Analysis
-
max time kernel
142s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
17/06/2024, 11:39
Static task
static1
Behavioral task
behavioral1
Sample
b86b48533066b2792eddac86e0420985_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
b86b48533066b2792eddac86e0420985_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
b86b48533066b2792eddac86e0420985_JaffaCakes118.html
-
Size
52KB
-
MD5
b86b48533066b2792eddac86e0420985
-
SHA1
ef0204bf91988246016e5894b80dd7f0c490bf7f
-
SHA256
5fb3b7fd0e3a5bb8677b9c5bbc85d3da7f18999788c5f59a4ff70928181e47ac
-
SHA512
eff4fca713219ff48e9080ec934576e3dd675c28d9cd3183b8e32f525d15e2405431249d6a4a4a3c0a14047e92f8d147ca09ab542093f39144f6c7a9a5fe1414
-
SSDEEP
1536:TqHydIp0hLhwY30QC/3OhFlBigUJcKtAcCHPD/5zU:6ydmelwYEj3OhFlBiggcKtAcCHPD/5zU
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000043750aeed8d5ef842cea51afaf8d024160fc561b1a47bc7cdd1468e6f94a78cf000000000e80000000020000200000005cbe77f31b87b71557b3e881810577425666ed5fa3bcc18d162741fae819decc90000000308bcfb070a47e11ad9aff26d93b2f4788213ab7cc030db0d63470d91cbb0c19c49ed49c0396260e66ed0f350740d7706d029dad6f9c6fa3c1f8763387b2d812bff85d8eb609ce9a7c7880d3fbf4816f333b60e1ead57bf00cfbec79ca20f3d76f5ba58c03ef6335488e6b2a56f89517a5e0cbef2aaa40272af4781193c8497ce507ef8ab1fc0acde1055ff7f992a12e40000000cd9e34e2b82f57d33334f4f34578b444b36ced22fe2c4017479937fd7bd6edce9be7f68376a284be1f3d296f9eee0a71ef8e794ef7404070a1f9c216ce2c7ca5 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000005cad3563450fadda3694d8a0cb806f965167b4d3532b4e69e5a0d80e6471543e000000000e800000000200002000000060b38ff02012d58ccf1c78be031b459ae4e7b8d79fd2483ecd6c631232b055642000000060cb35a08ff0c0933243ec52d8bf1c8960082d29d3ae222b1c4a6beab8ec28bb400000009bc60b23c40596a5bf2ab59cf833a9a87a9452a6703ec205ff01cf7513e0e32abcdbdc3834ed10863e9fe168c321b18214bbe77b518820a584368ec97d662873 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2037a916abc0da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424786236" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{41D68F11-2C9E-11EF-9486-4AD8236FB259} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2204 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2204 iexplore.exe 2204 iexplore.exe 2488 IEXPLORE.EXE 2488 IEXPLORE.EXE 2488 IEXPLORE.EXE 2488 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2204 wrote to memory of 2488 2204 iexplore.exe 28 PID 2204 wrote to memory of 2488 2204 iexplore.exe 28 PID 2204 wrote to memory of 2488 2204 iexplore.exe 28 PID 2204 wrote to memory of 2488 2204 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b86b48533066b2792eddac86e0420985_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2204 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2488
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5baf90b605c055c51918d87814ca7638b
SHA195727338aa9d60dbe8f5da7186c548822b71554c
SHA25684bfab557a43e89d52d5d094e80f52a0ee9c76baee42b7f4efa3200fbe766112
SHA51207fc7e22339fa8f2c483a4ddea51e28a6e18326d34345d3980804a72f08f140901527dbc110c024d81c653000b6df88c8f22187ed6f5088792c39a17aa921184
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD513921c4ffbc249c022b4e53994666efe
SHA10ef732de310618b07549697b1efdbba6cf236624
SHA256276241927a5101af8101f8dacb285a4b2653c5054af43ad9d36186e4482f0d69
SHA5122717a9ab78e05313a5e9c34cab17bdd87bf96b84c77de4aa35466f96b03818be32a5e3ec17f1dd25575acd8a7442d6b3010e5243816da707716edc3e988d4bf0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a3f2198df27b760bd31a12d5c598a67f
SHA18cae8c08cbf90a296592e5a5b9c749f545b4befe
SHA256d26395dfa879eb96d6934d4b4fa13a6f8411f0ef4e925cd24a4f78c0b179e8f3
SHA512ee87e4cf511c3c6ee59fd20d8f8568d9cde85aa93779dcaaf9bc0a93ea8aa30d0393e518dac9d7d7c8bca0864e6414d4f23f7bfd9042fdb2b6003745b8d700fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5078d304d01dd41b0f7fd4c962b8b7c70
SHA17b3ae127a879131aade23a3fed10a2759b0c8061
SHA2566b6d690c34b66eeda8ed356ce3b59faf8ab46541d0b8ec4a4374b35efc522736
SHA512c4c80a5facef318015567460f6f7c789d2f6e8260de1cef2c9c9b2e642340a12cb5781fa794d861fda7ab8a2566b2c80c827c130298671a1e08a6107d6bdfcf9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5228100bbd16802e91d7c1dbd98064e3b
SHA1522da5466ca691e703e7d51d543c4af4fd2a45aa
SHA256c505d6e4f9044e1cdeb3ea9f76c6326b93b1dd85ca942d7b079d8f93bcae16bd
SHA51291ddfd5182e75277fc22be07f25bc5c40bfaf961997a693c897c10e40b2942403ff85f3708af329cfc1db8de208cabd8efb000f55eb297bd59383169fb520647
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fdaa34e47b64b23a2ecdeafc2359294a
SHA1b674d66e04ba61ae740686fda1323e5ffc6bd070
SHA256ec5a4748622a78d92a832f58833bf40b8f2e02b054ab87f4b822692fad85c463
SHA512a3c85d27fb43f77e66028e6232dd7a9837a58decbbc5412b0737e1dfaf238b9736461015345b9e42b8306f146571bb9b8b8752cd24c3a99c9985b5be60e5fc70
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD519c17bf31697974885be132ef4ea7762
SHA16f6c40b3638528b00fd4bd3e43ba06c0dc89bc2c
SHA2569c51782e965d6bf18381bebaf55c84ddcb8fca8f1e53190534c82329eb458ec1
SHA5120b7dbcbb5ee9fc40174c9f6b48d989f1cdfd70eb87045fefffde9f2bd3f156e832b050c77ee17465f6cf0de412bd056f69acf264ddcd8658a8afc2f7fdb593b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b1c1a1d4d9b2748d7b03cbd22d942fb1
SHA148a78f2091d75a441669d663e5b3dbfad344ad38
SHA256aa3a5620a0c4e816a3768cd1d9eca65c05df97ed28bf4f74ff685e72c46fe246
SHA512095dbff42034170558af9dd7de2c28474d60dacdfe2ac5dd78f4f51a31b0e99514e0875fa4c2a94d6c0ba92aebd3e3920e06f24c65c9542c9c466315aa5d781e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f6c310add95fef5337a999d44fd21d47
SHA13dadf1fbdd9a4abedcd066d49fe92439f044ba09
SHA256551127941b37a38f46e10c14e58d10762bcc40e30257b9ccc333da44216085d4
SHA5129f14ecf699dbece7c357383f24812d4ebf4a0fc875dd5eb89e29176683fc54ab9eeea48b565b70b8d120f9613608a6105f795461694cb43604d95b50fd249507
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fe053bcf7382e9043a61bca8f5730106
SHA136ddbdd2a34cb8a159a48536fe72948d9f7a30fe
SHA2566552b085436076866fb22ec1601f656ee8ff3d96ff43e015de50320fb136caea
SHA512b621a0ebb8a65288288b631f7f65f4e5a2d5e0ea0b1433d6cfc8b31a2dacf78c7f9eb76483ad156fecf04262c34933376a73f945dbf2991e61a09fae9aceaa0e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c1418bb2961552de0fb5f4082f4348ec
SHA162136eef596e05bb97861488e066e5d2a9207229
SHA25610127f8c4f1b6d7127b6b6cbbbff6f5a3d7ff397f5f6649fc871adcc4eb2ee54
SHA512b529806f41663138926fdecc76b0d57c72c8505f620e61b5a56737c2ccdc1a80e1b5649a2af0aeedab74f9fc6ad3aa71eb63ca6753f3c81a677dad64e277af16
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ef426ae2b432663b14213e2aaf6c1392
SHA19b130be14037bb40cccfcac4fdea6fce418f69b8
SHA256945454efebb35bf9c7483ad0157bcc25785e2708726d302ba44dada869f90995
SHA512f577cba269a0b9defcf5fc1c9de214dd81d562e82b6b34c3181c9d4d0a0812c17978de398ed22c92ff863151fc9c0cf7ef3f8b4a73cb332e9f232bc411f86ff0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD596e77cc2b4eb94d6ed74cb648307b635
SHA14ff4317e9ee6521e118ab4d168a96968149052b7
SHA25687e2c4f2c37e26a2bf31a27c6846e53eae89e40451671a4e463ca5cae9848fe9
SHA51291454d85abc274d6d0e2d7e50479db70bc122700ba6b1cc3752805303dd347df8b975af4b2a65c53509f81d85078b5a5d276ca9d8f09047820fb2c3e8eec9fb2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD501492a46ca18d359b8b7d353407e15b7
SHA19e9f9ef7a2dc5bc952263cd876bcfedb0b7d8524
SHA25670bce53ef7fb0ebb6c2af284005a12d529cd727c8d03ac75158634ecb567f49d
SHA512334778e9ff8f13ded6ef417467ab2b07ffe700acee3f9e9967278b3356a9747883de8a04f694f493acb5b7eb5399c354d7450e770659436c388b2c1eacab81fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a01b73ac0c3e9395facb454d37f83fa2
SHA1c82c2445193324a9d201cb9b5bb22dc826d37e0e
SHA256374d15f088308124f6c7a5774414dda4f91df3f4b02b203c478400703f6a3917
SHA512e60149ef51953d140edab60c558db3801e39b22cb6aa5b5b4a2a33b1c480a1ee96d5bb96fad66bbab8ece1ac71409fd42edbdb9afe0dde4140a7eeba7eb27265
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD590dec9e545ff67f3efb71f41dad49d0b
SHA16cec894fa18a207aef6e52f956524eaaaff4c6bd
SHA256e82e680eddbe07a2fbe00b3d5956fe77a3fb353f15e4d5305ed8a6f3a76f22b5
SHA512e426122d93863e1ac4d5941c5210a41bb9e659516f92dd646f3950d1a0188378aa21cb2cdd7844022978a8a1e9139a18d61cf44f008be5c47debfce02ce590b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50a7a46ba7a4ffb95ac26feb734028a66
SHA10fa2b043fbc3dda3ebc75f3bf9fa05aa8cc150f7
SHA256c0e210c6f45667c96f325d2544d0f850f9e792bf33de6b9ad3d6a28861e768d9
SHA5121a1c35209edcef7bbabd3f6d299e655d8323e7907b9c50499138e99722ccf768c12220d0ee36aff48a07eaf0852a26a71177495934aac309d0d0600861196a99
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ec9ecd4a7e441b30b427fb83fc233d7f
SHA12c8f6c336022c6ab4611c8a2a1503567903d29a3
SHA2560d7ff29cd3b40df536a6452912b40196c2da8ccba1eafe883e9e81a317e18d7b
SHA51247ec36b86db9fdb3dbdd7f61242eabfa3fab6f41b22db0653da27477a9f11093aa9dff1c47c94e273f781c6b4ed4e729f4ec28ee225ebf6593e5800ecbb9b382
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b