Analysis
-
max time kernel
135s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
15/06/2024, 17:50
Static task
static1
Behavioral task
behavioral1
Sample
afa447f668f1a836c17edf434f497280_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
afa447f668f1a836c17edf434f497280_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
afa447f668f1a836c17edf434f497280_JaffaCakes118.html
-
Size
138KB
-
MD5
afa447f668f1a836c17edf434f497280
-
SHA1
a94b4c452d04b5c86893071720415fc440f26c32
-
SHA256
abd7bbb56926613f3cab141ec0c98d617e52e640b9b4732d3f8b459daeea7626
-
SHA512
30b0272481c0fae6820abec8a430b9e5c0df151db2756696385e338430a78fc3be9609d4155602399973bfce1b4ab912ebc573d8131d6834778ca5b62812f4e1
-
SSDEEP
1536:Sog+eBS6T0gyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBw:Sogr5yfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000005081e746fe424d5c8792d9a877f3ee08e72c918d5b8329ce7a5dc88ec95e4725000000000e8000000002000020000000f4b06ee0182aee600031bd1c4887f0eb89e0b760307c4660e17b6d03e0df3ec190000000c39b8f4bbec104ece9c15ec9c0b7c36eaf73e2f6c58c79ea9d3358d33e3eae2cff85dd7f987ab7695cf0acbb103f71f9bd37358099647e3597aa921ea36ebd865238ff910a10b3dd54321a1534e5a23f201755981c6b6fe9280a961641462fa3da96d79afdcb058122449a8c0b1e011e959c475dc77e2a4de5ebf37054a42e6d84a717c20ad6f1f30c9cbb7d4a88980940000000dc1b69f1b1662bbb8ba48403b9ce233dc96ae8adea4ea9e44a4e530973dc87b2f556419756b56675bf20b1ba2c05d894f61aeec12d5fec65edbc813324b49e6c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424635729" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D3942491-2B3F-11EF-B47E-DA79F2D4D836} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a80760000000002000000000010660000000100002000000050bafc73287c426f1fbf021b0ae703b65188a0702dc325d24d0331e61cf24b60000000000e80000000020000200000006d466282b9ec7fe8a1744d77432f7175f4a9e60234a3f22c0f1c948e59c1864b20000000c63e63dc22dcea8a1de7890fbd8e27652324b4cf9f82b96ff8ccead5ace270ac40000000058a6d93f032dbc8662795f6d6795df02b8aa48d4ea4402576fa0496630092b262de057bf4b426c3c7cd17ad9258e7fc32d0b7910753828bc6c4e7ab00b3087f iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90f0fcc14cbfda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2236 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2236 iexplore.exe 2236 iexplore.exe 2952 IEXPLORE.EXE 2952 IEXPLORE.EXE 2952 IEXPLORE.EXE 2952 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2236 wrote to memory of 2952 2236 iexplore.exe 28 PID 2236 wrote to memory of 2952 2236 iexplore.exe 28 PID 2236 wrote to memory of 2952 2236 iexplore.exe 28 PID 2236 wrote to memory of 2952 2236 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\afa447f668f1a836c17edf434f497280_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2236 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2952
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD553e30e4d43247dad39702ef6273f941d
SHA14d282d677080fd474aaa6c4c1936a73a1168bc78
SHA256ea55c866551e7a5f201c11f2952ec5d97ef0a1a618718c2ccdc484bc0fba3ac6
SHA5127b659f9787c509c71178da7896b5b4709ba8fee4b34f72dcd29be385ef0dcd9963bf9d185e9d9112394369a8bdae39cb728c197282c969048e83f790d2d0c3ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD564e279a16b826ac6bf7d726b4f9ba2c4
SHA127abbd607c8e85a9bc7e6cfa3da73feb39313c22
SHA25649390a8e077ccce9ed6bef14824fc6ab24f62e06a272ad397f00becd8b0e98a9
SHA512a444eafcea3c777400815cc6a6f26aa1457f1265a5421563905ecdeeaa428ffe5b39297eede20a1b12eec16e7b1b6cb9521fcd4abba223c83bbc949d331c4123
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5637a8feaf111283128dc14ab57fa425f
SHA1e67927f6473cbd868a093fbbce2fff19eceacd1d
SHA2562066a89c303a48da8c0d97b9d75d19e493a4753063440a20fa91ae9071a46067
SHA5125362c0ffdfa13ef56c22490bb676b0e95207cde736205cc5a270f4458edf2c0c126c8b0758ab7e714348f22bf01c889068bc86331c47d5322915a33619dfbb8e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50ab72ca5cc93a5ce45be68142a6d6d1e
SHA1cb14fc5e75e846afe41358bdcae1a035dc7be726
SHA2568f7bd41ee56a21a51257f69a274931899fc85f08b57f4530f8e941d7393ccfb1
SHA5126f8caf837fb9640f4f20292c356ae5e581d705c250af3f2dd83718e548636c886a4dbc3c0021cac87a3d4925d31f6ac054f17088b93774409e95ba499b07bdc6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5afa3c5d1cdd0f97d186a83f973bb3da9
SHA13f1fa92bc7698ffba2f6709a3c19144a0c79fe9b
SHA25656160b8f5492c0983e460fc88b872d90ca765fa036b747d26dbab8585d3e8502
SHA512e0eaf7d27a99337beea45c73ad198614c2519d64289cb5ffab8b1259d9392c52104b05369dc244668d63d08d85529c4ee4099827c08a12059a9d573fbf93f307
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52652b77bbb84371b5cfb33b58a621e1c
SHA15c6b339ec8d904a3ab8441b044d0c1f47a4df3d2
SHA25621dd44ed3d596ab9d477765dd8f82b24a29e99ccc6683d49dbe74fef716a7589
SHA512cfc49b44c726fd35d75dfc8507a1c058edfd7d06f64a5ccd02c23e57f80c64cbaaef5565f3255c4b2e547c801d0724bd2108bdd4bce6e9b4a6184347fa14b8e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d8d489e645fcb7e8de09c11a7162a5f5
SHA1c6aa357cc071a36a9b5b517873cc16960654ac2a
SHA2566dcebfe49645ce9a480aac0bf0520af5eb588b3d4d44aa998915c6c7528f8a66
SHA512e1202b4eb7bea983b170ad3e328cdf1ad2fe614cd50fee63fba01a286f51edf57daa7663fb666a8464391b2a2ac6265348737bc957f6ccdea6c15b2427a20d60
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c37825b7e64812fcda9a016136945e33
SHA12ec9ab2f32603aaeff12edb6b4980e32dd9c5424
SHA256a66bb4caff81591820baef83d18810b34eb2e671fb3d32b94f8ffaed99cc50e4
SHA512511a089607787f8aff9a7c452c742a3ce4cae33dd414699f031119252e99b615fc322f34b48ef2c06e5a9c81fa9698804af9e34bc96fd419b5adab2639f6eeb4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ff03f20c5d3ac81e116c484971af8cea
SHA13c090ae1e490a3720607d56318c611d023ebfffb
SHA256df38b9df525a8777fd3f32e46dab7eb09b9b64a1db57e9a59679da0d143168e2
SHA512ef3a44ec98cbb06c51b0cb8d7154062db1d83058fa1a53330dfabdceb4599f84077202b731b644470b85a5a270bc89668d855237b2bd4e425fdcc8485a3827a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD537b8bdcdb9f350083e2dc997f6dbb96c
SHA1d59bceec30be9b5b7ea2662ae84269b8efb1e7e1
SHA2569aedf13b76363580852e2fd4bd6286a44a69b8e95d7906ac548bb520fdc829c2
SHA512551f874735e4cf0923f6ba64a5d3993c9217db011faec25edad1e8b5379327fb61c0e114aced2137e2abeafc641a05ac1fb3fd48c862dac87825374dab254ce7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD558538747d7386f5273c1abd571c12ca0
SHA163d71548fb1cdb27fdadbfe3015e755bc76f4184
SHA2567b33fa77da9489aea20643d76ec4b09387710688db340acf816a1f5671ad0138
SHA512a6471ecda0d5d4aaf6e847aefa3170b39512f74edfd07020e994db13be12b45541c171a353ee000c2aa062cf7e3ee9dcbff29b9c6f7e6b539658fdd1a488561a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD521f97c5bee34b9cadfd642a64da1137d
SHA1a77b9e79aef115be512810bf327db07fe57168ec
SHA25604bb765daa4f9b5c5c584277ca31b6d1cebbcf40e8603ea87769159311009045
SHA512b993b0a02a191fb6c57494b94df94e48cabedb2e60006eae8587b2faa971c276f9c59ab6cf900e2c8ee8320e36263f970397b749db48a65dfb37035dd15d7dfc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c5a653a25bb2196070d1920033314fa0
SHA1079c3815f691e33cc5291053abd6d86716b261a5
SHA256bc9bead93b8fe18e07e17cefb464a32933b0a363425e1c16434d4f01f94b5095
SHA5121361c1560123394ca3c62e7788649b212373e2cacf4f05ea33de1dc3c7e0875dada334f08684c806d3a59516214d7b612cd66e550bcd735dacdad98f24ad68a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5198ba018913e5b2abdf1cadbb5a8a3d5
SHA1e7ece0cad09f00bb0026e271416f2b420f8e43aa
SHA256b9762330dc4af70b2fab0158da188d502bc34b22b7a26389f873acf6d5e02a23
SHA512a63d39c62c79eee2863edd10ee2b98095144d49abf59f4956918f45a354daf158ae2b3349a6a499b999372b2c3c797283066b6f4114f01fcb07197cdbad22493
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD521bd4537f2cfbd79b29475636ce8c719
SHA1ce2cc62e279b6888a5b79d587078a2240a008e40
SHA25656adac07fefbf880782656844c59fd71c53a88dd0010f5f1dd0cb3fb09d350ca
SHA512316ace0980297cb572ea2a94a08570c29512b65fb05e7a95a879ff12c711ee1d6164c485e75b8c713bbd944f25d9f0031b04aa844dc3aa3cdb349ef4b28d91e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51dbfb69d97069be8f632785ffd8680de
SHA19f73a9e6101b411ad0b926c6889d52fe5287e792
SHA256fdc71098852672c1b9ed24fa5f0d43918e0d256bd960ac2d3175c9fb4c4fe839
SHA512c165d9fb4294927ed345e09c9def3790c1861c0066d6293a721cc4a4c7490cc5bdeb2b28590bbf31e679ad47b37839a706090b64158befcabea7da4ee9e4ad9d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52aa89619372cfe48d045fe4f2532988c
SHA1811378f261392488fdf5fa58b3286411159a49bc
SHA2565c2e8c6ba3599cb89bcca3723d67a7559955d5c1e3207a91f879a3f9c4eecb6b
SHA5120f65d76771cee45a73db78c7a3742d5ad1da24adaa739dd702d543a9aabecb03b57a5008677c5e334323f0ff12d0c80430ea5d01ddab23f847d8c8fee01c1e90
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD537273ab29fcc6c7210b662b2c5d504d5
SHA11413f99234f1e0830796b387a1a6658f51ac7d93
SHA256e566ec0a444c35e16aeb881675537d26798075d385c85c2a20a4e41bc521c38b
SHA512329f2bd1670bf53888b5d832398209af659b2d7506aa4c63c67b28767ce476dd720bb89001e116d32d692c68c5c9013feed8c48a2d400d4403a0033ee2ed809f
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b