Analysis
-
max time kernel
134s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
15/06/2024, 09:39
Static task
static1
Behavioral task
behavioral1
Sample
adce1da4c22f126e50f5c27d7927626d_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
adce1da4c22f126e50f5c27d7927626d_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
adce1da4c22f126e50f5c27d7927626d_JaffaCakes118.html
-
Size
213KB
-
MD5
adce1da4c22f126e50f5c27d7927626d
-
SHA1
00ca7ed9f2e70a794db78d53b29d3562e0134770
-
SHA256
098504a889a6908cabc756e32182e6c538497a7eaad4d004fb72fdaf67e96e1b
-
SHA512
4373d291b395bff5b8f281b02b03c63453c6abc95a91adcb20091444c7cdc0515ba54d4f721f1650357a9e219d1a8397d01a807cefa28d5929b3c7ab05cad9ad
-
SSDEEP
3072:Sz2SNZbfPGMeoyfkMY+BES09JXAnyrZalI+YQ:Sz2cHYlsMYod+X3oI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424606221" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1FF67491-2AFB-11EF-B54F-5EB6CE0B107A} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3056 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3056 iexplore.exe 3056 iexplore.exe 2532 IEXPLORE.EXE 2532 IEXPLORE.EXE 2532 IEXPLORE.EXE 2532 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3056 wrote to memory of 2532 3056 iexplore.exe 28 PID 3056 wrote to memory of 2532 3056 iexplore.exe 28 PID 3056 wrote to memory of 2532 3056 iexplore.exe 28 PID 3056 wrote to memory of 2532 3056 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\adce1da4c22f126e50f5c27d7927626d_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3056 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2532
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5090a9423fa2d55b15afe03b8d9e64fe3
SHA134a65d7b25ee9fde819b618584b4b06d73376383
SHA25688ccc397bdcbac452d524e98b93df275255659a8fe8b646b7d5e728c8617f179
SHA512b7d97a170d58ae856320179a730fcf516abdd195567bb45b3a15ef9070cb11354546c8ae9139ac0b8b8659d317e9b7401ffed6129eb2e3b0953d340f16edade8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c637f175f3e1c19f60cbb8f07f1e6d68
SHA1cdf2d1ace11ed19c2e5b86bcf7cd6760de7b9aa8
SHA2566ba4ac0e7e9aa1c63bf548cc834d07112aa716b19cad54c2ef34367ba4064219
SHA51270834c43549ff9ab938a46abb300980e91ffe6ab1997993a37827020681da68f9576852d55801e69a775ba1e03a71460ab9da349c9ca902b4909261fa0cea6e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5adf8c4264bf9e0c1d66d18a2608f8634
SHA1720b79d0be092bf7c0a7c1ab5a79943ae6dd04c0
SHA256757f5e2c4373e6c20c4ec4b23fdceab8a210dbe6a2436e652b3fee61721477f9
SHA5120e7b87019c0c4e94f1648eac4c090b99521319890716958cbae2dad6632905802c367ffc800c5165420ad202538a2870fa9b3f8b60830c7bd2a58f85ad58cba6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5506e076101caf68993ec9a232df2b24f
SHA1a82924208228c7f784e92e5374addf4ccabe5160
SHA25644e06c036f66de759cecdcb7ea2570ec59756f3dcf22c2e15d08202216527312
SHA512861823c12b7c061b87b6395cbda5b7b4afbd722826adb3b8ce6189fcbd858f0f82bc3ffbf7130cf918c55ef4adefca85cf62d058804b0534eb60cbb6d8bce2e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f6fccb6c9ea55ad2b1b5a7f9f037f7c6
SHA13a17284c2c8eed631df6c16a0efe6307b6d81577
SHA256d7e665e59b40ea85d1c8c2e6e9d937db7734a25d9c951c9a7fe4ef5c5add65a2
SHA5125298a12a579bff3d2ed053c90fc627a13dd4e0d73ae0ecd47d79ce5beb10b3c48276b2640f4f788e37f48d390045410522571dd0ddcca611cfcf8767cf056531
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b3d975474aac7cccf947e94715a88f15
SHA16d5eb588c2dfc51a1c18e86ceb0e310e29c7d757
SHA256848186f77f2165d163854d49d787510e15c2d823f1b5ca907f289882d6e4497a
SHA512ee3e1c78f5b32a81fd69b953bb2f7db5dc34d59ab99411dd8ba4290fbbaec9fe1560f4a92fe2fdb87c89df23836e99c5947f0bcff2db954ba3897ac08cb9f1da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f5ad779f31eecfabfee5e01206d9b16d
SHA1ed566df5dff209fd0071074cf276d12cda2940ec
SHA2567fd0b484bf299db362944ba0e66b95ebe0a09eeb59ed88062dbd8a8ddd43cd13
SHA51208d7c22c0390d7ebc6fdd5e0dc2255a7ee958663895c0d49ab912a3e295be88ed4509d4b8cd657407b0b937880532a0cd44acda0d1db3092511c43fe0feec353
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e0d2bc47dcc8496b0eca867b657875ec
SHA1ff5b861ac42b6485b46ae9f5d7bc3fa5a60d4db7
SHA25664a1a152d06ee247657134d9e9b599728f5d481c5135afe6fbeb3c5a7984e70f
SHA512aa2686b2f58d3a35c53b26807470cb64a1fbe8aab4650bffcf6f10515b9d5f4a7d1e1cd13730ddd20bd1bda180dfcd2339683e44cb04d0d5691b39a66ba6764c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5de4b79554d6a4113308e4d23adf96480
SHA1858d7d637cdd77c33f8446819cb81c57aadd8f12
SHA256fbf63872ea910c1bfb5cd4a13f3bfc18c80d84d6b2f44dd1e44ff69edf9627de
SHA512cde55e9ca67dfcb188a9106aa6d69736df20258377f4357e668a9592ac96fc56e60c6d00ead4c27589d869ecace8ee8b8953f7f7ed76d28b2b76e245c66098c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD593c2f71a9d5e78e5c3c3b5112fdb7ab1
SHA1f826730c25b9e1b30ffd4728b09dae8f4b830c01
SHA25646386a0d32fe06975e994e7826e8020c0d0f0e63671f825ae0b4f0c146fecb08
SHA51225a15b2b4c9a89d0326e64a49096be5d935259e3aa4af7144b6f80b97ddcacc4e1d85896818e460465f22fa268fddef7288f5b10d40a409a8f88ab111319717d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e43ff1a6b2060a5da59db8c1c48eca78
SHA12732398f1620d9c86f89a5b4cba530a4cbe8a531
SHA256e07c15de3832b7ee36df59792c6105e9b123e257121491f2d41c0be248ca4c3d
SHA51262bbbe427497db2c7bad21377cc03008248a9d308257cbb792764557553be8103bc2aff5b21768e0668efd40ea9726ad8c8ec71adfa74ebac2ce0e6e9ed313ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d29887acf38f62936217b75288228d8f
SHA1f700683c4968c96281349120507c7f3659e8a797
SHA2566d6a1b960921b14a14b469279846ac5ef08ee10b1c292671a2a04d5bb45f6d3d
SHA51202a51a502d2e9062654f3b8b46fec0353b34cebf22ffe7058515009768bbab2bb728266de5e7be9993be7fb290c4c3c1b649f0ca9ad85a2cfd98bd7dbb52ad29
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aae8b8df2b2b68e43624fb7d4279ba71
SHA1d948b3e3f206444ccbd45d3201d71ea535530b21
SHA2567a42b68ba971ec1313554738f7b71b9a0480970043a654e3e302998b1547d059
SHA5126b8971913600da56f8cdc533f284b12af7de2ee1d92ee84669c1aadbebbcb50e558237ad0dd0d54110ab3ec8df5bd329725baee9f397056ff4e044f96887c5ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bef93df2504e81773432721f67baddd9
SHA178a27ce9b6d2e5a2fae61a9e8838a21edfe1cc61
SHA25682b08222b2e4665af8294b4f36c998d26a6952d8883401342424646692854501
SHA512c915afe63e8ecb50215c8de61665918159a15e67d3e45cbb844707e94b664cdba1bfecd4d4643f497c0e46a1ef31c9882dabf21af5ee3c4a225555339b716fb9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD570407a640343331c4e136fd410d0d4b1
SHA1749543aab6bf3178e7f550d13f3d2ce613acc8a0
SHA256a2d5c434d7bc93d6162ba881aa2c1a9a71ea371e70ba8274d582b59db2c20d74
SHA51242bce4be4738b9b48617ca5864db1c4b1cbc5432cc42d869fa148cb55b869b7a7e7273b3cbbc8b3ad0349d7bacd2f83292e3c441581151e672abb674d6c8a098
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c34b5c6d8c5cc06319d21c58c8d0d618
SHA1d86691f3c0cfcb133b86b435db543f3bb89e9a36
SHA256b294db955fde58956d22551f99156ea38cd24f361f8243b031a85a2172bc42cc
SHA512ed76a994d55d03d925956316ec3cabed9bdb5d04d8b40815fe22bb5681533afe6d30221724509edc8b975b089e3161b39a8cd31117e3a5be7e175a4d5d88a643
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b1df2c400bcfc4eeb63f0f5acd215383
SHA191c44e9e4a780a2f5525f11cf89a859749a4babb
SHA256dcfe5a67cea9cfca50483cb459e26058a0918c16221cf6c66be0db15c7f02065
SHA512f5bef927aa81aeb1f4b1cd9fb3311e37cd23897481e4c5e767bf0668a6a0cd2c1736797d4f84593e32149b553cc9d9fd41930f7699a825fc4f242dda67d27444
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d63a5804b5fdf1d7972f0dc7d75141a5
SHA102d0b96b9a295d95e1e6ab3e54061e2c1c754934
SHA2564470fb320e93ea3faf152e24f98f821b5f464a73aa037f91fac6a49a9f995506
SHA5123caf05ff6dfa9e6702ec9e7fbb92594a142332083e49a3bd15e7fc95658eaf9c53fcfe5c2c46a1cc65e8d2390db4eb097d738221eb39e71581312cd9aae577ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e3899e0258a030a388ff215a4f28299b
SHA13f9bb52444993c8baf5a9a148ac749fe6ea3fb27
SHA256b3972b374b969682c74ffef61b69ea0d2982358bd85012e3f9a2add6b4dc11b5
SHA5123740d9989f6b10a1af88b89a86a065b67a9d9ed2e95c340c3acb0521f60ed173622729edb447be752d7395b9c995b9c4d6da4e60801bf38ddc19a7cc0e21e655
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a62ae2736ebbfce0ef59872bff96139c
SHA1049705577bf2cfd02a9cc0972b5951d4fdf86953
SHA2564883183de740d9afe7cbad2b58d20fae5210a9d7b30d0b4b097ec86e64d2f3eb
SHA51281964cf67bbcff136a70499884852685549c9bebd286b9bacd479a3c545b032735115e9d4b152ae0164b9c68f3db6f067dd32e13d4cdab9fec7cf2110e0b7a3e
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b