Analysis
-
max time kernel
121s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
01/06/2024, 04:42
Static task
static1
Behavioral task
behavioral1
Sample
896479b6cf81aa4da554b4a826df55b3_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
896479b6cf81aa4da554b4a826df55b3_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
896479b6cf81aa4da554b4a826df55b3_JaffaCakes118.html
-
Size
461KB
-
MD5
896479b6cf81aa4da554b4a826df55b3
-
SHA1
53c8c8c992080cc36a0405f1cabf3b1d080eb103
-
SHA256
743496aea2326755502ae6b07d13eef7590f84289db7711a2c18ff189b1208fd
-
SHA512
300b0209a82aceb1835b374d3cefeca931dd0635c22d305a5735268d9a594188362d728feb05d9068a7c6eea859ebc60482642b093f4f73c05b9988cfd7522e6
-
SSDEEP
6144:SysMYod+X3oI+YIsMYod+X3oI+Y8sMYod+X3oI+YLsMYod+X3oI+YQ:d5d+X345d+X3k5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423378831" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6280F091-1FD1-11EF-9DE9-520ACD40185F} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40c9f73adeb3da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003a9583f03c6c4a4fbe391ca0905a73d900000000020000000000106600000001000020000000543aea3d13689ab7a70bb53bb72f6484d072ee4bcb1f41c1d7e0f2610766a3e7000000000e8000000002000020000000087c81730b2955622335de041039cad2a76437b08f376b3f43cad74854216ab090000000b8cf50b9e032cb3d3689b78623fffc139de694622f8efd38bc4217ef4f4c4c8a122c289b790ea9638eb551d262ea82926cb85e1974abbb786760954979c170a9eca152d61439de4adaec223132485b68ae04ac371554b67296136d873b36ad3595068efb4fd0576232f6ad769a33befb10659586fa524a1eadf4880204f6cc58642798ebcac2b537e989a982683c4b2e400000002cec1ef0bcae5d24d8b43cc63a46832d5f637fad52148cb01a5e18def7f6a7e62979f8e4f7e8d7ebd3cd47ef08a003738249b408170bad4909ee54ea895647b4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003a9583f03c6c4a4fbe391ca0905a73d900000000020000000000106600000001000020000000767eaf50067795c7c0f0bd11956fd6cd92a64fd679a529ad9d8901ecb1b09278000000000e80000000020000200000000bd2d48b429f3abbf0d79753f0d0398f391147f4fb101c46f154051351fbd28d200000001c22546419f2a17fb9fc050cf178729f86348e5daceb77411c4a613d0d1ff76a4000000029764bbfc5d465a94a74d62bc6c990493bd23385d8c0ed13f90185eb3ba0873e02a3e182bca36147e299f7f6c25c7879cce96b4c091ed33eeb3c46de83920ff5 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2956 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2956 iexplore.exe 2956 iexplore.exe 2900 IEXPLORE.EXE 2900 IEXPLORE.EXE 2900 IEXPLORE.EXE 2900 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2956 wrote to memory of 2900 2956 iexplore.exe 28 PID 2956 wrote to memory of 2900 2956 iexplore.exe 28 PID 2956 wrote to memory of 2900 2956 iexplore.exe 28 PID 2956 wrote to memory of 2900 2956 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\896479b6cf81aa4da554b4a826df55b3_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2956 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2900
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD546e7f59fcd51d7bf97d869005d862ed1
SHA17cebaf0fdb278955c52eb5776f64b85724c590e5
SHA25606dde7e5f88e42b65539524b7c0808f096811d648a2364451b16353b2fd640d8
SHA512a382247066fb1fd7eaffc0b91dd6e8bbe2bb27711e5ef3663d29c6599150a9e04b9e97dc898209530cc6882e880b7f2d0d512136bd47a48a241a9e1975f966fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5485cd3bf7acdeedcc3940b96ccfec0d3
SHA14f6a6570368bdcd89a40c2808d0aeed1f9385cee
SHA256ca7be543d1ab0a971ff10db24f8b401fe1d70459694a918cc8e31f52cce86e6e
SHA512d561318da7fd5ac86b2a2dc832b7896126a70e9fb59958d5aed8ae65fd034a13057cb40e601842961cbce183d77f212053c4ac73fc30f8f290cd623ef0d173be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD536eb625d4ccf1458b752ad4e2a19fb74
SHA160684f7f47709dd15e52a3a3ec4f53eb413376f5
SHA256e1c7f1ecbf8015ed575ced07e00175055dcd1bd93408158d14b4e2af15859b3e
SHA5129e5a0042caf5397cb7b1b5c4d2cd82075ccaa5b7c65a72f2bba96a80180b01c438d125d7a218ba8a4c7b65b037025ed7868f3776b2e24874ce6dfdf35fe07aa4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50cc0cc5c8b4eb734806cc0dc3f288f52
SHA18aaa5b239c205aebab67a01d6117023508857623
SHA256a324235bffd1921be97d06fca5363c468407072e38280ff6378546428dcbe368
SHA5125cc4767a270bb4083a3fe67c640305944d4ae6eb721adb7edd0812c312230754006297716f7d98d43b812752c97e1bfb09c99e7a025e27b71f96d2c14f5afa61
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD501c411c813d16f0e796fe76261bae226
SHA14f6c1ddf01d93c33ecf02062c1ce25f616b5033c
SHA2566be4b7c9582022b36656a2c83ccd15c77006150574920931d58d4287f7b8199f
SHA512d40006e0cdb2f04d70617438ce3535230232ae9f903988e846ebe60e508e49aeb6c8a7a3410ae744e9f6bec491b7f511d06255ba59fdd490938f657c43714bfd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51316967ab8d1cf098e7645c9c974e057
SHA164674eb4c99b097f0f9f8f3f7cbe8f9deae95dee
SHA2563487eb13359e8d4f62b573008960af7b8764f1d43b1f519af13a84db62f9818b
SHA512d9f5a0fe67e8053db65e6f22a0577e759311d2489d2e746bba4d665774edcc25e49588e817beffb8f42eabc6419b99434285e204b28202a184a5d381168083e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c18bba2de0f19cbf66a43bdf561cb239
SHA140d6238af2f4395af9021e564fdc75ad951117cc
SHA256f69f9b41a3146a1af9ff924a99ffbeebe283c89b187b813995532d0209a30ad6
SHA5129933b9ae8544ae7d969c5c3d575355d9e1bb4d561b5320c6c575aad77a8ffb4bd8c2731782fbe7ce2e1e9db5d9e08a73f199562c1a592e800d3011ddf3fc05bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a6580573a0b70d687ad5cf7124dff5df
SHA163529e68095abf381dd42d8dee10f0cc7e7db8ea
SHA256809b34f7a70ebe7edee5d15cea05536d013eea562b3a1daeab8db9569fc081a1
SHA512ab9d1b1fed319bd4e6181c29377891659c58e390772298b53e848e4f6317b521ea1540b0bd6aaaeadd8b0522f81959a577ad89e8ab13865708992d12e2a99493
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d66c6bb75c1fe56b468b2f0936cb80b2
SHA14644cb224ec2a661d10e3e09e7abc2f34c2630a3
SHA25608c1dc6ed931383f1836ec0b8ef1b2906eb86663198960b51d1198a372635171
SHA512ca1366138a07bb84a7d70f50a36963c77bd996ade15aebf18378f2268ec66200fc1b730b18c81d5b6545ed788eb3d6bf8eab0aa1b7ae1fb4a9517cf634f03fb5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54d4d8bb6e043893abaf624cb95a31aad
SHA1cd0914468183393b457b464521ed1895ef6b7921
SHA2566f9769a089d5c254534267b20afcea3aafbc36f78ea063116b013cbac76eca4b
SHA512c535d01e28ffacd32f2be99c02b893dd151c042880065dd1fb17896a13112dc76e3a34490d6f1ca77285a0a9a82094a54e1ce932c6f01897fbf8091717abb7c0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bd66ba917a5c62149c80bdbe9306f1a5
SHA1fcc2c06a47fda2b2382e7962d2fc7c373da3b23c
SHA256f78b8dfab0ac789b5d4a53b7f1d4fd40b78e59c1544ca5565a7f16d058184384
SHA51219299330070fee7a55c305219f69f84a7554c5b248f5878068491114278c0b9afb1c2c94059313d5ded9a472500e8b9b99ab36cf9192b00c3bb95f536eeef9c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58e1ff71f50b37aa26934d14330340bcc
SHA152565abc089e80a719c77a43d268c130e0656b33
SHA256090bfd33e2ac4234d0b4ced48ddc40b9ef7a2160bf64caa5adc80bc4f7c436c1
SHA512b7cf48ace9edbab35c6f3dc3ae06b99b081bd2f6e8cc66f7cefa042756136a902865391a6eeb3279c7bd302810e27d414ac7c57ab63e345423a09a1657502adf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53f0d8ddadcaff9266512ef173586f59a
SHA1ff21ee266ec93e1dd260b27d8d75359ce647a791
SHA256603c943738ef8160322def008175affbb2ffa07e6e70b10b512a0438ced16894
SHA51254c827bed5e9b30034262aabab782bce2ae253416093c569a7bae84222c98d0f0adef4cfd56dc7c2b17f2b70101a45750fc6a8c5fc2ac8fe5bb832aa83682175
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD536a33faeff69ec545a8225a992d0a913
SHA155fe1df244bf0d97fc1eaf77215af25eb7779490
SHA256493b42e1aaf91d3d8a72316f25116e728c8279266d35f739764479cd93b2c3fd
SHA51201fa24aa53ede55af6b9b55999ce92647b8b619e2d4ceb94862c5b7911c7f80be4295a5451dc27a12df56d47d8351104070a284300cdf70dca8c358b646ee54e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD593d074377c7b15edda0041ff048d55d1
SHA129f87ec3d9c2f6984b42e493d504d0b6b0ed5cdf
SHA256951f812628fc9af603f0b0bdee14792f816bf548c64d3132b05a07ca0822d39d
SHA512596bed76d3ae14a529bcdb66f852b9db5bd329d63349c77cfdaeec1d22ec40f9f541cc703acc9af9a356a20f00285c9fb547b62b1a9854d39b69baf17e08f90b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52f00e822a5d274497a2fe5600c8f1185
SHA1d705a6cdc68ae14c7c6ee38e00a8d647d2ce6ddf
SHA2566befd45f2551e22ba87c0b0b6871d552b29f87ec7a75a1ec5303f45c55398696
SHA5129161dcf5c719ee3c4aeac05141d0d8e3f2791bba1dd1204918815ef3bb561e27a5c2c6ca1f71bc6ea4e10ca0abf79cb609f2b16139f7cdb95e699fb154761685
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5655edfa4f792f3edfcb6d0f1ea31bbc7
SHA1963012f7e15afc54c381dc233af4a558db221020
SHA25672976b0ebd8184856a65ad54bcb8665d35ce4dbaae707489f1366fb40936927c
SHA512f1be220c76a5f41f1ae4e457ca1702b4d28ebb5900b27bb967dd70a944482b05f54fad225d870de0de2b932b8a9b2584b82b938f14eda08411a11df6fa09f2b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a914cb05ab332fbd054d863950d50bb8
SHA15f9340c027a09e15a447e75dedfd898b7e5005df
SHA25640ae395e6fc676c259a0aabedffa687a97db92415b300a4012324f1b551a9aaf
SHA5129f713fe9b5cab9815f9994108b5d4c823fa9abfc4779ed33af51a1959e84b62facd93d6d061be1ffe07699abe03a4ad1ece312018214e0245f6c1a384d791dd9
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b