Analysis
-
max time kernel
137s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
15/06/2024, 09:15
Static task
static1
Behavioral task
behavioral1
Sample
adb639a75d6a98bf7a245112360be0c5_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
adb639a75d6a98bf7a245112360be0c5_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
adb639a75d6a98bf7a245112360be0c5_JaffaCakes118.html
-
Size
460KB
-
MD5
adb639a75d6a98bf7a245112360be0c5
-
SHA1
1fcd229306f4addcce3c479f4158446a3142998a
-
SHA256
e2fca5b3ae036f7e1a904bd398e5cb34f245ee9e692b70b5e344b9e7f39efecd
-
SHA512
4de8a4c7e1552737c9351bdbcd5de11967dc37ba12901f807f7663a342a209a3634aa3802876b0321da4f12a36b7a1b9449814643420b11d4050a7822937b29e
-
SSDEEP
6144:S0sMYod+X3oI+Y4sMYod+X3oI+YWsMYod+X3oI+YLsMYod+X3oI+YQ:l5d+X3Y5d+X3K5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000c5aa0568d67f7494c2098b871dacb34610f4b019cbc0e9797b18730a73908807000000000e80000000020000200000005c6ab79a9580c0a1c613e080dfd07fdcb0cdafab4a9b8aef997860ce8e583a7d90000000c6f201dcb099a3835b9817e207e556fac2181de27a9d999b39c164816be9edaa60377c0bd63e9c66e40723ce89fd6389c6e0796cdd6748098274fa131615ed81c52255f45f6c98345641196aa4677bd95939b0015a314318159723f735dcc64407bf17c768536744327625c0a740a4f6af918d60579497a4043168e1a9325a42a9e8a4c5e7099fee56b0054506caac6b40000000f5624a2a06c51941997360717b1c6611fe1bedfc3ab1950de51b931c73734df25b2dcb3ea96a19ca61e41f8ab3e0533e8e07d2d5b4e9e17a119e42951d69fe42 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C521FB51-2AF7-11EF-8B35-D2952450F783} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424604782" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a80760000000002000000000010660000000100002000000006d576b7ae8acf6747e289650d81d82f6bee212c8ddca8f220bfe29474dd4cdd000000000e80000000020000200000008f2e78a43ab4f762cd7dad1ec98d8a44dd8298a9f0888d76f6107c77088d47e420000000ad10010cd160323f54d17af15eb617185b73b1efcbc668ad98c0695199aebf7c40000000fc8cb6f22756d7f517f1a9b00b2e9651afcb93ed1b01442aa4bd0d7bf362f109205b3a6796bb225be2266482de4c324babbcf5d868114b61fd418467f2c3812d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90e1fa9d04bfda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2208 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2208 iexplore.exe 2208 iexplore.exe 2788 IEXPLORE.EXE 2788 IEXPLORE.EXE 2788 IEXPLORE.EXE 2788 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2208 wrote to memory of 2788 2208 iexplore.exe 28 PID 2208 wrote to memory of 2788 2208 iexplore.exe 28 PID 2208 wrote to memory of 2788 2208 iexplore.exe 28 PID 2208 wrote to memory of 2788 2208 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\adb639a75d6a98bf7a245112360be0c5_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2208 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2788
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56b026a183a1869351a47308369a92cab
SHA179f71ade2d03fccb4367a1e512ede496c2d8b974
SHA256c7c84be555c32475636474ad0bca726703387c605a53f087c516fe9f2e854fb1
SHA5128803de0ade201c04d26c172c12236518b6230c56dd97d19ca6ac0ace45263d83072fb3086eb8ea100f36e24b69199915db38896ba031512bbefe19f50a4c6705
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD511076132ffc53b48531a6fe4fd8446b4
SHA139b3c4cb0c33e67bd76152d107a4d268936827f2
SHA2566b69dc40efb364f9a51ad3d5cf4970611887fde5e022c971b0f33667906cda84
SHA51204f32cebd405a01e507c992bb4abd197ac83fb24a39d9fa6ee14c1f2348c90cd5e01794c460033a214bfe1e60106d0a027b9bdd58d4a1b1b9e42896d4e5ad379
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54afdf6d9fafb3a40eace541bc89cf6b9
SHA1a7fa581851d20120f6ceac1e556c9464f54682d3
SHA2565c3bf7882bf91d5d4dda0034a8be2a8b0640b562713e52285aef26b6033431b6
SHA5120de6f25ad2a6116452d2ab9477b0dfc7f135fa7c1326b8e100f6432e6b75b5e2a3a868f80156ba823437c479a8a8c33bbfa4d6bb356351f7ba514a33fbc8e92f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55f9f50d2b4fb8ce7c04c55fdbbe0d3c4
SHA1db4ef7c88aaab3b705ea6d5b7efb19478b85ff84
SHA25641fad06866a7cb7ac1bd43f0d6f6c199b5094d437cdf4bb7f68c7d067f7cbf70
SHA512c651124edcd058d7c969985fe4c1e70b715b148de08fa70cacccacd8862305dcba1956446fc2beca6c02aad1e23ecebbe33e4e107e79ac59c7dd01e3648f8fd7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5825ffbcb53389bbf89889f1185e04622
SHA1b06b1c3a1cda4812be4bf3a931b6b3de6d85f897
SHA2562d9aedc09a3a8b77d84bac702a8f21d53538f7a0616acfeb48f904b62ad915c7
SHA512e752bb69307d4ce0b93147c6ec9db3b04d82016bffac15e528c18b3a93f01b611984fa8b2e14909502932482cbd5f36aae091bb68ed1b6fe72cf4be54b0b7d1e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aa742b47973485959ebcc91b624ff82b
SHA14d373fb8c38e992a062d8b67dea43a05a23d277b
SHA256afedd5e3e60b6ef83da4068777fe3966d3c22e112aac43d5b35f08f3715b837f
SHA51295924396a1332bba8b356f4e9243501fc1360d5c9e229c72f7b606e5d8241a769c88a8d0e4b806d8fecb1542ef386da6101ab43f42b79a64e5ed0d2e81da76e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a3fb5351ec5a9a406b980d6a76400114
SHA1187077335fe36a7c592949f45544fbf57955ebe6
SHA256b3192f6072216d96914707e3788e94119e096e0f27b8da6b5b5355256cb1020a
SHA512c4f7d08547c9f1b7d0f57701036fe42df1b36a7c5eb2db8fc45b605ed5b957beb37f241d5c6aa5402b8947bf45a39917ddba23db227c6515c0fbe172f4f688bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50a65a7f353786834906a362342c4f347
SHA12629c116f1d4703b033c1e0667d74ebeec802efa
SHA25682e0cb54ae060c8d9bd07daaeffbfba187901152aed5bf247d050bd34b1a843d
SHA512b25c7e4992607443939207721d3829002c8003281e3913804c75a0a302684f501c618b9f737a5076837058757b45cf287cd08f67b97cff5a19059c4f4f301fdd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD528280da580d8ac049a21ae79b5596e7b
SHA1270356ee00f34e190204163353c6792b8a2c9c6e
SHA256a637bf44924f5ccccdbf482c3deaa2e22500c86b85d3984ff16b11202f6b1b16
SHA512b52f45170debba8a979d2a4be9416c04ac338c76d84283c509b29c70692d8377fca7fa56cca801d1402cf1739105b971c9e0a3c18c5b4ba0b756dcc523fce973
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56aebdcd028bc6c282f2e697b8bb1278b
SHA18084f3ece7bb5dab46e0970833f92f1f17b75b38
SHA25645c501a80250a1f94819481b3cb06b84b30e6b8331b09a22108c8ccfca71051c
SHA512f8d0e27870b341d75fc3a3dc86b9f5b57588b30581a8c713b0af998548285263d1f6bab16435d8d52bd036f52182bad66c893dade3e2849a5372d48f7f37a4c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50277d31206ead3c0e155bb2838bd9f4f
SHA1662c64372a05d9e105ffd61cd4a4d2af790b157f
SHA256dd8e388b7be7a05133b3a215355c221fffaa4fe42216525f3e8e25c8cf495ceb
SHA5125a64c4e132e077171c260fb9fe319204acb2325393c3407632735d4a6e736943f5d55197a9a03271e6578eaf9d01ee80295afbcf4e6c98f50e27c9ef64e29dc1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5802ea6c049fb5a7aebeefa8de03d9c65
SHA14ed27e8296dd0347a2437913b47e3e198f095e93
SHA256fcd94731d179689cd476fb07851326843d0399ed0a8d94b35a4688497e826c04
SHA51230ec1ef2e13432987daa3dfdf65ed3549763d41f79d1c645786b56199be4c0c6c6719163f932ad746aab658e43dbfdbc204dd72ebf07dd5f343b994e27ce9a2f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e9015a755536d8ce8fa3ae86c45dac21
SHA135f6de7ea62cdc16e8c3bd965c9c72078e055fb3
SHA256a4587c30359135d92b7fc7984db6a82b758ad130e7d05eeec6eb705967e2f95f
SHA5128e2697622f604f6d19bb9d27bb9ed631e305d2c70d22f74f6489dcf60bfbd8d8be08b7554f98eb4f910fb6f27655efaac6951669fac106371843e90ac77abc99
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ace179762e7bb19d7819d381e271b9bf
SHA11e5ff0910acaa75de2d8d04df30d14bdd2473805
SHA256d2b5680e818494300d4c677a4f491a9faa0c536f1ca00fbfa0aeb22787dcd5a5
SHA512a54026b15713bce0b33d13689d3c98e6b63ff9a06bc73a382b057bd6efebe76c09132ba728cef50d740c132d60c9cef81f8ac01d8a09f490970822f30e5097e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50fb53e1569195f244707cb336a8d750c
SHA1cb1052be19c588f157e7469dea8be4db1b11791d
SHA25614c264cc99c2c56d893647c6fbd0ede612864e3873a2e8b8a3aedeab762bb866
SHA512b57bfa643d2d6d67fd7aa0c564dee1131193496e5f543ef5e55c98d3fcdced6604889cdcc7111a32eae564351af0b8301393f2d96afbff1ba50c84afdd4ef16c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50ff267b80fe74b7e118640966a9f8cdd
SHA1833801f2c1bbe398fa0027b5b12839bf70809373
SHA25679b2c4a31aa1c663599205f46a0973a76eddc493a3a8fcdede9bc2900e67cb5a
SHA51294c983fa4c786a5b550e964f2cb603f50474473234ea2ede28291a860413f5f5863c86509c7faba2e2acfb49a9770708d9c921939455daa263f7057374fa6eae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dcd64f2f7f0d8969f261017843fd926b
SHA1e442caaca0dc65a365d6b6ff0a8153fc6319b755
SHA25690791705f9a8330526c3def325b1f4913e9b3f0e84b08fef5ed5eb3b1b7822a8
SHA512c40d1e08d85fcaa1299608f1e0db4e0320e84db154637b86528b2bf323a8897edd4dea810ea9d4caee9f03dc1789cd11fedacdd79b2e39753aca75273d91fe91
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bf43c4f76b4b2321c0802c2ce1818ed0
SHA1acb280ac2176fcaf10778513bdbc4695a565043e
SHA256e7276de11d40bda6ec791845a54b41238e96937f5d86a22e8f583717c6a3b0b9
SHA512a7d74a794cfa2489efc45c6e42482a88d40226ae266cfb6ef065a735694207d4a3db8ce795a144b05153c7983c0f8be1d0f1bdde6f3dd42efc42617ec9bf5c03
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50b245f5c0a8d347ab476627a1a34de68
SHA16f85b1b291cd7ef97c7a31b2473948726a6bff01
SHA256ae57ba8b3ae4ed8b01595ec805aacf5a70f6e8353a92b596b3f8e1138c0d2037
SHA512b38ee7d617478267002d8be67ab117d7368ad4f6e08dc7a2fa37bde5ed88d8240d3e56a5fcd53a167d86cc928e15080ed0e49bb70bf2306e37ec157f58cee857
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b