Analysis
-
max time kernel
138s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
14/06/2024, 22:59
Static task
static1
Behavioral task
behavioral1
Sample
abe29238c71541979d5766526a43b8f8_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
abe29238c71541979d5766526a43b8f8_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
abe29238c71541979d5766526a43b8f8_JaffaCakes118.html
-
Size
123KB
-
MD5
abe29238c71541979d5766526a43b8f8
-
SHA1
67f5fb73712e1a9a195185759229e3f05981414a
-
SHA256
d3a4115264118c824a0ec40ae834be1c873d9e5b2d2b6855282878367806fa64
-
SHA512
35055d7f3fcd9b5a4a082c50e0b693087c4ed3eef9e7e25adfeef97d8368b638036370d67dbea1387a3866492a5e73095a3b82d1043491c4059e00d0af689ae3
-
SSDEEP
1536:Set6URyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dK:Set6GyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000a447c7a74c0184b9eeac33fb2ec7a8f0056de1236d8c71673bad19d2fc1039d1000000000e8000000002000020000000a9874aac6ebb5dd726465b6f6c3d1db6dd1fd14f3589433ee8c6b8f83fb684d12000000041f4e01056a8a8d4894c09159bac725f4b3627d92c583f4b7a6b70729dd36f9540000000f0b8b97c5e1c7b1ec0a4f3e301fc8aadb74fa04f99b87270b879a2e259f769f71d1029f54fcc4540cb2625782d616400a4cfb3c3935117173a4a78e24bb62a3b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CA0CC331-2AA1-11EF-9266-767D26DA5D32} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424567853" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000007b4e5a5f17f08a64fb8a4f3da7b7f6b030491b005ab50788378ed8d3ae0c6586000000000e800000000200002000000054a9233a2f566064e15418a80b043aca9b9bc5f6c073e67550f26512b97bb0ad900000000aee0cc70067d15d6b32fca0f30ed98be76a434ea88beb7ad5d24af2ae2bfe8c883df5677031f265899c94d862eba47c8fc5f0a05c85a09d223a20687cd8d86a62b3ff4f11616860f5809f600b39bd5b2c1585520c6bf0e68aa16c41fbba7dab765dc749de2433036b4e9e5365ecf12f870d40fd1a5361e53d4e7f49a399f1bf64896259122d45d0433138d3c00014a84000000044d7d18b0b5db55d18966591ebce5c15c364d12105fe1e991ea5cdbc7ac1c0acdd6f5a9017b46e8b9ece7e7f394f155dfee12ac70278ebda7aac8eb68176fca7 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90e48fdeaebeda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2124 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2124 iexplore.exe 2124 iexplore.exe 2924 IEXPLORE.EXE 2924 IEXPLORE.EXE 2924 IEXPLORE.EXE 2924 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2124 wrote to memory of 2924 2124 iexplore.exe 28 PID 2124 wrote to memory of 2924 2124 iexplore.exe 28 PID 2124 wrote to memory of 2924 2124 iexplore.exe 28 PID 2124 wrote to memory of 2924 2124 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\abe29238c71541979d5766526a43b8f8_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2124 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2924
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fa965bfeda63fe9efeb6503f0710541f
SHA12fe2438a3662736510ae93b882b9b2d1aefc609f
SHA256b3336592d0bd7ee36c157674f399b8f78ac9c52eabce1ca667e1c97dcb53e5f6
SHA51284fda76bab7431ec2441eb59a9884e21b76355e8c3fb897b00dec122bf26ea8a1437584712261de9d3c65d9515b73a2d0dc404210f431eb05f20009a5e54d6ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD577991972a09696cea5077089c410798f
SHA1635530e3463f57f1b8312d1a13eec90bbabfec88
SHA2564d0d472723e85518c7459264ccf1d21970659467af0961399ff5dcb9b9e6fa6f
SHA5128d07a6e40ba8a17122f1e72b6840c872947bafc2e331be5106901c65b9d045e57c9d9502151efa0397f47ddb96fde4624fa292f9e312eabef0013fa57d0c2e44
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54f9a6ab64d29d90b884af5679759778e
SHA1381dc4eb40e41ae30855f5a5f653fddfb044b9d6
SHA256f350dc47515e6a08ba30e4f77aa526d2710099baf627a77aaaad2f26a1bb8d20
SHA512bdb7eb5f0480a2002daaeecb6b5b5849fbe32d80557ce356296ece725d178f294461fdd5a7cef037717c28a8e5a3c88ab63b6dc263a445a3b619ac4cd9c48221
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD502db7b40899e1bec378e4c328ef9ade2
SHA1e304cf15d51bdc0c9a5847eee4539020f3406c40
SHA25685296506d73261d007e1c2129f0b42dfb3c4971f1565614afd4d87de20362809
SHA512d11ebfb4566fce8c5fa1b8c2383d753b6df3c3071c12fee2f874de7ee99bda7946a10a701e84f71454e3ca219005a421516b53f3d03eb097a86bea8df5bc5a81
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50f6293cb69c27c6060b77a94f6aec02b
SHA132b3a19fba37f559e48a8b4912ba0dcfefb546ea
SHA256d8528b21d9d965fc2f9e35243bad7ff65d0644e3ab28ff04cbdf41c95dc0fa5b
SHA5127fef9bf09eabddbb4a3d3866daf0330114fb4d106654ee9fcd0cd3835d89ad8b12cb4b793f52410df874128c2f856cc4080cce2ac716418aee9ead0cecfaf82f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e2e9e9cb1c72698370b5cab35582b98f
SHA1d76cfdf4e4dcfb81cb5cabe9d39fbc04268a6423
SHA2561b212795f641307580705b6faa4e3ce97dce40690ff3789c0edea67a6911d526
SHA5128f9d93769b2c46022ecd454f111e128e77698c4c1c2480aa6e8e4756ec8810ed3335618b58cd7ae95c9a51fc14ba0c623d2b04b87e6824da27b10b09eedaa529
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50948ed452ab8ad090c00852c3737c2f6
SHA1cd18430af432254a8caef03058539009421155ef
SHA2566aadffb430774520ed4f8b50f090e67543ae424e78af5edf365f52eadf30efd7
SHA512f1385ce80e6e04c4a5f6fc8ee3fdc5ff34ea52a60a05a179f8bcfa28d93901920459d160adbecea7fbc663c6c27e9107416fbbe9279e51b87ee57bd717b04568
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b3773f79a036dd5a41b8664b2cae6189
SHA13fc1ecbabb50c095406216610f0d3c378c2ed419
SHA25632c9c8d9046901e7b84b0f86612b1b8ce10c751b944716d45c71955b011f3061
SHA5127e791e55a6fa5d90a0f8b8bdf757384e1ba94493feeb7ba6029ddbe2f8b3939a9e2f08c305a7e88299890622c1a51475529c9d4acd0747c1dea80444d1d2f700
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5efe871c709c1f5cc7421438423661caf
SHA1c12f602f422c467a6b18fd3e0c475a618f267c79
SHA256f1e98335c5249dce496b7d7b27c3436a987f71d120538166bce341de2ea437fd
SHA512d959d32279fb6123640648332164eedf7d9a1f68d57e3ff8bceacdee680af9a10a1d33878161103a168cbc0c928caf7ef229320fe3e896b085a1a044c89612ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD554c54b09b2e85f54ca0e997abd0c0205
SHA141e77890e8a08612d89f5a74c56003a7bf1cb558
SHA2560d7a8e10873c124d1550a821896de4c22efa9400f22536769e93f4f622af2b2d
SHA5129ed3af792172673a0580cff6084eefa9677f31c322976d980874c0b26f5d7cd0c099ebb7c9f549c800837df8ad40027352a24f1bee3948d405c53f37fcb1084a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f5aaef7cb522fd75fc1cab77601240d7
SHA1691a6e0d0e4c96410c64f6fec95a69d70310f661
SHA25621bf1596bedf1577f73eb492feab7e424cec6ac2778c311225800e6121002680
SHA512365a8c146c42d113eb01525ecea2e254fe6785adbbc80605df3ea081114115219fd5c095056901fb305cabf61f17c0551f42a84126b16646534c6f069f32ec38
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f8258cb05cffc05ab0a594a272281f73
SHA1621fbbbc403aacd909b94caf75fe56a974b864c2
SHA256f13a9f8c2e6275de42b6dfb19e3a5406e07387a9293616b2b06c82aca435e87c
SHA5123e7e59f0d3f7a08d8b37bad9386ae3df96f4259bae565a8c67a12513881b58bb1386379abf6cffdc9ac787b0489aa73f3a170b724a64e16bb44e8853ad69cdd0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ef929c34bd52e81d3fe2bdbaf867d0b4
SHA1827314c9506ee4d5cb2cfefb019bf3abdea0b1fd
SHA256c63387a3d38d3a3d72942f8eb511b135d8af09de017c8b4a4f45d7a0a299ba7c
SHA512dc21489f9c65beb6cc3eb5e617c45b2bbca5d1ea7e2504308f295dc350f39c3ea7e3618fa45bc8713bf98fb4e15a5964e690aebb8d1134b45a3e092ce1890a16
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD576ddef0ac95a6302bd7c5dee8165837e
SHA161b8ff9e82711175d2c23d05a5e6174935b903ac
SHA2564f8c57854c88ee728bf552da5acd4baf730da2761b7506ceaa00bf8bb48fa745
SHA512125b94f3184c3e60a1afd22660368709fbad824fb1364c73475c16ac288883efd54825cd0218bc2c173bc6891d2aebc4f19de49f29c5c452f72d8c80a13372f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c5f7eef43d5d0c718e8e0dd70cdf1131
SHA157ca11cff36a10e55bc2f09b518446c3cab12647
SHA25641dd683a548a5618fb0830dc29316d5958a2ae1f758a9746aabe43c527b79c23
SHA512f777298dda52edbc7096025d00a3b9cfae04016e9efe9ce7c20d5c08df6fa96b19a63424d689ac5bc66e4ff8fd18e68b887a300163484285f80ac56fcd06a09b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c6dc21f11060562b3ace3ccfe85c4b58
SHA15d0e8f2226729aa8b94a2f58ffabdc5d520c4002
SHA2560a4eba0c93158862230a3488a474db445a995ad60ef746aab47d3eaf7fb74a0a
SHA51210a22bbf682b771534a7273836bc492c2bb26e3675bdc1c66aa793793b34b01e40b50a789138a72f41904f12e9671b957c92117e1c8a31099f698f229a75e459
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d8a4c7e5c19b06dfe89589e9a8728399
SHA14610036df4c9cf1057fe355dded588f0cbead5c9
SHA256f2d4816183878b3c88a5cfb11dcac245c81df1f700b80920aeada72ddc8815ed
SHA5123e01b2c689b4d0c7cf22b363198b7dffe55bd041c3b2918dc8d91d837d4dce07d072a75b29376d3ddcfb71dbdde7541d48662437a057b99305cff6e8a124e7cc
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b