Analysis
-
max time kernel
122s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
13/06/2024, 09:40
Static task
static1
Behavioral task
behavioral1
Sample
a4e4dfd0db3a488a6af1a1a9d1442318_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
a4e4dfd0db3a488a6af1a1a9d1442318_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
a4e4dfd0db3a488a6af1a1a9d1442318_JaffaCakes118.html
-
Size
77KB
-
MD5
a4e4dfd0db3a488a6af1a1a9d1442318
-
SHA1
543d2d2c36f584c385039b942fe999edba68b207
-
SHA256
363eccc59554e844dc9506edf9f0053eab7cbf1e153c4508561f4dff71d2fa37
-
SHA512
d2da7c0d1d8a2b738292cb6258ed913f06731e988a9dcd47f4ce48407d218bb03378b220f37fafaab0fbbb9f3abb810163d01595addcdeed0b144d10a89371fc
-
SSDEEP
1536:o3turnNZNy5ZbdKfIWuPs3frlkGovXc+O/SvxJrz5t:YtONZNy5ZbaIRcfrlkGovXc+O/WxJvX
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000f6aa2c6be705244be2b3f4bb3bbb159000000000200000000001066000000010000200000001bc64d061a07ef07c6e415f84427d0f16322620744c78ec4bbc2270953d00ced000000000e8000000002000020000000058bf77211c9b5288f99b1391f9a8b5dd9b2c750a738c0a20334673850565e222000000078d0f33fda19d7cf5cc1cfd6ac32f1ef8cd2990c8e1f7db42302e1a7e43ca1eb40000000c590f2e238812827f074b26a1c98b0b5aec423f68b7783ca2add6ae2eaeec617abdc6ce310a3604815e891a0cddbd3e5f578e033f2c61aa18295c8027e7a3e28 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 209e42c275bdda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000f6aa2c6be705244be2b3f4bb3bbb15900000000020000000000106600000001000020000000526c2ba49581d7cc61332c5cdc96dc285de61b7316aeeaa1a71cb73f4875d817000000000e8000000002000020000000eaf5ffd2200352b7783e28363afe7fcf486e1e092a13d15d6ad310d53a83e11190000000244479e8af1d35894baa4af3fbcc9ec92e4c2cf7ca2e7d423b1daf8f9a6af7bf853f6b99eefc92fefeac3f9e200c7435886ffc58a6e4ecacba356f51970cb0f3dbbbf557cad27181fc69ee3a671e913d43874089359f7a2bb0f72dce7b221556e4fc07438d5cb04ed4bda813a0a0e7e82f4cc7519a5a335a92b2e21abd475d64596b20745cf9c292750ecf408ab1890040000000c4ea74cc7fe71eae1088096144b69b766b6fb29a8ea40dc6cbcb1bfd7e30408b3410516040d1ad2927e3a001684067b8cbba077b1e52686c5f31b90fd573a34f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424433479" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EDBAD9F1-2968-11EF-AD30-660F20EB2E2E} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2036 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2036 iexplore.exe 2036 iexplore.exe 2696 IEXPLORE.EXE 2696 IEXPLORE.EXE 2696 IEXPLORE.EXE 2696 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2036 wrote to memory of 2696 2036 iexplore.exe 28 PID 2036 wrote to memory of 2696 2036 iexplore.exe 28 PID 2036 wrote to memory of 2696 2036 iexplore.exe 28 PID 2036 wrote to memory of 2696 2036 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a4e4dfd0db3a488a6af1a1a9d1442318_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2036 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2696
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bff1c099200bde6f5d49503a6117b072
SHA1eab4f86727c347616e773a8433169f44ee1b8a13
SHA25608110a1de610aa302a8f8f27b9fdccd6e1de48422be59468cf5cba8e57cc34d7
SHA51263020df559677848b04d3946e0acb46b522af69947f33ab28976996361bf86f693cc1ae4e4e81130e46f9d7618ee7f4443ad7b1293cf549a5c208820f53f2eb7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ae764536e26c926fc92ed2b27850ca20
SHA12eae6b5303b265c438473e772368878051df5a67
SHA25636d5326625873540472378e9b816bf6dd027e24e794bd96c9c22a37779b4489b
SHA512c0d41cc11815b0afc0ed6804080742f238ba4a2577c13aa9cfcf1ed7d2145fac3a74824d75a5e57bfb68c5d54e4133c366498b261f2eaa0c7a70c3d211c11df5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD578556d2be910be31e78057146ddd5818
SHA1fa582a955a046ee386c708bdcaa0a119bd87f59d
SHA25687dd3bd43ffc41c5e9c288b964161866056bec5e35b189d8723bc3466e2b2c72
SHA512d68b84a3cd031091d405b92831a92f599ed78a879fd60893b1d2f01c8597744a894583d489cf0a8219b0f5677d639b8322799f7a88e1e06f59e3037c8f540ce5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD542542e6c17074912c5ff09d9c9cc616d
SHA117165bd60ca4897b6cd66d3761ec66efd023a4e5
SHA256ddc0654dd955cf95562bf66c69a3b0efea0a8e8e2743868aa5d7b1bc6334f59f
SHA5126d1eb4b19d0c31a0bef9c094d69832ab1b887ad60d9ccb2283e829cc107e4ed4ca0006274bd9282454fc36870fb9ca9f894efe61f7090a8bf7f5fab2cdca383d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f4b34e6418011a359799dd96949764c0
SHA12aa68309d422ac11d189b54edba051aa458d97c6
SHA256726d3f8eb89204b65448f029552b3cd27e790765639afd4ebee6744465b7a24f
SHA5125a81b9c028eb49e6303f80fbabceea6a28c2c4fa6a93e1ba7bd6c17a77560eb9c0f6cbcbf6344f86b4d5a342bba741a79be9acd8498c00c8815e369fa3d56422
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5621c0624f6bdaa2051d6dafd35cc566e
SHA1e29f9bec85141ef912c54d6afc0f116e9387bf8f
SHA2568f888e8104441a8a51b41c70861f471c1924eccaed780773c8126feae8287e2e
SHA512837a9646ca4fb66b43ee744426b15f7569fa22b013172d445488a6b4f7e4410125204d5631ff27c60bf943bc1dc7f9b030d59c64649d0b03ea6c3ff2989f7cbf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ac904b0e8d5b415c337e7664e974a4f9
SHA10879fdb9448a85c52cf87e3aba58f1e2e58c8070
SHA2562994773534ccf47ef5ba57f9d1b8bf0ed6275047904345e455f2c518d00b2afc
SHA512efdd63cf8bcdf2714ab276547c70571531d2087a0d3859c25f2db50eb3971cf9281aa78b5666b39e2c40b2efcc7cf4c0a271247d212e4af5aa46726ee682ea98
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD533cb1e0df90e37f9fb127d8f5466c402
SHA1f1b52383da4b5baab7a89318aec296958399f599
SHA256ca68e0323f85f9d382c0bfc753cac4292363d2275c4e9802b7e51a59704c394f
SHA51274b994db74c8e7c41c9eae89fec80d0be7db0ad8b530a2716e5ee043abaf8ad248bf4da330554c18add9d44e0e66441efed9567444f14b23377ed12dc3697476
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d4691aa6472b0de799755321f0247a84
SHA1c43daddb3dd1912c4630ba70e4a019904c043d1b
SHA25656c3635f92c2d2533177dd7265cb69f82d0edaaf99bbf085d2fb798a99636229
SHA51226854a4289339413a6468daa6f0710b8b604bb46d653aea5a3731406b2d8817fee86313bb641480daef484e79eb7a0d59ff61f0d93c3858b1dcc267b777a9304
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51433066f89edddcc7f495204a3664167
SHA14b0f8b6a1e5e0a2d497b4a3c1af662726526d6af
SHA2567539813dbb72c8d14009425ce3c9f87615a99e3aecdfe80bed5f6db04e12dd1a
SHA512527e09927b8e6d6f417aa79ad699b9e87a360c1bf3e9a522afe33a6fdc7460892a48ff3f3d6ae7f6553be95eeed2db655a528f771e6e1de88780052f56bcddbe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d6884ef7a94e70597099ee49a8b45db3
SHA126378f458ca5416f7d82f1e7c7c3c13e25c2d656
SHA256022f39314044905dca1ddb157a7e9630f8247995fa3b08cac4d949b3561417fe
SHA51279e8ad44e6a5beb63cf0532b77d5f9eb41c159cb65b3de28e826173573cf5fc62f0b3f6a15c54adfdff976edc2a053948f61753e1425a37d5e96d0bce0af11da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56bfec44a373bdd0041e09596203ed00b
SHA19920cc05d4dc2c5b26a72c4c2947ed1d1bbc1549
SHA2564e6b955617116afca5b12013f9942d0c84188ff88734a9b915528a5d78c6fbbd
SHA512689a2af6a1975a591cb1782aaa50f632a94d5c0483d18afb0a820611d20adcca6997e9b64f8c62300b6173dccdadeb6f1282438cb578389ceeb00d69c88fefe2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55eafa9f76ef24c8e46b53e33e254e80d
SHA1be2a2a22a084f853910b4b6e77172bf70d611ced
SHA256464cd9333105ca334651eca316d798c28fc4ab5321406e6e5d32f443ba267fe0
SHA512211761d233ab4dadfe54ade0c92fa5e9e52faf4f203ae9223219b73aeb46d5fee4eb534a13883c18d80095d0c9f02d3d033300b35bffaf5471a4d27d9c28994e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a759428d544c21cb460a44920ce1db81
SHA1976a2de2c7765e1902fea96f6f287093cd006e89
SHA256667205010720ad942c5547329d45c8bc1d734f6640d9d585ef41ffd00f0a4a24
SHA51288d1af4b4c909087947bb69d9122d6adf9652bd877d221e75ae6c4210df80ccc93776be6989a4189c3be62441f4e1d3c203cc68d5cdab401d6efcd9752ee3e82
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57c3b644e1dff6e8b9f638df49c4a6802
SHA149b4b9acb3cd9e31a38cd2ad4aa5147938cbae7b
SHA256a46bc1c79f4442c228a73437477720245545955c83dd89246152516ac010a9f0
SHA51254beb42e691d7fc1d3cb23f2b243be8d4953011596c4a91e9d3fb6e5e8f56c2fe1125533f4a941263024b1ab3d9552834a5a5730b483a601081ddf9d83f6933e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b7dd27761b19e5cc3cd733ce6b3215c6
SHA119f826fba8a42a0baa9490dab25ee6099b400cea
SHA25661e1bfc1957a5329ef87f803f4ba9860191b932bd07284be8dc86291b9a7d420
SHA51235441d1c485155d8feaf31575683c6dea0b41f90e75e0314664538c316eea3f7641cb311d9bd2bbd1b67b1d9beeadb8cfddaa1a40ee158101d92aa2a7ce5a8f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5df1b0a8eb060c3b3d33207348d274080
SHA1bd5334c09dd1ed8269fcfcea233456c59b23fb24
SHA256f021245433d1c162d2fb127443be18b854f60169957f71bfa9946b97633173bf
SHA51224d2096731f99f173e6552d9b6b3e27626bab056a9481b9eb28c9b77c48666f491b9fc494cf910da36a530a1eaf19507eba1decd27a94dd57d11392d352fcf84
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5de89a3823e49a14abc7158c2f2faf475
SHA1c5f3037f47f90528348aa7fee4cdd3c30b804a03
SHA2560808b44512ebcf988eec9017c6dcc632c749cd30232fb805b08a28fac102f8e8
SHA51219fcde9dd55d3fe4bc76d4195049a2fbe5f4091e265db69354eeb1dcd9e781304f7fd5081517cf8e75327833fdb82c4a5b2c138aa2cf5e5b0c0e05c495adfe9a
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b