Analysis
-
max time kernel
139s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
15/06/2024, 15:26
Static task
static1
Behavioral task
behavioral1
Sample
af15e78fb22396ca586d233bf1addea4_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
af15e78fb22396ca586d233bf1addea4_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
af15e78fb22396ca586d233bf1addea4_JaffaCakes118.html
-
Size
160KB
-
MD5
af15e78fb22396ca586d233bf1addea4
-
SHA1
b1ddb0c69fbbf82c96b8217ef80fbfc989545eb2
-
SHA256
5527458409194fafdd38f358084f344acf1bc9c5f09ecade23091b1e6f0ed9bd
-
SHA512
b89489dc212daf5cd7f624aad9e5829a2cfc32e0094afe25fc8e33eb17e9a8dc51757ce8ae6bc557c0adbd2327113bd42ede0dde4ec065df3f00f0a58dd66e53
-
SSDEEP
3072:SnVbKyfa44FvFyfkMY+BES09JXAnyrZalI+YQ:SnD42sMYod+X3oI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a80760000000002000000000010660000000100002000000095de4f575103720b942134b9c91cb6f32c32a3e981008a6a1302de14d431bced000000000e8000000002000020000000b00b671943e1d6b9e55596faac7b0c5fa6bc86d9513818684fab963208b102782000000001287ceab970c7bd9609e49975b68855ad965993ddfc8d4081f1284fd3ef70734000000019ed5e35c27d1ef883bc54b8dbcc3c73701ec59d3db4f8498746b8b0c53c5affd8d1a986da95e989e0fc1442a7cef72dda4a019d8cfdbf5cf73431507dbd6bc6 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0d340aa38bfda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000342e9811e5289935f35dd5616082a612647b573574579c95f9ea368644bff7c1000000000e8000000002000020000000dc1c0098714f56a4b24cd39dd0efdf70723cda70e37f9bb3aa5a6932384f2c39900000006603b64318550270ef3886a9e8a97f13dfec8531520db4a98d4db5cbac530353d387b3110f9b0fa785836dce328a8b3e5ddb8a74644be8d0a604c293dc95af8d42594d62bdb70a1ea4a9bd2649a805b870019172add3bc2bf6945a4f5f78dad3f3ed53a1d6948f54a58a41196c9dc52a281d39da482b4c43c5425a9cfe9cf99846f32dc45e42cdfdc3169f590d4530af4000000057cb720dfb96ba7d5b2f978ef8a8e9d323814b7fd2c68f2a5f5767df087efd9223873c88c7ce8c525be6b8b14134fa4bc1a34ea318aef6ae2ab4a0545d838018 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424627036" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{95608EC1-2B2B-11EF-A1F0-7EE57A38E3C7} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3000 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3000 iexplore.exe 3000 iexplore.exe 2908 IEXPLORE.EXE 2908 IEXPLORE.EXE 2908 IEXPLORE.EXE 2908 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3000 wrote to memory of 2908 3000 iexplore.exe 28 PID 3000 wrote to memory of 2908 3000 iexplore.exe 28 PID 3000 wrote to memory of 2908 3000 iexplore.exe 28 PID 3000 wrote to memory of 2908 3000 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\af15e78fb22396ca586d233bf1addea4_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3000 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2908
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5da1b6d704019abbe9ff35b4e3b588eb0
SHA140e642e8cc9bb8ec745dcfd634b94785ab49b38e
SHA2569207a64c5f5c66039321bafda62ef09b938fa1137039831327a64bc65a735778
SHA512d69d77a9132021fcb32295a35bac87e5fc0a646975716f06de2a39e98cd0c442d40284e0002acb8c206a80a368b2f09c357cf739afadac1605cc25e1e4f29654
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50cc839d6c256d9f5c5070606319c1023
SHA127741f15b1162c15d5214b1e931a7445ad73186a
SHA256b2bebc16392c6770ba71c2556fe6aad7e1e5a9982cc3901c28075cea8aac5b98
SHA512de8cf1806b1878c68442e85122a3d7d4078ec029b07d49166036f3917ce10ae846d8c2c14e78777e0b79f73bad589a15b9e96a7c678e5745d4379950067b5b64
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b4a25968a20a8d19d8f40dbdb58534b8
SHA1d0a522226e1c24bce0c9d5bea84d4e7ac9fe3f77
SHA256b41d46482b7001820d004412336a2980c0db5456a045b2376c444b51cd9cd2eb
SHA5128503d8bd5dc16d88aa989507a68cd8bba1a4e43d6649e2c1263ba5d598ba73f6bc1701504ebb09e4a4442ed185a441221a68e9993c0f010099684425ad46fce5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD545063f59943d8c053b6e3458b6a5a150
SHA1a98b2f0401e7ada924628e1800516ffce531238d
SHA256e79458e576587e378783eafad37db805aa211b6ad7012303be96ed1965d8aa1d
SHA5128dcf8e86f1ca42b13755b06446a8ec8a9bbf6214bd77e4c51b3993a51563c264ed9d469e3b4e4c7dc4a0e544a0ee3d458866df363736bca2ae32793948815a69
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56cfc1ec53aadeb7070a2666b7f1f8440
SHA16431cb8bb4ffbf11bbc85b129328c943dfe2f0a3
SHA2562d6bcdc48dfdbbd63c19106ebd8809e09efde16c3ce4d61bdcdddeaf0e07ee05
SHA512b2503bb15adecfd6107bc372409d76fb814a1113563c5dbba607aa00a1775d96a7c27368943236e176e9aeb956a86814e631cf3074ff3566c73cf543da51575b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51424399f0dfe18e524fe6f8a5aa72977
SHA15f8e0c467a7811d49a7ab1f41441567a7562a855
SHA2568890a367926d834af13fa5384ed703f14c5194d219aed7f5c2c769a115661458
SHA512ad2d6d04d69c545758fdb64e1ab79701deab68c2ad78c06e75ee98ed6477cca07bf5b95ab3ee3474621c5e6f478a105781e496b3b9aa497b166b76db57860c10
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD509843b9d87a15050273e64a50a7852d7
SHA115fcb5a84d187a2249c7ad4de37a71cde33d0ac9
SHA25627cc6bba40c912e250a4fa3ce9047f78612b12280fc4c5159cb1d784b5c98761
SHA512554082919f448ba5453df1d3c16db4215d74daf372822df5f6951d0d77fe3a25df7e91a26739e9de547a0815be9579ef671f898e70dc325f177ea115b78095f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD524c45d50049e2ff94cb1e3c1557482ee
SHA1ef02309a55e7c7542442d8db685cc12830b689be
SHA256569faecfd8f100b1334961ea9a18be2dd7bf8d60d4d85c9b7dfdb4a7ccf473eb
SHA512daffc7794271bb7e596c7e168312a7ed436f8f67405d78126b92a19ff8575a5dba30306a814f0951dbbb991b2daf9866612ac42e79a44789adf6a0fa60f47707
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ebf3851633ad5137278fca0125da2e7b
SHA1f34bb9ee919c3f199ec22058ea3c9c332814ecd1
SHA25676afde166d57b9ef021dc80170056ea5bcb86d38614191d70b7d45faf6a210b5
SHA512eaa116f9b50ec3b329f22a5e8d9e72ac3c8b4dda9bb18032997f32e380e41373421bd55341851beed3874024c1c974ef77b4b05d03717a28fdc77b391424daf9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5753c0b8fd69d71690cdc66fa35e7ea45
SHA19f4efd98ff4bb0316ec212fc26760bd747ebe06f
SHA256e544f2a0579ec661b2f074d7ea23c274d7a77bc7308592907677515c62c201e1
SHA512788bf306686a0e5b15a55333aa42d0bd431d7bed59fef4dc461e957cd03aedeb2046d88a72e4fcaddc122d865b55b198dd012662f383a4e69eee61213b8e80a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57969fb29d41d053f79e7e39b6e3d49f5
SHA1b5ceefe535d535d189441a3ca27e05983b8196b7
SHA256e96e61a4a643543e5d8bcd0b30c54dedd949f39f16c0c617e887d6e5771f09b4
SHA512f673e8c4e8fd6c86c6e2d02d9ab00d660837d62a24a84d32523d3f23ce8abd47ff8651fde0c6f42dc715f58bb6a3ea7d53c5bdaa2ac48c15e095ce4a2304642e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57db75e8447e7e3a73015ad3e82c03ab0
SHA1bba92201181a3b8a210987746b8a1eb471deae15
SHA256e35f63f812482611fd7cb0403e895f8de41260ddeca36e0de29fdeb30a6db985
SHA512388baf2b7410e9a31c7e1ad9caf486d0c037f95fbb1c9f13a514daef39bf69b4e09546e8d4d020f6e6e388beea8bd67fc82914208e22d4daaf69b3beff23fbf8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD510c271c67d19136d1bb70e99318e0a55
SHA1a345d04219cc5a8fa5b5aa9a524419a069cb90fb
SHA256662a8552644bf245c4a82d1fcc842c029d5f7198edeccd3a26281f5113433fa1
SHA51272463ee19dc4deb75e6a843ec22edf6be4773e8aeeb24acd320cd0068bc52cdbb2ee0a1053c94840be82501bd636fe959cf9b2c126ebe1d71d8833007be15bfe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD581ec4e6b8588b21f99820a8d448c31cd
SHA165860180a41b5ab3c760ed91cff186d7b90d20a3
SHA256f8c5faa928b04268ca02e013928f949de77b1f09c6f4ed81fb329f219c88a008
SHA5124135331e08345ebae3405ef9d4198090f28c5aa782961b3ea1e22c32db265d8b22aa769e6e5deb4d0ef49ce43eb7e005c971ada98b2f8918ec8dcae77ecfe257
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c284eee9e44d9e82d391f60e11eaf881
SHA1d9cb3ca8196a6e3ee4d02a48a50685580e4cd99a
SHA256ec5de07c36ff82363369193e129f9b0f95a02d0694eb2eaf33459acacf166c65
SHA512bb972939dd588d4d6ec772becd15e8cf5b9d593829b0caeecd4cbf2ff28db8f7792d6c09851ed521279f935877500e243eb1d4c177a08ce55cfc9753cac6cae3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d1bad64096dda917e77615eb8e2afa9e
SHA1ee79e480ae39fbf6ed8e5fbe2b5bb6af354e2f56
SHA25684cb12f32ff7f5f939e63236495d94f2eedba270f1368d821229a767fcae5e72
SHA512eb2ca530b9aac160cbff8e00a632c5c9a0df330808b54831e1b52a1a17ac27ee828f3f158f5b8d0baa6501899d90fd85d4d0ad583e65d7abdbfe8e02698a075a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ca6b0db86fc8ee6acee787b4e65d8ee0
SHA17b974448a46f57583c58874ca7cd804afc0296e3
SHA25657ac9b107609bf7eeaee01ed2f1a2231cceaff27aec3c387e487f0ed4c380d9e
SHA5128d80ab3db75bc88ef7e8ccc29482afca2ed62976c753d75a896b72413f5e13ba8ce8a13ccae03c8042ae48b685bb40ebf3deb53e30869aab392d4f11641e72e8
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b