Analysis
-
max time kernel
118s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
16/06/2024, 22:40
Static task
static1
Behavioral task
behavioral1
Sample
b58cafc671ab1ede0894d0414133161e_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
b58cafc671ab1ede0894d0414133161e_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
b58cafc671ab1ede0894d0414133161e_JaffaCakes118.html
-
Size
32KB
-
MD5
b58cafc671ab1ede0894d0414133161e
-
SHA1
6ccce439a99b3d385e42524b20ed7f87128c461e
-
SHA256
87c8655715eb1401ce435f65527abf4924a5b2f1d5d42d361ea3b02801cd2aa1
-
SHA512
cd55932c4f7b8c9bcdaac4515081ad126e05a4527777125fa6d76632675b724c8e081d45fd13ec86d9a11a096b6e4de5fdadd7ab73ee2ee562bcedfc9e83d280
-
SSDEEP
384:gGtCDreJg/0i0ovcyfA/yiAJ7FFTD+tk3cj+t0OKLcB4cELNQH7MvQdW8x1zQomM:1Oreg/fnUxNQH7MYT
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000002e9e780c839d7c0a962870b3fa7bb661fe5c0dec65ee86860978f195f3aa4b85000000000e8000000002000020000000b406436a441c7686982a594f01ad1f45edd7f5677c4648c33f1bcca3c5d9f6a820000000b3f6c41591bccc10197d27933b058998f9e1b69fcc01e5fb18c037bae196257640000000c88c2cd17333260de6d796a4eb911277ac3ce0077ebd819b1c5ddf4633b67103d0099dd39f04d988d9388bb2e0c1b2f1438eccdbf4fe5fc6771cf4a2ad4ed6c7 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0c25a4d3ec0da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424739514" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{77722E31-2C31-11EF-AB87-5E4DB530A215} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000003192f569e12ad208372188cd8f1829ed34114a51b2e60dfb9c81184b681061e6000000000e8000000002000020000000c2eaff5ddcc06b7bf427061f3622b900590a2b7c32d60954684dbbc8bc3ef50790000000679b73562d749f0c468e180668c8a572f620b06c52297c916dc0f78faba182c4fa178eb489ca59c44bd46a9aa5bb32b25a5dd24077dec54e55688e7ebd1fb031c1190e809d720b3c298cc6d98c8edd6f8a2eea2c643355e942208790aef2c4413a6bde6bcf433e2f77eb7f71f212b8165698be3da53e606a7dd45bb0c76f956c22c4363f09c29f7a18df277725d4a2f94000000027e0a01e76ffcff6eb8a34a276c153b97ded26d6d723d54b6c792a51417200947a5509ba6ee55960c8f19597337a373dfbc743e5749c3ac2b86ff0106da91b02 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2980 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2980 iexplore.exe 2980 iexplore.exe 2588 IEXPLORE.EXE 2588 IEXPLORE.EXE 2588 IEXPLORE.EXE 2588 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2980 wrote to memory of 2588 2980 iexplore.exe 28 PID 2980 wrote to memory of 2588 2980 iexplore.exe 28 PID 2980 wrote to memory of 2588 2980 iexplore.exe 28 PID 2980 wrote to memory of 2588 2980 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b58cafc671ab1ede0894d0414133161e_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2980 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2588
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ffef8ad2c81a59e01790f9ae1d4378f9
SHA17448034383578bec20bff9aaba7280c4b3cc774c
SHA25611c4cd597160e7de92aac758300b7ace722d5714e29e7ddcacc8e47ffa85af4d
SHA5125c17e6e6ed14cefd0105cb782ebe4578e5f1590d574eab617d3ab8d5429c44143b74773ef76efa06ff52f901f0d92f43c9dcf90c202f342b98a4497a48dc546d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ec877c767b243103cba0acfee417f62a
SHA16b8e5dd66943635275c88a73e4feb978b1ce1a02
SHA256e075e06b00434951dd14ad3c68828747b3538ef3d36a656182384a14649f2828
SHA5120125424148c104b7630de9eb2a351619c26716f94c78aa6dc54bf3f925543fcace3a9c11840878e74aeca2a4ed8d7e9eefc4ba49dd9fa5779f58db00c0b74442
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54d66fe9407b25433c936150f0d18159d
SHA17accbe252dc3df20f77d6def4bd90c9f54ca8b0f
SHA256cb1419108202c008cd41620ce51da07c16af45009f849b7bd418879870aea696
SHA512c609b123788732ee67cf6264809c36f1100df2086812edc2c4ceddad61fc9404198c19b4118a1f99543ea407922129f18c0871164c87b52c3ad70ab3d22dc877
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD526b936813f36b37161a583a85c342682
SHA1ef8221a3de23b482f17363b07ab15e1ee0e7206c
SHA25660a353f4d993c14c19ab460f326ff37222febca10bc187b623867894a52f1b81
SHA512532d268048056c8c541eb92187864c522078449f4e52a27da9b59922bb29d6eec8f8a51919ea979bcffca7af4e02ed8c44635bb4a926fe4b2a6c6d94c72b7aa1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58b10aa1fd859bf601e25781fb5aade83
SHA171a50d229d63e473a50ab456579542b5a4ae1d94
SHA256874cf07a6167edc90aebfd235234bb2070cb489c46b748f38041c0c8cb80b665
SHA512bd8d66a679f82e133b0c10d1ae5cdceb4d6ce997a86bbac838ef1bff3df33240a8db7199c4be1260372695448febbd5535166597db492c7e6ed4de5224abed46
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5924bd227e84e7c375683fb9d1860f719
SHA10b6c60977b8a024316add22bd7e2620c92b66aaf
SHA2567568d28cb95767e53e9d902aedc6ac70ea1b1a4c9c4a53bc60e8ad0f567e893b
SHA512dc93e92e2085c986d6296f03ef9303da434cc20924b27b7e12fdbdf087d19c8da0c27e560ab6252f254c479f4f51bfc6a03b7a98b8af81df7c46c4a1196a7d60
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cbcf1208a1227493b3627af65f5a1fd2
SHA18ec8d674ef8f58b7544f7cce96033fcd75aa221f
SHA256ccfca6e1bf94ea9f2138ca66586e57eaef35e476fc5e14170a66357d335f3493
SHA51257ff74f5306d6b1670838a7e2568aecab8a7ee7a38a60cb477d37365cdb61540aa603edb5c62ea66abf104ba9f0eeb5a78e7650100d727dc47cb9e96997ceb61
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55a2d41f81794186aeec9886e3e98c4ec
SHA114cde16a52139f1a2f6b9664094b18c797f176ba
SHA256ced4fa0b914c4ed4361e7d61648b9c949e1f93730258b3505ad23c16fb69064e
SHA512ad80cbfcad77ab4760ef744c18ba9fdf1f940b525ab1ea8cb77f25f68166e2dd591897d0619de04d67070f267ef02c03186491b484a8b74fec5347a2ef333417
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54b176ee117508a70bc748444e26957ce
SHA12a56719440f71b8391da24ce96556cac0b915b0a
SHA25687855e7f046d8730d9eb7051e1ba373f441596fd71fe4d00fa2b169da5d34e8a
SHA512881c401370c701ed9d13c1a19d685e2fd432f598fa2f2f22251216f59077721bd6d7ba54fb3e47144e01e7b8377838522cc88f1e7c5ba5f9920c9039e11ac854
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52f230aecbaed2756da67cd7ffc4ff7f6
SHA1dac696a9ecb6177579f34c0ce56caa2b4623d295
SHA25663c3ce7cbeb8a55e039cb3cfe6a9e4269b5ffd8e779ecd65c6fe760108908027
SHA5123aedf0a88d41bb7f4c0e36aa01d170f726a00dcce673d7b713ed7758e86d32e4cffc307374ec3380f74bbe3127cc635f2a5d57dccffffdcec80855bfddc86b49
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55fe998419bd248d4ff3199707901d8a7
SHA1fade4340555b14d492c675ce04063b43d003a10c
SHA256b8675df7fe91c4f672ed37551f6a890ed71202a2138248a918f965a279d56e15
SHA512647208717703828b8d9720085ea0dbb28686d09e7a33931283ea7904c515f8cf07bd4cb678ce08f740315f80fd528136625e1800feb520d681c086092d230649
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b084199a62cf56ce52b40ddfc867c7ed
SHA14f37cb8227267525d21a9a92e352d99e0348e357
SHA256005eacf3d91ee5b7ed8ca43821e9984f3c5b9a223266cbca492ab1c5f057d3a9
SHA5126ae31d5d10735d43bf7c3251d7316383ef633d8acc15dd1b666766b67b84e670e45882df6a9e6bf4dd3b1d46cd99dce1051ed38ce28e018d922c0b10b6ec190a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD541ee53ff4697b9a5e6b36b01913c23f3
SHA1ce94b8372287a404fbcbbbe98090e3321fe107d5
SHA25650e696a7b9748ec69277e538b4bb4548e16fbe983f6bda84c5d741a6fb402b89
SHA512c67c18784ccadf4f9cf4b9a08a9d7112376e066adb933e1bbda7a4096d70be361cac72252c4912c0139930fef43318f9afaa913cf7c9cf8eeaf662408c0f8ad6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c0239bd679834f50d2be0f5f023057c8
SHA1599477eaa670271499c8e41508730b5bec1691bb
SHA2564fbdf89b21c8e9aee9a6c46dc573f52fc352898b5f6b69647b333f685aca60f9
SHA5129195e6648e3b987443873f70fafc80c7528e5c4f4ff5b37681954adfb1ffadd78fd877a0e7bec1973b6c1c6612040e4079667c7db44a2e95ba1c77922a8dc7aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f441411e9ce9defe8215e0e26d1f0584
SHA1b7d6afc44508c7a2af05f32e2ed8011c0a0cd9b8
SHA256b649b9717b4e561e62d9e07eb9d310d4743e93220107a6d64822593ae8d698f9
SHA51259b9e7a1745e596ef5025d9466c6368ab411a9dd0bb1bad3c551500584ce7dcd91b5c00c1d43f3fc6bfd574d727bb9941d29c9b123cf51f86d23faabbf63d43f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b14110807947ca925104e9daaaab29a7
SHA1be82581c8fd8b7e5bf59b044ed51a580b930ab4a
SHA2567fdfe352caf1248ae1ee261b6487f68a7ffdfbd5afb57d2b25c91527acbdedb0
SHA512941a8bae328af48743053ae8f515db849eb36dc1db59c3fec6b63f258b2ee0cdeb55ff38b4087d624e6b431c663a4fc7f51064f4022cee3ee219d406036ead80
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f7d2acad04cbb462d6a57fb6a813c532
SHA160d4265a6471cfa988de204b57e710d10d6a7695
SHA25605388d66fcc3e3eaa6bc7aea180a63899bea50ea3221b97f7edfdb4d792cd1da
SHA512014ad36f36f8297274bb48e357bee760330218e731cc473d3508c6178e56f65d40e987596b396fe869ac984a0b8a2a6fbd41a339ce766db73ea5f0be0d70a595
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a5829174b9ca3702f45e3341f048ea58
SHA12e399809863a79a81270063caa7ea5a70e07663d
SHA2561c275a554c63e6b77182a64f1d5e50a2ccb9ad38afb3372b8285f335a4350927
SHA512013e70c7b916144a68210aeb7c787203d171d3cdb04b5145cfbc17308e3a578b3498783835e454ac36b114d3933118b199b744540525dd60f1dfcd6587ea6061
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54739441b8376813051e57e99e374da9b
SHA13301cb7309983081772f319369a16c1d992e263a
SHA256050939e7a490ad0796fc5e424cc76ae0b217b9bc4cfc2abce03a7d615d65fb39
SHA51294a5f21e49b19dfd9629acd45a3632d77eb5534489c5a6bb9f15006fca09cae45c9ee1acb62fe8deb0586dd0fdff5337d8961381bce2a024c333ef8a2aba60b3
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b