Analysis
-
max time kernel
139s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
31/05/2024, 20:00
Static task
static1
Behavioral task
behavioral1
Sample
882cc457b69d68e85259b029344f5406_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
882cc457b69d68e85259b029344f5406_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
882cc457b69d68e85259b029344f5406_JaffaCakes118.html
-
Size
70KB
-
MD5
882cc457b69d68e85259b029344f5406
-
SHA1
1f9fed31f3ca7256cfc9503f2da1a3e8a1a4e72f
-
SHA256
24432c48d7fecfeb9907658992510e6c496f4e4185f8086aa8ad47a72b1631c5
-
SHA512
deba9c96812386c10976939abb47eb66f4787711999eb26c256bdf142fa6db6130fd2be447969468a0f462175851cb8f50e3b014fa084179aa357cd4ea11d3c6
-
SSDEEP
768:JiepgcMiR3sI2PDDnX0g6sy6pzf/kgoTyS1wCZkoTyMdtbBnfBgN8/lboi2hcpQV:JOpn8TzNen0tbrga94hcuNnQC
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b10f917b60a1644bb884aa89c9c0007700000000020000000000106600000001000020000000320650cb279efa3e021e5db8beb1099b87dc22a586a55dc46ae75a502687c989000000000e8000000002000020000000628a98c75f5d597f0ed52c736f1a6691c4b66fc95057f661ef440faee9448f2c900000000dcd36084c55f77435d64ae861fa9aa8c2714e8e2e525340e05db8754738bc619e6dc585316a0075ad006ddf31f0f8fe1d178add73cb59e9ad464216d08abbbb19f16bcdfb44a96d8d05225be1a352c004f374bb71dc0c70c19c285ffccab9faf2ed87db31d387763140ecf0d37051316b11cea7cc52d0fbbb1501c5ac84c96414662bdceefe33a43c9cb8694c2eb44a400000006bfdc22314293e05ae018701c560c668abbdf52bf667e50c1a3180533c1446a0b06ad42fe9daa28682decfb3d33ee83689173c47fe9274c053c893bcf8971093 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60737a4695b3da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b10f917b60a1644bb884aa89c9c00077000000000200000000001066000000010000200000005144043ce6486a7664426cf773b1306366a64eac96e22d8dd3843f05f56cfb43000000000e8000000002000020000000ac892dd1d0cc62d0a62931dbe6eab75880bb69deea04e9e920a1f56e0ccf20ec200000001589db5193e00a21eefe88e0a38b223b729775aad741cdbf548cfb474935dd3040000000a8736d8115f75edd6b754eb7712886b36ed925d2c5d4dcac8aa410943bcf2b88f5a636bd5b85216dd0229fe64d76eeb4d0508d51e330f177b408c3fee385170c iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423347504" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{719F3FD1-1F88-11EF-825B-FA5112F1BCBF} = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2204 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2204 iexplore.exe 2204 iexplore.exe 2984 IEXPLORE.EXE 2984 IEXPLORE.EXE 2984 IEXPLORE.EXE 2984 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2204 wrote to memory of 2984 2204 iexplore.exe 28 PID 2204 wrote to memory of 2984 2204 iexplore.exe 28 PID 2204 wrote to memory of 2984 2204 iexplore.exe 28 PID 2204 wrote to memory of 2984 2204 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\882cc457b69d68e85259b029344f5406_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2204 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2984
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54f0b66733a6ce059980697632467febf
SHA14ad020973351cf91aa46aac60c0466eeb91b3f09
SHA256a745a59e43b4994d7e399b1794cd44c9a77f502ccb126b01cbac5fa05f6fdc64
SHA5121e299daad170d912682046d43fc63de2250fbf477adb8d67312e3fc5d66e75b7cb18909a76eda480460ecd5e828353d6750754bc42e616eb9d9d1520c63755f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56a716c6750003062b1959aeb354e58b2
SHA1f633c7ed94b5771f2f02df6249d1fa9cfc887467
SHA2566e110b1f208a34e700df940afe98bbb7dbf23cb34af2dd20780c8a948fa867da
SHA512825d75bb1255f1e695360a013706afb582fd86d11e3402dce024bd3e41e01e0716c6ea8d4482229ce4f90e964beb241caad6c74c826e6479536c3aa9e34cf6dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD593a169613309f7e14e765552a28a960b
SHA18510fd91e6074314b7f83b6d5d86145f6fc40878
SHA2569f948839bec8b7a54eac1b7c51a300fd00f94a8ae77ff005d2ae636d234e608a
SHA5125c971ed4891fd6e0db3d81b43957d1b93cad87e840ae8dbc30432d44cd728a6da6df61f779a1bfd5bb7cd7c17d6555acdea91c06c1f1be40700464f7b8966c1a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53a023a16da938c23e8fa959e0505ff29
SHA1edc90137ba8d6c54f1ce87a59ac7ed5dde445dfd
SHA2568601803a59d406ea579d39eb34eaba52c993fcfc90c620b84777344b63cf971e
SHA512577f1cf0488a3fcd031e21d4e27dfb2076d1f68ab21fab6f0edf6a03a9611e8381be5608282890e3f75bdad85efb2d0b74aae476c47dccba5f0351a28c3e8bb9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a5adc40334dec57656f9e564698f1e4a
SHA1fcd370b9d744c26fb5df2e28ad292f5220252c3c
SHA256a64e366cd7014c7a2cd67878ed22acecd885aac92bc27f30f19618e8eacaa096
SHA512018f436c721361639f4f306cfbf27765902ad8d0f12213e32ec8d76d2d5a6820ade6bf0dbfedb9d9564eb6d3f2ea4102c4390d9a08c98a0ba57e834b60aa1f55
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b7e2a982af9c8c6c29537a9ed93aaed1
SHA18d6b54c724380ae2ec7ae2982c258711f11d5898
SHA2563688623cc2f0ffa02a91a1bd336c09cc7eb6c4e5a37b2b12c05a4bc8f5658994
SHA512bacd3345d3cb686cc89653559120aacca25dfa21c39a51701d52c8ce89ea30093337794bac9c4f89806d20aef5147d0006ae084692e09dcb8d10257c000675c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5327353fd08e350795f0d41d85fbb7487
SHA1ed3453aa72383fa9db10546a815bd106bbb1c13e
SHA2564f165fcbf3fae7da42bc440430eecf84ebc75aef2112989714eaa097098e8089
SHA512ec84d77e93435f3318d7fcab447588c98d757c034e990f29e684e3d45d803219038f81a86b57ece26e7393e492085665d7ceed5014c2ce04b1a23fab8e03d0f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD593e2e7dcd8872c430e3b9f7209d0406d
SHA166cc62603554206e3e0d2449117df8bedcfb83a5
SHA256f7999db0a697e575ce7e41e1aca0ba5c41c85085ae4df18e436e58e4cbb111b0
SHA512ce130f89a18f770678675d074ad6225b86d6c0b20c5ad084b62bb0b68d852765221fd4ecc3a1f27e151145ed29baabb1a7132d348e831e476c2e70834c0f1452
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51ceb38a7acbf18e9b1b9acddd288a075
SHA17e205841c34bb1990c480b3066d32df2838d0e84
SHA2560b109779df5ad505940e97ade3355b84dd5030acb5d25b86a2aed677dd9d997d
SHA512273a4f6c4592ee23de4fe6585b45b297f761a6f86070a1f3663b9015f8cd3fc617f1b6c93373004b050bf94ad6d6fcedcfed6898daf060d92bc8081445586cfa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5980c3d8c689de2247f77e2b3e3c66cb7
SHA153cd87843dd3c461dfac804f6e845c6610cc2ca7
SHA25611bbe501655e15f04fc7dbc63d5f01c8ec0eb30368bcefa8565bc8e08cf07507
SHA512f5c3c8bc3e8cfd6fde5ecb67be69c69746b591df4dca30bbe9eebfd08e627857c40acb06f0e7df5a975103e2845db7602a0dc4ed46cced7b5eb9e2d7ff603ed9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c07bfbbea8a1f2df7bea1b1ebec0abb7
SHA161230260b787926ef3a111f8d25cea0b9ff5f801
SHA256b1b86d2f58d52a27b983be4323e2b97fe5af6ef974920406031d1968b81a9467
SHA512b6e83a48093d9151f2d0dfd507c03b7a74580be1a025720a51d494517a442cbf77313f2f2ba82744c42f8ce4ff435bf464c872c37f269029efbd42c72160db2b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58d8d979d0c6c85c35d3a37ad21ab6119
SHA196ab503cb5caf2ae05fc65e5f6356d0482e013d0
SHA2561911ad86f32cd9b5ada83c44724c14cfd7cdb8f131dfd939e0879611f12971ab
SHA5120cc3a86204848a00b53a21850a913324e376e89827079b3618c3ea49d2935e5244f35cd6a219b9c1e6f821df3bae6e0ee34a96de5843ad25f4b705a59b08c771
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55e7824ae4d8afcc7504359e20b797e6a
SHA1c2e47251b00e889ebbc22567c5a857b15b00e9fb
SHA25605d7d4a2fd44df8566c08400c2baa9271a7ee7871c1d7dabf6c80f83ca9abfa2
SHA51236ae341a8fead325a1549669364ddca4dfb9413b1df540ef7791683955655c60274764b0a371cd58da621b0fcb78d715cf75226b53d0da0f8a0dfd58e691a24c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54dc63afb9626fc13c8f62cd5a9c9fec5
SHA17094ba3fc65a997e000f7811275e21b18079a9f6
SHA2563d103514b0aea8ee4095e3d11002c2b00d0b4b902f2f05385756f922d5f174df
SHA512830ade392b81c6f7121580674ef1e152369667e5ded0156cdf05c60a1c06bc8f8535dc43f7c47da4f10201cad584bb37c215a45536f71cf74001bde174b447d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b7343bf19709f1281b26da03223b801b
SHA1073ea3806c3f125e96e54d881ba474f21820afc4
SHA2569a6a8b3d97ae43bec81250570dc543880ffb13ba86ea246e3b0c810eb908c488
SHA5123ec5981d8d816000f0223b33411d3960ddd3763fecfb37450a03b1a11140340a1fedf4603416db964577091e23da66be245931eecc59b7c4c795c61884e8aea5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52b38395d709a233ecb28798d9804f9ff
SHA1db5bf40f8cd28e129aa22121ffe43597a65046ce
SHA2565771321da23b2fbd52140c36719aab1ecef2e22cda6197a4778b03c817572ae2
SHA512ce48d131af2e00fdb3bf747aa2406027ec0194b1055a923b278d9f6a4161d8be557c147bff6d97e53d748ac97faeae3d1d0d97f913323b5e9db5c12c43460b72
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD545f6d333897f579b69effdb623d2fb37
SHA1fdb980c501b80686ac1036ceacdf6e3820f9f454
SHA256d0f8c2757740f25e70bef9538d7052a4476167585d021203977cb38875ca8d15
SHA512d4e4cfc36adda2a5300e4f01d27eb6a758259f766a880148063e120714362f0cb6018de35e85f69375337f7be4a4402f2497436746c77e9a995457f5048b63e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50594ba2a85672a5ee509807197c15ee0
SHA1622f2901bd319c0b43b612149bc4e654cff805fa
SHA256f7f2d03280f379bc807f2453abbddf441c4d502b553f13840cd389b8b17e0429
SHA512830fedcf2286d5cbf04f29048d009ac215ea9e48b0743d164130024dfbd620dd1ccb500554edad5af3eab58115fafa5c1d9a498c9b3405dcc61e6f908321c8bc
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b