e
SHA1b37f060f251c9e80873bbec8f3552770d9fe78c5
SHA2562d889adfc84cf448ceae7eec59d4ba8bd8ebf93eeb2bd27c5b66ad6bf837e093
SHA512848b2f9588edc02f9b4f9055667f37ad0317e172743a770c490513e084d763a7f5a013976117146785237d5d258350d16d3333be5dfcbd0207a578f733c04bdb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a966855126c69da07c89831037fd0cdb
SHA19bd6d9aff97e965a7e5a0f0569fd70f29b669ea6
SHA2561c359d81d16102f6dacf7419ded20977f3ccba09bd89d809a2d86b93ce99956b
SHA5128bd3aeef160c8af3f2d69f69c916f84477d15b92459fd786071c2424e9726542cd014e3cec8334d3719b0543f8585419c43df974e9170df3c641b645b68cfae2
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b