Analysis
-
max time kernel
141s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
03-06-2024 03:11
Static task
static1
Behavioral task
behavioral1
Sample
905b8a7763cd9ddde69820ce08ea251c_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
905b8a7763cd9ddde69820ce08ea251c_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
905b8a7763cd9ddde69820ce08ea251c_JaffaCakes118.html
-
Size
79KB
-
MD5
905b8a7763cd9ddde69820ce08ea251c
-
SHA1
1a648d67c37b2955e298ca164cf0048eccb70053
-
SHA256
22b9d0b19acef174bb63b97a0fe281facb66ba0b3c433ce43f9319f6db75bc43
-
SHA512
efc1b1294de561f39fb9fedd4504581fd3a3247f8b12b42218ba595dd4d0860769234ab3f18d7291955ab6d335c1d8b3bd9b724b0d02a484ce8a4200c066af08
-
SSDEEP
768:Ji7gcMiR3sI2PDDnX0g6s/6R0JvBsSQpOSmpdSjcY8loTyS1wCZkoTyMdtbBnfBi:J39+OdviTzNen0tbrga94hcuNnQC
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423546167" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FE8FED21-2156-11EF-B21B-FA9381F5F0AB} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000bcb1962701640873f352bd6c48eb9c0bf40d9e9264e4d635d8f8e259f0730996000000000e800000000200002000000045ae2f66e9042bd028a0774f751745f2b68f3a73380dbe14573c547436b95153200000006ddd4610efcc60dd77494aaccce414c986949d31b29701ae00355be07f93aba340000000bd0ba65958d17673fccebf465dcf8898e3cb1d0b98be3b0aa2f9ad17bd07f87974dd33143aba52bd67aab289e197dfe80afd4bae7d9286ed0c41c05f978a2cf5 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10ea32d363b5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000c42fac062e8a0474b850a2542750d99e0237c186cd8ef346f3dcb7bdce799f6a000000000e8000000002000020000000ab38e34752a7628d884477a22775e6a1721e8cf6e067e03c42814e078589b2f090000000dddf3ecbbdf1e3e6e11269a91335465e8434599f403f9378ac29677b75187d6add77db0f982839a1d272d1ddcd50ac5febcd4db01d65ae5d1dda9736628cb58ba7949da76e4e0ce9f71428a104d9d0b84229226db2433e943bb575f7a74078cf818e55861c77dc94979af58624b152de06c18d2789a9d2ff8c8753fd9c851c347afca3d43cc75860fdbfea24a4cf276c4000000062c8cc2b5b17712344283c0600cd223a021eacb71b098c1689a9019bde0a07a16f902197e89253efd4c5d5da75288d58643912a9152dba5f1291598638c66e63 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2408 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2408 iexplore.exe 2408 iexplore.exe 1676 IEXPLORE.EXE 1676 IEXPLORE.EXE 1676 IEXPLORE.EXE 1676 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2408 wrote to memory of 1676 2408 iexplore.exe 28 PID 2408 wrote to memory of 1676 2408 iexplore.exe 28 PID 2408 wrote to memory of 1676 2408 iexplore.exe 28 PID 2408 wrote to memory of 1676 2408 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\905b8a7763cd9ddde69820ce08ea251c_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2408 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1676
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d13dd7404ae21e14417cf92bd88ada19
SHA1ad25f36b28b555f123b94b64d53808ba99d2890a
SHA2561edd013824cc31f74e08cab8de6ccd3ab91470ad8ab8a732a97b861b9739de54
SHA512bad5dc2b6b71fbfea7ad193b5f1404875650e9490e1e27078b7552f6371ddaba453a8576567d3283f17e4ae4a63df0730b462054c51efdc5546099b36a48cc16
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ecf0b910c87df146f5d8bf5d838a2c0c
SHA1890caa3f4c178cd7ca123ad823fb95d3e1e8872c
SHA25623bcf215d1f84805ce97d22659d28262f55dffb5c3aa77ae56e38ba3f54d34a9
SHA51229fae7a3917df245db5d6f743f4056d2d577c85725b479073dfe58f2fb0b8495d9761f529b53a995923fc0e8f306b84256f31900dbb3f35f4d1a967e7fdfc162
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b0c3e12370b82a38df53db7d743d9a18
SHA148e75e161ce04205193c6e20522b70ece5bc9998
SHA2567b955a9dfd58b85e59d9de9f0901cc4d68d4b2a4776a21028d182d478b92795e
SHA51208f603b6a8a997dd79838c345a1cfe929ef7c5d0c8fff0f0a1f8a2d871f08b5aeb26b3c351aae5a368bb6a5f503e38050da69e702fe9abbec8626e746be05c04
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5388cd61fe71a9e93366d2aa5c9ac3618
SHA114a2c716ae203460d2f03f5c94f5a5baa6d2fca7
SHA25657060bb4ce96c961f679a837ee5716c26d14fb441ade8619c59bed0978cc0093
SHA5126ef33decfb59af407dfc386f14839403e0e9584e9132c110c9b0e91dd3c9b0855d2a61b9be593c5a74d25f317445045a962f3639465ae6363c312de1a63b6538
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD571165c1ac49e5a970a017e5bae35e7d7
SHA1acde19603c2e5e3ff0df7e7605cf769e50f8ca24
SHA2567744ec44f16e8d1aa84c404787e16dae70b841de5a14fe9ae3237dfbc58ec45f
SHA51223ca403d7d8356e512fdc5464cc3674f62db556d3cd7c1ad03b895638dd72f99534435b71243e1d3101623011ed4dd6f50cadff51f6855762c7df9327de09a5f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ba14d195ab1068d16b395afd00c12839
SHA14106aba695320c4fe3064b7311bf56b08e1d9c82
SHA2567ead176ebb36f3ff4686a29a207bf598e424280a6e4f899ffb7668fa5d4d775b
SHA5124fd194947cc293448537c25f0855042f421d36b28ec03b396ac42cc91cb3916d146bfdb6225ef07b40af10724ff0f913fdfd7b37175c443233ea6bf89ab62ed3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55362c10609dd106aac2e3a926679fe32
SHA1666e46d9bf5c5d703e15ad4654cdf1404aa9319b
SHA2567d1996cd3bd6d0dbf147ed51a14f084cda8d4037c763bd6b2c35dcb8ef9f5cc4
SHA51242e886e2cf705608cec3b5561c5ad27190472d86cc82d2bb77647349eeaca7500bfe98d759e9207975dc4265eb3e86b4576aba6c607d25d3b7f9ee1825d596e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54e0d81b6db37f28656f895aef703edcb
SHA1e1ef1dea1164dfc9e23daa0cf3a140160ad1c535
SHA2561de2ffcd2f914f9182d4b7020b34d7131a107477e5c39de1f5d3734c571c6ba4
SHA512a138ef7684c57cac706baa34a74e55ac0fc2c1c425b0d3577869fe718dfc29b59e9d6d8c4f43afc9867d45f9d01b0c836b737aa01d5cd1abc62bd6ad3e6cef18
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD501fd850e7fb139dce4ee7067eb79316d
SHA1ac2b8599add9035bb201ea2671d9fa98be2b31ad
SHA2569d3057806d8f810f3fbf99de65c97382a8b8bbaedf00a3f0825bd13b6249386a
SHA5125f560f4437f2d7e652375051180f79ca51767221dc20fe400b477505f4995e30cb23bb616e829b480fa6b1920f4361507b987dedbf0ce05671efc16277c4520b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a7c8463371ae72bc2946075c8e6f6e58
SHA1596f2c0cf92dd1d058cf21b3a2f1413e9bf68a08
SHA2562de58eea308a7552952d2f80c302e78c8279d15f7a4abd828f426f040478b5f8
SHA512e29bf0e641bd3581134c0f75018b9d459ceb6df3f253bb319fd83c32733aa5074610e8e87b4e98ac44c9e39013a5f46a18aa669759cca27928c7abb2365def18
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e15db2bf39c95cf73a636dc6e4868067
SHA1414f01614a08fcfd04a522a2e8f46584a62a7844
SHA2569a068925c194c063c90ad1c08b92112ebb774f15d0793e1ddf15aef9ab0a2aac
SHA512076f557fb1731471a8e7701432dccd3b8bc89c52089943660b2ea3e8db6d3b1860f1f0eb7e73792df86014b328e220d158c9b80d288a8705e99600ac02d4cc1c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f75951410dd33c4bfb1758f2f578823d
SHA16880911842a7030948da292463d5ff1cdd771c13
SHA2563d306748cf37df1515be27fbb98ee1174627174a8a3c04a680f4c5f03f8fcc90
SHA5123ecf802a04af5897b4f93b24cee04e62e9d50641c5e1b5e64d7cd4909a58e9d42c37cf5e8cbb25ad8f43298824ee8f46f5d5310cf73c2f58521f382d24087675
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD572379c0c9d7b89dc11cac7073e8d88a5
SHA1466e840b773c4169b2846a024f9a2bdb0905a6c1
SHA25655ca9df1670348a002acab8ac22bb0eb69004c7c8e1ef450e87348058020b328
SHA512ae3d10d89d1a1e4c39d40e19b4be0b16ad80f5a6c7c3882670ed0303837cba3f301ed45a7e1e9e1f46a32fcde97eb69d4b9d9bea007a3fc1a45d0afab704a08d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD511872658a64e541230298e1f80d58e31
SHA166b19ec9fac0bb6e1b5d99cf53990b3880fee61f
SHA25654b4b230e73d9925ed0bbfc04b7eba6718ac0497abc0fd04aea5b8d4435f254e
SHA5125f82d15d1388cb4dbeea28efdaa8d115e1761d8722228439c64e29e69e9622c3e0b60956441a19c85d1abcbb43e563004c7788269b1f3f425447469361826594
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e026466f6822d8a38d3ec943e5a2a913
SHA17faad620fe8b1ad7af01862fc1048bf43f1eb911
SHA2560fdd6c1e1e52010cbf80e96fb0e9911bb5433071ddfe279d5219dbb74c105a70
SHA51278ee4b6646ba980ef1d0a6b452095946207f50a0bacf02ed53addcbeed206a4a04929cc450de40125d962c8334d6ad360c043f4bd91b3209ec92e5a16c1d1541
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53fbe9de8a47f20adb02ce06a30cfa416
SHA1e364a394080e31db3408ddc34ea67e95455f3584
SHA2567d238a99060cc4c1d1c710314f66abb9c7edf126243cbc47b6461cbfe9537dbd
SHA512ffc96ce0b10bad00b52a19f829d90bdbef3cb5b0c18d8cb0f69afae566280466f5b26492716fe755e9bdca3d2d4bedbb4058d13822e4939ed22157613b2eb554
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58e85c4b3ba034486ac4c68f819815d76
SHA15608c15d37e45c030e6b1a916832d3eff1632f01
SHA2563f2b675f2e5e1f3320dd60a5cf8c02c07d7e688ee4cdeb374995e3aa071fefd9
SHA5120975f08fac6d79253e99242f57696c7244c785dd97ac9bce7ec5aa14b23c69bbdc18507495076dd2c110ef4f5df032cd6f95f50b95ad877b21bf6101fa397bc0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57f7868b27e781c50b40a4dda36673f80
SHA1cee41f9561eb7a2706fb9f3a75f22f710991dc70
SHA256951f9b5f955af6a170d0e787d1ea0457af8701ba0230317fa840f2d91879b325
SHA512ed5843faa8f36d219e8b08bdc02eff07ae172b78bdeccb3aaea93715c15f6629c26ae0fa8d9c3cbd46a2a9c2d92d510df4749f690fd0243140534957712017fa
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b