Analysis
-
max time kernel
140s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
14/06/2024, 17:54
Static task
static1
Behavioral task
behavioral1
Sample
ab01804991b012954ced270bf9ca84e8_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
ab01804991b012954ced270bf9ca84e8_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
ab01804991b012954ced270bf9ca84e8_JaffaCakes118.html
-
Size
60KB
-
MD5
ab01804991b012954ced270bf9ca84e8
-
SHA1
d7ef0313bee07333720d9dab01f0ead08858eef9
-
SHA256
17b0fa21fe723d74fae28ba97e6948c93e64f9f8c624b839d43fd3b225e31f56
-
SHA512
d9f0b0a8d86604921b37f4483e6f3b70f4c748c8fa29e7d48d07c0e181f0f8b9a7d57f7c7c79ca2d567ed8855d63f09effd1267033380bc0c4eb1d5f59e771be
-
SSDEEP
768:JiegcMwUc9GeCSXuhjutPoTyWhCZkoTnMdtbBnfBgN8/uQcc8QFVG8sP/Ijkk5nt:JgiRmTRgec0tbrgamchNnWC
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1AC95661-2A77-11EF-B3FC-D2ACEE0A983D} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000099ba626a5d2869c4de31441980c0f1e98d855d63f51ea5c26dacc2b46961a99000000000e80000000020000200000008eed2929e8c211d2f866ed5579a9994f339ad131fc586729c2b979e9afb1ea3e900000001aae052dee115e898d747131244740c49185f0401cbcac58bb42af9e1708b87710a475c373e58b4321c1e7e9a1c82cb47fb7801a4508f95f98fa45fc35d5ab29db848bf865284d7b90b6c9162f250f2db1ffb1b901dc12afd89e9ba28401d2880bd7e14dc23b337759fd87355b00fc1ec6fceec79deb11924e2e71697ef1ea934f14446b0223976858a82df2c04b74d340000000fa47a7a5dcd794b928f654e9ee573a2ea8293bdf99f8e1d1a6fa478e4a5853c504df0dec99f1a9a195d967932577e325e385fab163c471d0f54c5b59c4d57ae1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00e19cef83beda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424549519" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000002a8d185aefd8d8754c0e843bc6b6589a62d30ebe6fdba37a262a477171d21ce3000000000e800000000200002000000026e86af0605b2507d9811fb244ffa7c4b011694dfe2c9f34733b697410197c202000000032851cc4896bb672f5fe156a97ac54167b54c6d4ac1f8c33fcef15d98744cdd240000000a800fd25af97df9258aef7c0c1574378228963f27dd8f262918f70de2ef0a01dd64b0f482b8b848b41a05ce8d5ebe56397f5b922baafd09585052a025cc0f973 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2860 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2860 iexplore.exe 2860 iexplore.exe 2548 IEXPLORE.EXE 2548 IEXPLORE.EXE 2548 IEXPLORE.EXE 2548 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2860 wrote to memory of 2548 2860 iexplore.exe 28 PID 2860 wrote to memory of 2548 2860 iexplore.exe 28 PID 2860 wrote to memory of 2548 2860 iexplore.exe 28 PID 2860 wrote to memory of 2548 2860 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ab01804991b012954ced270bf9ca84e8_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2860 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2548
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f64ea4b4eabc2701db1d145644e3021c
SHA105191bd65e70a6cf7acbbf0d3f7db35dee804870
SHA256c301be13eefd839155d821ab6d39ba137781f25f3b2ade8b2e08586f1c8edfed
SHA5122e6819892ed6b2c7539d6e3b6b5c1e5e04c8a7a3d3d7bae41dcb08be8907c32d92fbdb8f0b2d2d91df76773960f7b1fc3be13653d72ccaa0d4f34d34821a365a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52cbcd87321bd2d22eb98f4ca1b2f9e8f
SHA1412bfd0ed53069322291870f45822ff58a6e4c90
SHA25698449fad86872e9f2b74e4f9ff497c557004d6235ff2e69904b748499e6913e7
SHA5128169a6bbb5c07e7a1d4d6e7365846fa5945a32580ba4f0db4ed6ba81c2612bf08f2968365a9d18b3c1150a0824f3f8af5c8066939773d4af3d17cfce0e8e681b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e9ed47c9c21f06abe4bac8a6425b2e8f
SHA1eb260ee9aa2904b91322902cd71434399e77e39a
SHA256413b6070c042aee742087aa4424334b415ee69ead0ba854fcb23971de5bf6063
SHA5125b12bb417a5ef7bfd82aa544a204692b89ed87032265b62b5503b21efbf8a9c989cb65a0a14f00cb93dbdb72742b20d0848834f7b26bd4c0ea0eea81df8e8f1e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5638d8d25797d51256257e5f5463f33d0
SHA11c4767bbeee7665cab7aaf790a98ee73ba07a0b4
SHA2563adebcc335bf816e62ed7c4c5aabbebe6b6e85718060325ea371aedac9b9c832
SHA51247f94218cadb6cd8748e3c5077c82c7e3c76946a9f41642ced914adb4798f5937f1ad10bc21c57d13a9525607d6b0c13e6829d1876b3bb3c2b98470d57a7d4aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eece6683613b0c5884bc3b561bd2eac2
SHA10318301dd43ef1ef8cc4ee6717e982431373fa65
SHA25601b12f739f6c91647438dd1a0b737ae9fd139f1cd8e1ee7cde96487bd1d4a965
SHA512e3b4ace7ea11dc3c92339dfc7e7645a7e9d8b7cf5f172b312d16a44342effaeffcb738ec2394daa8ab35d7219a27acfe225ab404aaecd380db0e095fc3e0eabb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57c6d6ac2447ed6ae32fd9a10b99ce834
SHA1c7a65235e7a2ce92e7462b0d7ee493612de604fe
SHA25647270498fabe5f050521d3fb16e77da8ec5a462c79b095e4cb8d5c200b993798
SHA512f014779774aadaf52848a167755ff71bceb1e2c1b910e355d2d4d77117d7ff6cb0c7436f39f9575fe17a6686ab0b4d43ad08bc846a5bf6217e75f1cc82ab19c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d61205642d92d690133d5444e20dc3f5
SHA18bafac22787526cfcd4d2a26ab199f2d702a7f6e
SHA2566a98d965397e6422d7213aa5ba6a6dc0e92b7a67998c3c93b9fa919843376826
SHA5125e25ae78e9f9ce406ea67472a84c7cabfe2e617bccf7c65960aa1b3e8d8c8edb82a5f6d3d248d6ea966e858abbbec089d5a40ad35c36d12b555606a4ad48c81b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b68d6a8729bbe4a9aacac2fc8981de71
SHA15261a4f9b0957aacb37182c96de89054a4e84890
SHA256a7d40784534cda4f8c1d60a7a8e1b7eb33ad3bc79d8ac2930461846b47777a04
SHA5128e4889b2749e40faa723c9edc5a1e208dfac75c00ce422f399f1db9d7352a1697ba172a9c3a4367245e8b03ab1669be94846a3bfa22a318d4a06c79d065fa2bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b17fb2ac61912b19c8842f389ea5bc1f
SHA16df17ea24442a3c0a2616ab0c0cdc34a88a49837
SHA2567cb49a7611d12756ddc5d9f58110a4aee707767607c314132dceb3a09b7c2fe7
SHA512ad8d4d24446cded82f4c96b4e6ee8fdb5909aa6c2cfa9ca5f0fe7197343511e40ef3a31b0000000b5eaf76fc1cbaf166d3d88aaab6c85de9e6f4ccc0b8bfbfa1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c9f5eb28cded9ce7216fe6a73364d6d9
SHA1d2a27b18cb3f037cefc64b10f8d1d907bf187f27
SHA256b5afa7c4ff0436f12c31f38a050ca43a6fa602b31e2720130445ddf4f813363c
SHA512a0b23cb5d75d95d37356611ac8c18e3c6d18434fac03ef919b9c61a79aaac391a531bb0bd148cfabd139f11ca7449bc720948b0de4782e340c189a009a1540a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD503ba1efe6101ea02164fb08c7d61e78f
SHA10cad405b72638266f2bf80382df48cadd7e78190
SHA256ff018d798a22bcc79324bbd738053faa9ebc92c6a84bae2333ffa35a2559c336
SHA512ffaafd358182fddaeb46e89023996804ebdabe03e1663b0d043aa7eb874a9e7b9234e2f7be82c7f377ce4274634e8c8288bdd589877956303fb331f505f90a3d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD576644b16c8b374a749d384a2769911bb
SHA1d44c846833b9e7dd61338ceb8d39c6cd5d2b1d52
SHA256084e04c69bca0f392267c58ecc15aacd84f8f2cb42117d7befaf07c5657ed10a
SHA512b073c4dc97f612490f8be2283870a51659ef073dce0a6609aabbc9c52f3a25670847d8ab2bc3f4f754b58d619a3631dc220dcac04e8e27437ca9de0054bfd91b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bd4e9cc1cc9c5e6d49318229e88d4eb7
SHA15bc41e09513223d41aa1eefd225f82e9b4157a79
SHA2569593108ad1d6db46df50b31c0f1f23f2da170db61182a1a6800f442fd29e1041
SHA5122b1f442a87b28416703829e36f65fa2b8c01fa86e11f0c7351017f5dc66f992f0549d5635f9f14cf8637626bc5721e059f90df308d066a06769b913fa995335d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eb08c3feeb29d23999abbd25e0e5f3af
SHA1b7bb481af07626a56b5fead9c861f13986c11139
SHA256d888612eef741fd10bee28919fbd0743b85470c3447f29011ab3dcf3dcbbbd27
SHA51298adb05ee74b93c097aa8fc8d312237ba95cace7629ec1e0568f2f78d17e84ca16bd93b5287ab2b5efa1d00f1b223845119ee92de3372f3355e042369a9c6214
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5afa1408917c7ddcff47fac4cb769b661
SHA179b4fc17b43afedaafe8001495810de04c06d1ba
SHA2563f6e5e1b4352348141767e700fd49de7d53f17d18e1bd9f312f3d628c8b4a043
SHA5126176c0ad16fff849377d5ed701c44d8c2184019566578a066695c0b6700910abe4a02105e66a65be740517582ff7daa075a41fdf909fb2321e4a95b90a0f0c9e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD513c53dbdc09fe603367c5e942be8e117
SHA127591806b11e6cbb933d543c75fd64eb315d9719
SHA256522382cbfcd594f065863d9b8de300585e5f942ed5431d465a0bf499772828cc
SHA5122b87a7d18c42d2876af39dfad02d2a72e90de9bdccb01c71d0ad5f57aad87f2d056a14512c1f4418847b08e667b455cd125c7a4607165f041788494bcf10d248
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD507d463cc8d8be82a46e8d5ef65c20fb3
SHA19f99ce666f462ea273ca8f8d5c1f8b48ff0b7430
SHA2567fb29aa4729b695df160ce0962aa06da577b2c034e27db704ba164ebfb55d820
SHA512284c827e984692c8faf5c73066f4deda9c07d381ff8b3ce56f9bda766652f7bd962c003be2be77cb468db4891680482204fcd6c39c15234b8b7d50f397f3ff6e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55f280623dde7a535b4d71eba6b2bb20b
SHA1272bd0329c9d1b1453a717e191b8133e215fc540
SHA256fd0f7f40b1f93a77a0beb15d822971ac306c1254781a8f572208fe311428a468
SHA512edecce2b717a8a61d4991ff0a2ccdac0c88580959b408346f46591f84d5419e26f0f130eaf19fe30271b9bf0ad73b222fd6a8112970badf04ef74684e29cd6de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD512c40d434d877fa14dc47a50684d0d76
SHA1daf372cf0a2f2630c182f1d3e4c3b7e16f47f217
SHA256e92d0126984804eb21c7bd646d5111e34345a4ae621dc6113862c673644b2bd7
SHA512e3793252dd947b7414662bf11160fe9b17ed83cbc199e47692b62aa1152cae98278e4ee885af2a73d9c9c840785b69d50e8d5333c06811633a2de9a1cd8aa37f
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b