Analysis
-
max time kernel
118s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
05/06/2024, 07:42
Static task
static1
Behavioral task
behavioral1
Sample
9783742f13f14249f1dc28e261f24423_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
9783742f13f14249f1dc28e261f24423_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
9783742f13f14249f1dc28e261f24423_JaffaCakes118.html
-
Size
460KB
-
MD5
9783742f13f14249f1dc28e261f24423
-
SHA1
8880ede1e81a0edb51432bc5ad87ab98a502ce38
-
SHA256
64a811a54d413e92bd2e761abf7e00657b4f678c02a3e83915d26aad89457aef
-
SHA512
2d1a69c50cf1da833970610442ed268d1163dc19615aa61c3a0daa0f8e7657d628ab295922942eb0613bf6d481dacbda09439db1e8e5a60186739e2924c46095
-
SSDEEP
6144:S+sMYod+X3oI+YdNsMYod+X3oI+YmsMYod+X3oI+YLsMYod+X3oI+YQ:j5d+X3J5d+X3m5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423735244" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{39D82191-230F-11EF-99EB-F2F7F00EEB0D} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 307f5c121cb7da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000cdb36dbeba839f8a19ea5d1c1dc929bc63ffdc5fbf6358cbb9614d239b304262000000000e8000000002000020000000d20c8ed4b5e95d9c2bd952a2150ec4cb232ac8395e12d3b3139c0f50bf46732890000000008f3f374c9c8a2903746b3e879e6f5626eb77315e65ec362a212ae2826676937075564bba7fa422ff31983c4f762cb96ee310e09c48d37f91ee5d809aa2b1f652c18280241755d5d4a4afc05f1448621f6f83007e948b6faa38c2a36c6b3bf7774a9606d8c07a496c10d1f4e436a9ace53222056938088e480185053c1746fe319f72ea974f579f8c8d8411de730ef940000000880e12eb14f4b96787a658deebbbcd7654ec4d6a8022424e99ac80d007db080c55b25e0043fef36cefd8d19d9cfd06da2d03d36af689fba2865df7d89cf397db iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000074287f7b548d4aa6d6ac313f74ce2130ca12f1cd83ce97ac01ffac5df167f60d000000000e80000000020000200000002108fdd55871f33d5183d5c4c33c4eda0f0cf4e1317bb459d0d1d56c411fcea420000000bd165305d99d24eaf1bf7a9e409a4fb3f10d177369a0a095f0e0853ab6401ddc40000000304643dc24a0d326edbc251ee12b4e8f910b8a6c0610ad5296d46638c7ff33287c34b75b1dc671cce1503dc40dcc345a1142657fc718c15dcb51031b079f3085 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3052 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3052 iexplore.exe 3052 iexplore.exe 2168 IEXPLORE.EXE 2168 IEXPLORE.EXE 2168 IEXPLORE.EXE 2168 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3052 wrote to memory of 2168 3052 iexplore.exe 28 PID 3052 wrote to memory of 2168 3052 iexplore.exe 28 PID 3052 wrote to memory of 2168 3052 iexplore.exe 28 PID 3052 wrote to memory of 2168 3052 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9783742f13f14249f1dc28e261f24423_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3052 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2168
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD576fa99d9420be5b0881c7dff137e543a
SHA16c1d1bc88d83bd13bbdfefc7b255dba23146ed0d
SHA256cb2779ce1a2a1111980db350aad4bc089ed0295ce4d70f27b5a3eab392b8c900
SHA512df156e8b3c6bbd16a31320338d552c67de3fcbe11f6302c2d133d19713fc3f864dabd4dac9f3768581b7ea8bf48d1b14c3e1abf6a80e82fd4b302832af686e55
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD579e3dbc0ac3b66b77cb275298913b5bc
SHA11b5af87da9fbaef85385c28455836dfea7b4b59a
SHA25628c12b5e1f7a8b007de2c47a513339f10245864e4a8c5bd53bab5efd369de8cc
SHA5129877aeb7f320435a7a2c243e1d01912473e991106af061c0e0bbc1ac7f5f601e784e04e94b23ab1bdd390eb6f2be5330fae9609743759ee1288667b6f03d7e97
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58d106e8c54e55cd7933bfda39a831fbc
SHA18e1d1b96ea27083da39e6e91314ce0ee75f5599c
SHA25649df96abc29c866d804171af67825383012d0ccc1b851f0067b65a646e06f141
SHA5122a35b79af81f769508cff7a361a135ce50852032e87727809170410b7c9af05f8a79c2c0048ea66623836a27208d7b8d3f5facab6460b27fcf01472cb0949dc3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5df88a28b0edfe5c076c8b079e3a4082e
SHA1916dee750e75f5110d071a28dc43383f09c36faf
SHA2563ca222513ba9c1120709764df8ba34badfe7c31aedb4e28a3b06c64ff6be5b0e
SHA512df4ded37de19a3892839b3e5e4008bbf7ab72f25f575f47eaf6efa646490645dbfc2e9f1c59c632658b6dcaec881a92b03a8bde30e33a2a2833d7a06f6f719cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD562e1a5434b021fa624d3a16859ad2c49
SHA13af48363d8520bd051ef364d59dfed11cde77384
SHA25600e8dada5c002a45edee346a87305732dcc13c7b05db2e5be1ad5a7621f0da24
SHA512778b69939b704a3d42b31589696543d6c1bb1896fda328fc0966f2f662e7c4bfa6383cf4ecc3ba594d08e50f8173cc7320db1059fc485ca55e2279407e92f6fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ee40a33e936f91fbb4f7caf336417873
SHA1522ee63a00e3f2d394be110a57b521f1d8c497f3
SHA2569809e119ab909480e42932d2c522738db3c8ce89bc22441cf92214807713f4a6
SHA51218c5100dfbcce876eb0911c5dd0bc767431aee3b67ec8382c36696f0579762109a674a15be929bf09675d4f06bb8fe57def35241114c955f12a051d6f4858b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58f58bcc09283a3e3d477ebd8f9c4335f
SHA15913d7d9534484e909f5af6983240d74077fcbce
SHA256aa4f2cfc13385ee5c26aa8beaf3b5f40dc0098fbca9805e3f91b46309f237c2f
SHA512caf3b50a50dd3c62a2f7affd09d8e89aeafe75d4a20f9d47f8db70e43daec6f7b9016b939adbd6570f5490fa6bf7c736f81d82a695c389e8f41c7046fbc7433e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD577a57663bd21442ea773556459ace390
SHA1066b8ad2a9e2fb7dfbe773c20e36dc758a2fb586
SHA256e20eee6529dcf16ebc91a5d4c68904fb49b22a8e77ba42ba259ade0f9662bb0c
SHA512f9dbe87cd5ed9f44d97e30bee87202d30b7fc7614f0c6f6318aa6b63e191b2f5856e96f9a69753f33c328e3aab9940aebf3f52826ab8fbbbab4c43599cbc399f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55e35508179f577edcd1a7e6c6d85375c
SHA114e14c6fdcc003cd793cf9033a41c6d681a34d42
SHA256773cd932dcfd7a14727e814c4938e55d1deaf5b9d2f94a9199d994e93b85a16c
SHA5126b24c755b1d6cb079e0b9ffb800d09ac2d042d0363c5b0395f77cba4d9530e51c91f0c14933e4d4c24c1827175a7176adc896545f73c0ff5e9c9f37f64f8ced7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5594928755677805d70afce56e1d8b921
SHA1c769961522c7d404b5e7903f5dd79b96281683f1
SHA25678c254f3fea1161cf409c93f7b58f50ea48bad7a8b639360d5a56c1da4f8543b
SHA512c5d49d061b9b8e25e670c7ee353a1fa34b9a5aed0c77fedb6e50e3e7fdd357905fb7b8f01d4613a4140f74e9f7d27e4ed1406b56aca645c0fc68afb27141a8e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5462823a3b4995f66aa0470f2e4bba56a
SHA13354c289e41d91151f5ce3f5023b7ff1cce1feac
SHA2561113ab561e0eafae95743c5420d347ed2ab94f289d816f4bc92a85f456f59493
SHA51244d7f352c85eaa4bf3ae6041e9240ad77bc58d84de721b0ddc0fb3f9fe20de5cbbeb13d165559bc00c852752964c7431e85df7c09e41dc030b331d95c6bae823
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cf8a9586204aa697738a079cfd38d27f
SHA1507fc5a09cad8b7085c7a7ff45ec0d04366e7932
SHA2566c1701eecedeccdd41868bc1abdfa18703809e5c572ac1a76e728f19ade7ff9c
SHA5128080cd3c06cdfe5f405ff62bb8b831001dd4a25a73dace89f25cf03750ccc9a6fbf0e380505a6e65eee1b553afeac6b008e224ddd3483379f25eed46867c2375
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53611c9b27fca57a5f921555b5ca1f6eb
SHA186b76952621dd47e11c4dca3d365a7d996a8dffd
SHA2561645edd87546e895a9c3e9bf4df1fea5ef9d4584f69036e05a88ef7be4b896d5
SHA512ec54ea4a91edf4a4d9ee076283e2105f6786efcb81b252e571e9d2b0851e1cd289fc0664ba8199351a2841c8553e06e070721d2756c56c78316c4db1f863044f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59cb8895a041737a2cb66056d88910c79
SHA1206079bc135c141e7022daca0aac7ae8d3f75be4
SHA256a31ae4e50ebd857079f4b58b1ca82a7933657564c29cbc1740590947264a5037
SHA512a2c00f0214cc9d909d58362cff9f410e9c7f1a18c7378cf730d91e9615dfe93b84ddeb860fe4bcb589a942557a1a789f563643529167c2e35bb4680e57780cee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51754a45b539ab8343245fe12b38b117e
SHA1fd464d50dc9217e488512056d4820eb3414e6640
SHA256cc8f7e23b2b43100050ce4762b0b62e5a505c877645601c8812e727e4a1f25ff
SHA5121963177ced628f39f19076413b6dfcf3d732261d30a13d2614953afee40f768c0effc8e812715805a888c11fe7bacc8499bad59f91a3833bde8b44ffc2fe272f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD509abd4deae4badc6cd4095d3deef8fd0
SHA107b5e786c18832a1eadc0caff1fe05903d36df0e
SHA25689fd9d91d7cc8f1f0ac9a766e1b596e51782a57e72b51325df6b4f377bf2fbcd
SHA5127c6db6cf60fe1c51aee555170e9eb400de1508a75413c3aeea1cceb25f4b6522e7709e8609d089e667bb56d9ce4b8501dc6dd381e9423305a5a98843c1264a5a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b09fa3b21beb402ea52f714eebf17cb7
SHA17dcb7922d07ac70c25ce6116560f0d4d4db5ab7e
SHA2560f7d3a246ed1fb08bbd72e74c7c50099db1d471196002c38cd1d8be6c8905a8b
SHA5126f92e214016af71a93c27306dd029f2cb4c176ee2b1f3596251aa041cdd1ea2fa9fc3b50b423403d162e768067bdd6937e683e0be527dfe50c3d645bc501b486
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59a54d479433e835ff114d9282928b463
SHA19f00b872f640a37b517c74d2b499dad5ded02e31
SHA256cf024005cd9af4ddd0268a7665284e2ef6ba547fc09355faf89619b9f4201d31
SHA51223f8feee8831cace6fc1397f881df52ace1f195f1cf83c26405d5f65dc120d8680744e2b925782e5c3c0f380a726f74927de9b6921d9ba7fc0ab5279bc8b424c
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b