Analysis
-
max time kernel
121s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
15-06-2024 10:23
Static task
static1
Behavioral task
behavioral1
Sample
adfa12824afbcace2df8a7302789cde3_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
adfa12824afbcace2df8a7302789cde3_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
adfa12824afbcace2df8a7302789cde3_JaffaCakes118.html
-
Size
461KB
-
MD5
adfa12824afbcace2df8a7302789cde3
-
SHA1
2acb02ea19914f0aeeccb82666bae43abfc109c1
-
SHA256
3da0c8a7c99fc917c335079e679ae7096a7aa79bd0111c71316e601a45e03f57
-
SHA512
4f1bf18433815cb2879705fe2058707892e534a9ea983dd8e39ac0ed5dedc62de08547c05559313a6f11827226ab946d4086fe307c191c6ed70804a602d3f1cc
-
SSDEEP
6144:ShsMYod+X3oI+YYQ8sMYod+X3oI+Y2HsMYod+X3oI+YLsMYod+X3oI+YQ:W5d+X305d+X3i5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1059802b0ebfda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424608885" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{527723A1-2B01-11EF-B918-627D7EE66EFE} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a80760000000002000000000010660000000100002000000038bb097b0f616c49815a061cd359905efd991d3f23debce5556fbb2504527e12000000000e8000000002000020000000ba5c267ea0d14b813a8f7ce9dd3ead89738e7495ba0412be95dbff152f79907590000000a0772035caa3792ca003ea5167a43928c8165b4345c3df38736ec8567996e173e72144b223fecea4264bf3c9993db1a840415b197fed81257c673a5226c711b0e3a2a38778d8664ce45ac20fd4107dc3a3097e645b68260a48880704563cd3aacdbd076d856a07a4f7669ce707273e374cfe41703a1a77d119daaab3fdbb12c09b44cab8d2bf87603159940ec7d8153a40000000e855aa73476f4cfeee851bbeff7c1a447e742747cbf992c5e38e2547eea6b46ef2f0fdfce3ba73f9f8719ac1e7f5ee9c479d0154312023b25c0c8ea49c0178ef iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000000c3e4e3b7f8fc07c1a67859c32319bf023355b878dea35fbcb3b3651f3324567000000000e8000000002000020000000998f3de19a88e0e6118abeac206abf7514c19ac7d4ea4c2819ddc83511df004d20000000f4c1ebf68d9cb18541eb53634a26982b3fc29ed708d886855044771344ee19e240000000d170a5ea92c382c4983d2beda7bb2c84c7b17f957afdb4da4b5018c64d0d7451b5fd3966f3f32c57e49f7d5e852dca707f159a3cb030de448a47ff0c5dc6f5c3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1984 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1984 iexplore.exe 1984 iexplore.exe 2688 IEXPLORE.EXE 2688 IEXPLORE.EXE 2688 IEXPLORE.EXE 2688 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1984 wrote to memory of 2688 1984 iexplore.exe 28 PID 1984 wrote to memory of 2688 1984 iexplore.exe 28 PID 1984 wrote to memory of 2688 1984 iexplore.exe 28 PID 1984 wrote to memory of 2688 1984 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\adfa12824afbcace2df8a7302789cde3_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1984 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2688
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54c53d98ed8c599d3943a4b9572a816e7
SHA1922ce59cf6e08c9b3c4b9ccc4d71e207014ba56a
SHA256c39d7cdc8c27959854705f64577076a1f1693ee85c16dcf3fa25c6e5a1e033a1
SHA512092dbadf90928e3d9773bd56f55a42f72ac28fa80b8f8f67ca2d0ea6fc9f6d02f99fc3221826485754d13ae2a3b5170dd8fc13839f5751ca01bd10c5227f6981
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5328d1a93392e8bb7abf407b379fec7e4
SHA14d61917615689be4d4c7ba81fdd11564483cf2ff
SHA25691a58e358f830045b1982e393f24687f4ce284f89ac2666effb5f2df876fe055
SHA5127630c52f3f7e2a8251f109ec5657038aaedcf293e4840ff1bfd67231aba507314140d477666a648a319a6a777c952dccabb5e545bed0a8faf055ca9ff68fe4ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54a5903a43e57b99daffd2e23e376875f
SHA1106d61ccfa1414ecaa107b0806bf8f14b8ce730c
SHA256c83163de0243084771e7212d17028ea9569974ee0227d54013680caaae61f9a4
SHA5128fa13ba7cdeb6a831aa7d7055b08e6316c1da35c09a50efc578624d624480f23404fe2ae8c590a6016476abce25386cf611548e058f5ad09ef3211d7f22274f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a16438daa80365eb713768953591a70d
SHA1fe759f95cd4727f3e2bc7963b650a0ae0b776154
SHA256e5dc31cb5efe25f8ef8a5d7dac7f33035935034ad6c4e4f16a6d05e6e5e61831
SHA5120d463bb6ea158d6fb0a2e48e916a6bf2e4ba3387ce64661880588776366f8f6e42eea96d0073b44014a708b3d1aede8de6b31fe76c3855eaa1cf862a23495448
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55a0cfa25facbde230baa2eca1c1d7a0e
SHA1acb551b3e0c727d73b91594e4f24cfbfbeb939ff
SHA256f19984ec28be36817a951c73b531559bedf063c61fb9b07859c263bc5a2737ca
SHA51205d214fd55f7f6ba69004d96f1f0a8c99a3be21d03c9fb69aa731b862b448110fcbd5a15327c3df80b5c452e36d7e861065bdc76dce29928963d2855e0b3f442
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD515c837020beb467c087a6bda77599f15
SHA1bc2cb8556e7299591c257c7fa7d264123b429e10
SHA256f00e2f0a1e6d7f8a433868398724d8fdab2a2fc9fcb5aa342c01094389ba058b
SHA512d323268cf5d0dee596455f8017fcf7a48c9818f901acc111e2f37af06c2997cdb0e12b1dfde2486ef5dd372cd4a41b9d9f03e575dc4cb1f31034d4762d1e6a31
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d2aa2aace26de42a8b72b01737084944
SHA1c3bea590eb9cd7e536f905691d040dfeed300ac8
SHA256936a4baebfc2deca8ebae1613bc7ab87c88e587aa05d9727ff8103ed65ee8793
SHA512cfc0ed050e8fb481d4c24963d8734de0f26bc2914f9ea8a86e3bee92bdf1ba5c0a3f7db71d1be3831b64bd5f8725e596e97177ff324f16211a9e746a3a925694
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e97ef58b8f4c57436cc5c8fde96317b4
SHA19cf717b2ffb62c01ddad5d77918ccc503aeb171c
SHA25696f8b3e761a76d16166cc9e062ebe0586659307f062bb2175820ada259792e35
SHA512ec701d6956952e348e4cb5e48605667f5297655f05f9bb64113d203615bc427bfa85be4a9b33af3b6d543a678328af022106fd3c5df0d664f0bf05f71e8bc6dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD587154edf05b4b611a1aeac6ef78cd8c3
SHA1e8050cad7f0c08088c9baa2a880866b5e60a5080
SHA256d249d864503fe416ae01ab5fa2d9cd47e3da52d18125ee17a969f444e2079801
SHA5124a83e63639091e47576b790a3e9846d6fc43f0bb10ae9b50820d4bc8200ff07d6f644e24610e3d68870c0cf615bb279424c5a14670af72ec61685e72da3a63ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a5366bed52a446a8086a390eea38ff8c
SHA11b046cf78c4f61932adcfbd2ba47fd3801716aa4
SHA256c11a89a482fd2a8eacd579a5ddbeb0605d7184fac88916a9eb610921d1a771b7
SHA51247c918bde4ebaad3cc6bfc0560fc6adb50b335be6745a393cd9b1bce6ea92ed1270e5c7e9ccc2c58b471ac2302378a4e374b9fe60385fe7277b0d3f6802a5357
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b2ceae7e7109981e31eddc14b7992981
SHA194ac5d7adb4ea68d6a326f2b26b2910986d1eb15
SHA256d8c1dfaa5e6d2486817d80b7f4f4f6f8943ac86ae60bd81e6af8753c04d32755
SHA512ebe55c679a96499d0a8e23be1851052c44250fbba9e5df7d8a1c4c4fb30607dc288dcf365434d2c432ce87341016ae30aa3708ac890fee12490fabf08099deb4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD515d4bdf2d726a9f7f214a2b7b9d4df37
SHA17b939bfd937c8d7e59aa24b48f43d43b9782ea21
SHA2564ef5f7514a2dbeb7e1b2adf29dcba55c9e12046fe017946d045a2ea3f5a965ee
SHA512a54bd4e458c7a249e43722949dd9bea290a4374921dc8985a89e8e35d33597488e67cd28d221aab89a34267f9228fb980835493b9b4edbfcecf369bea6a3b76e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50a4991c7856a3b7b1cd108a5ce560715
SHA1e0b5e721dabb0a57f32a2ed2e5769c1ff324f71f
SHA256a1d6de2a16e664d67b03366e0da3a0db15aee6ce24f74e7c1bd6b00ebbac2c92
SHA512ad069bdb1da07213fd019eeba12c8a02a1013eab8dda3ac33acc0d8efdb63db8250a338fb8f55bcee637dca2f63271d5a02b93fdb1165938f0a8cd1632e49380
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eeb36ce7a6f18e5339ad0c4b50ee8061
SHA1b2f38158e61eae3aa7bfe89acbc093b5edbf36a2
SHA2567b7282ecd9d3037f7ba817b7b46b0ae7b21fcd9394b8b517a4f651e87876b184
SHA5122cb17d90ef920f369f0fd7dd82334d7478bf6345ceabf859ccb7a39057278aebf673c1143f77ce1fadfd1158441d348f080d506be3cca24f7b2ff433e4ce5b35
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54ef9a613fbd88bdfe8317c149d5fb1de
SHA1c5e324102150c797c735b26827358feebf94b405
SHA256bdc4090930fc18ac4810734f81b2ff5c661e526f0ed64454c0796234b45f8647
SHA51296c15088eccf47429c4e23d5126f372782cab21a15f34b2328f9b6985d8772b6c1f41977e20043b1ce58ae03ba014b9bf9374d756a6bcac10a89ef38230839da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ef8a5f32a77a8acc6731bc075579d93a
SHA18e5c7f6ebc26ad4eb252bb30783f05c4a2be6d46
SHA256db5650704a2337ff0b1d6df113d562e0e9da279ef94c383198b49506e3733356
SHA512e1664aa40cdf81746b507910c39916ab1d9cc0b3bd8933566818898b39296265ccc8f222012a5f95e04de3034937aed42532e478c010fa41d9dd97f024003fac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5872628fe56b6d2e640a3317e6b8355e9
SHA1057db6ff9d56b7d8bc09d77d03a11275eb3b75fa
SHA256fae182fce26f80363edb100a96f804fdb13aaa6afcfa0f55babae400a13f4da1
SHA512c5ee672c1825d0443e5a3a43e4d852f9aa3b41300816e6627756d874ac6e96c660aa913358844c49b5475f28d125086ec291a7f75a998f27cbdbe01739cff498
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d493b238bc5300c0c25363e6e9c84b5e
SHA11b55fcf34e519259b60cbfc6be522c55ae175944
SHA2569bd5c16fc1b331aa59cbc490c0adc06af51ea626edbbf2c37092b5466363b4ac
SHA5127b93eea119d5a2171373a7e6ddd4967758b3b2ed3a58a3e29e4a83f172f06c0d5c18d52f0488c1439ac3f10531bc4501582ccb8a420ac3ae14c151bf04724b67
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ca33dc7cdd12f87ad473d80c566cc977
SHA171fca9e95f2509936c6e11fe85b58bc1d12fee4b
SHA256f2a7d87c95c26bd2c85ced0f0f57d1327e888a576bd99053d7bb6d3f0efa00ad
SHA512cbf94682006054a4fe60d7d76a084176bb21a00261b0db26f2286fc7a88e3c7ba4963a5cecb65a248c81c81d1c1611a108aa285d88aa6caf501c28ccccdbc069
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b