Analysis
-
max time kernel
119s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
15/06/2024, 01:45
Static task
static1
Behavioral task
behavioral1
Sample
ac762e3a8645a6c8a141d7b1e166ffd6_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
ac762e3a8645a6c8a141d7b1e166ffd6_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
ac762e3a8645a6c8a141d7b1e166ffd6_JaffaCakes118.html
-
Size
29KB
-
MD5
ac762e3a8645a6c8a141d7b1e166ffd6
-
SHA1
99836508a4855433c3ac2630b93f5b0f023f7197
-
SHA256
ebfc6e96fbe46b16ae658196b2aa11451f777a95862a27355e9a9ad78b12ae6e
-
SHA512
ece86207b846d78b93657736b26056a08136187563f09203df97eaa1868dce9e29ef3161a52fd0bc3755c5dc56abb48de12f7e880bd9e3c2d2a4475c92fd933b
-
SSDEEP
384:1z938FWb52rVs17Fvq9QNzj3f12bTfFTeJn+zEI:z3IWVp7Fc+zT9mTfFTesEI
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000a9cd8869560ad06eae58db1059dd6763af5bc070876b9d57f856fcd99ac845d7000000000e8000000002000020000000799ca50401a6ab0c9979cabe807f59f2459762c0b85a70b5fe3cb4ff01a2695b900000004ac615f568b8d10250325b197c905873ebfedfeead6a2c015f34710c78b6d492eed741dd1068cbc3748c83531435aac10f024598900477797d2f28bd85895e4b292cacd53965a5b61e343e6977c10b40fde2b2255da30a123e1dac0093364d174d4adc8717c3fb5d4eef2d898419aed962b3dc67c3978c915c2d939d8f5678c1e5ff32131da0d38609cae15d58f3e736400000007fabb7ac10fbc3e39db18b659d2eb85d737f22fbfdd00d738aa575f837affca518700c70161ce8e25aa3e464c3363010d0fb5646fba7499bb2d37373f9a0175b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000c95aef36ee9ccba1f65a12fb0ed178b8612915eee68a272163aa9dbd39bf2ca3000000000e800000000200002000000042e93c578f2dbdd58fa3c2948887513fbea8d679a7c0e4dea3b12d1849bf277b200000007d6b800df373faad375a5e57c29f9c044d3a5edda3a6679becdc25c450a3e2b8400000008b97562071f99b1548410c49e0e024fcf53f4cfd9e4e82754b447b81c17d92d0a31d1f4798060d91c101822c0d6a59632c9e89ecba9c13a32156af8b8778cdb1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424577796" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c01bf3dec5beda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F12F1371-2AB8-11EF-B489-E681C831DA43} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1444 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1444 iexplore.exe 1444 iexplore.exe 3048 IEXPLORE.EXE 3048 IEXPLORE.EXE 3048 IEXPLORE.EXE 3048 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1444 wrote to memory of 3048 1444 iexplore.exe 28 PID 1444 wrote to memory of 3048 1444 iexplore.exe 28 PID 1444 wrote to memory of 3048 1444 iexplore.exe 28 PID 1444 wrote to memory of 3048 1444 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ac762e3a8645a6c8a141d7b1e166ffd6_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1444 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3048
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f96191c42290e377e1c60542189b6e8d
SHA1426a1ed4e9f4be528589919bf7464335d2e3914c
SHA256af6bcc960cac1b42f7fbbc8126191a9db3299408f86b2d904b6ed2e01d7aa67c
SHA512d18a0831b95c0c0b04e3d5943c42451818aca93bb38275fd4854cf6d6180083697a797d5008cf5fdcea790177dd4328326bf7143b3b3299101eb292610d91a46
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5db70983b3282c3756deb8fb1a90c6cdc
SHA1fc803c5a842aad2e95f16878e45ecbfae4589ecf
SHA256534646b5d520de39ce6b01732f8df46f335527cc442a514707b80d3cdb46382b
SHA512f752ec0083071e9fcef01678291fbc4aae37d40bcb704773dfb777c0fe4d2a85180781668a1a36aa1b23c5b68c13861867eedda527b09a94ca5f0737774e044b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD566779f85c0c5a1426b8cacb9900429c6
SHA1e753507e77329c1c11fddfd8eb21d3325b1ffa3f
SHA25676da41629a5214da96990147ad01ced3fcd1cbf924a99c657106bba5928b014f
SHA512027f977807d3818b83ff0603592b71af43cd71cebf53c54a85ad6689a65a4c4c36044b7394a55c20794e0d06c6acb7bfa8d74b9dfe0968bc46e8df7b641eb7ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58331a98a0ba1a87f9f2a995af5a24007
SHA18442324a4a96329a2921df709df1f3b6856c7bec
SHA256da454063465b36b7de931050dabbf8633d7a14f5d00a7a6e8db3760b98c96e5f
SHA512fd9dec9fadba6e954a586abdd247f1df6e9e8446885540bcb3a8461b5aec3b63dcd32c3170092603aa1a122cd484a980c7a0d5cc8eeef3c6f11a85aeabded161
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bc1c8fde16032f5c203c951818230176
SHA17d01331955f39cce7a66d18dd44afdb18eca37c7
SHA256899f057649a00f3be1ead5c7c928eb1dbb3e7aa77f82daedfe8b54203697a493
SHA512701935418845bb3a44e8ba54c3f94016aa27e2afaeaa1eb9fab963026b15eae335a1ac471228f4b6c260142a8038ee6d584e638801e323ecad7ba2c2b67f000a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53f560d2a9eda480351dbd75301c024ae
SHA10791662470fcf44ab6dc3599a76ab37bff250199
SHA256877ccaed1e6d1bfb89b4a392b06399c9ada8c99beab74c693d64809b414049a0
SHA512b99f1e8b00901bedfc87d70a165a1f5480204f3901771f8a26600b43a80c7b1f56d01578603ad6c039864afca2f648da2220bd0e14dd16dcb061851831480ad5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD579da596d167577e256cb7c98a59e9772
SHA144a1bc704ffcd2b6fa7b233dcdbf7a33dfd69f33
SHA2569158cf700a9445da498eebaa2493399d59fc08b263d8c6444b86b313a318b6c8
SHA512eb7509f49036310fc0a069ef671618d8fd6018e465baa0cfcede966d5f3cbe55e62640931896d706476bfcac54f73daaea6600707ac499c83a2201a66d1c6458
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b3525271c04a8f15166343a39792b549
SHA1b8dbe23e9fc1c386279b3f36338d5fa29e08cb8e
SHA2569fd509f72cf2df50f6509f13a554ab248f747726536b1c7cb9bf6964b740a28d
SHA51249e298f142f98688d1b4752c8a350a0a85bcb629ac19add2d520e0ff75d4b4e35727fc6a174ee357149eae6839db41b457650989822bd03e64b64f20ed9ba4b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52573ad1ca352e949107f93da49192f87
SHA166eb13039093067a97beb15c5b370c5ed1722082
SHA256008137da1bebc3ee7e2f4b1a468fd24ca4e47a95ad6f9ff877fc44a7f5d37f25
SHA5126adaaae9ee924ef340c455511b4148fcc793d35f72fab72435615ba0767011477d2fb78ca5b98ba8f14babba0c274b8f118c7d9aa2aab6e77b84a3c125aa376c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5955cfd36a2f60df21440f23f1332e2c1
SHA1086c4175ee84a43478962bf7620a3af4ecaa1a30
SHA256cdba0f16d1a66f5266b06367e827839628f5d8123413691708f504e59efaa76b
SHA5122db8c73e20abdba2b33f80d5db6aef01b24e25a858bcbd2219e61c253d95e42dc8c34fae93fc7a2148ff40edec02574cd45aec8a9e798a0cb65b5acf95036470
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aa5a0a53d3aa3024cd63dcc3bfe708ca
SHA1591eb9615e2dade49444276fd9f3a64d137f8df7
SHA25610d6cb17a07d05385171f1d934839dd0484a096eae3e94746d10ae8938b710e7
SHA512970596a28b68578cbb3a81b6ca6263b851c616acbfe95b0e909c6f46fd762561c88ba1b7f4289a496128289dc9b4d5765f2187f2dcb453eb1adcb0d8bceb7ebf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD589f5b11d1a39422932868eba283320c6
SHA111c6983ef980cf1fc579441d63b80d5000ba1e05
SHA256e6beb5176cd3d03b320a8872734eea8ef6655bd1f9dc9f3ebba282c1fd953698
SHA5125c5607e1108b04569b94bf81a70345d3468baae3c0c9feedee7cef3be52c4f50c78f25e2b40d515d722e79cbc7f4750c135b5ea71b22726403b37933cae0850d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD570ca1c5334b1c00d6e6f95b766901331
SHA14b19fdf8e048f98eef562d5960995517b9b51355
SHA2566df36da65b1a2c45b66af8dd42663a1c7aec99e65e759192e7fdce01933bfc20
SHA512e81317d9dfbdce516289caf4a8ed97bd2775a7c9d9c05d01a1657270043985e8cce9f8f43c3e0460a8c4d05b79150b88167626a7600dbfd5c3deace01014d2ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51014dc46604ad54b4f704a5720779d69
SHA17c37c14260c7579a22821465e8095c5131f96bc4
SHA256c4d636758dc9c23764d929bb6534b24bbe47ac55a1a0f2543614a49e267321e1
SHA5120432c792e4655d62730ab2f5f4b19abf2d3a49bf7eea248971a65f6cab3a84f9d36eab2993d2ffa5d2c57108d5c0f9774fcb940702a55bb6d46386b2ccb2c360
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55ae334a7fb69f7332615245ff0349249
SHA1eaeff8788ba0cbed5b9290b8532d4a293d52fd4c
SHA25685f5e6dd0c53e9840ecb01852110276ca23eb3ad8cce83476f905ed36bdd74ae
SHA51276b4057a667370ae2ebee54668e386e4eff8193563f0cc083bcf156005ff570bf7c494f4f2d914f395367edfa481d63758938545df462ed116bc82cd4e491318
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c66143ef3770f0d69268566c19dadc67
SHA1d108470ecee02870a7b4434d5d4bad9d539f5a19
SHA256e86b7e1038e3f56160e60259fb7b76268a1cbd0cd13e0629e2c7adb1c5c9c39b
SHA512df7e719b1993d63e769b686d79e9bf95f9d21d2c0455e4f25bfb4da130fb968cdc2e16517d589b5d8f58c31727ca426926c237b556a0ece9b72b9c273ec8dbcf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a5430e71393f1909e6f7cca56c4de7be
SHA12831f421922e468b6510074bcbbcfc70dfd5ee02
SHA2564970e0d86f09ddb1303352e190ae23b6a11a2bd70aba9543dcf0f276565b6451
SHA512e4774d86e95de70df47d338f11e95549e36a4949aeec81dd274ba79d9fa5fdba44ac39398dee53ce963f6fc5cb2aafe7cbca71e062962012654822f1f4d8a09a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD569ab15dcf3967950a2eedf3550f2dcbf
SHA1b2197bc53f762d8bd9ae61300bbce27c0afa3c86
SHA256d073b32f8cd1b28330cb59f0fc48bc0df59a5bb3f74c102ad6a27c987133af3c
SHA512dc0061c8967d878e184e8efc8bb7554d768d9a74377c6baf03d58ac3fa093d2b8047bf5e623395cda8ab6bd5bdf5bd430b557590deaac5f11d63c4d14de8492e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD531b3b1f052a34ee7503dbf644077805c
SHA18cc6bafcc5122fefb40adcd4b019a4b6f1f4f8e6
SHA25652467a838dbe8fea56010327da72efb6064dabf97564c5459f0ad67dcc869c73
SHA5126bf373b413c5d576605265bb6d164fde8aee27b103a22e5625cbc9fe997d70a874c74f0ba5cf4fa1b741d1178dffecbca9e5cd74b545b2a9e33d60e909d4965d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b