Analysis
-
max time kernel
139s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
24/06/2024, 15:17
Static task
static1
Behavioral task
behavioral1
Sample
0944e551bc71630595b7831a7e25f7b1_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
0944e551bc71630595b7831a7e25f7b1_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
0944e551bc71630595b7831a7e25f7b1_JaffaCakes118.html
-
Size
91KB
-
MD5
0944e551bc71630595b7831a7e25f7b1
-
SHA1
df23286d241bcb99f658e87e9ba310bdcb3c730d
-
SHA256
1825bc9be82d49919264502b803fa800b125ae8e8eaf44c230862982c7a70199
-
SHA512
7b8b8d54f053cc59bc718d7ce544a6c46749534ee27dc35ac9afdc97ed7f6f1c64df3dd1262b14b2033ffcb37cc667ed2c173402b12dfa8890d7f0f20f7a51cd
-
SSDEEP
1536:gQZBCCOdF0IxCKIgxq8YMmEhQcEOraRZYkV/op/Sfnn3dfaOsAtikKz4YHqhBNYm:gk270IxYPd
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000c1abd1d133b35558f3c9ff2f93f54300c29f51f448ed24da04e0a746749be227000000000e80000000020000200000003655f76a02308078d1295c839836b6e53ac460ed9a994cb61d8192dd3b24a00c900000002466710ff6ebae78b018c62df8057160893b24b97df73517fb295a4f9b49ac61b2a3fa7c87b6b1662e1a20758215310d0643e96b6b732db8578577a8565d354867b8c113ae6b7578f43e0ea4831bccc8b7ab74a1b654b166d66a8106c990fabe34be9377e5c1002c955a9244eab8d88dd20f5a045af301b83a37f46424ec831a4841055d6a2485f08c1b8d788913604a40000000d1fb214e8a971c4324d7b13ea36e9b804aa5a4800dfafc484e8592dda4dd02c33f38d48a00e8270c83a0ff3b9e924d83f0c05a7cc5a8f3fa32d144db836c7674 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425404137" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 509dcabf49c6da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EA0B0CD1-323C-11EF-8F1B-D62A3499FE36} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000046bbcce190552a7ef53928bebe93db0cbd37db5a232f0ac6097202d72e17223000000000e8000000002000020000000b0029aa4bcb416d29f50d9b64c5133490eedf7d76e852aad76f0427552d4b342200000003763b613cbdefc396d261ae92d0eba337457f1e3721aef084928cc8bb5c907a14000000067febc751ae8c2a4375ec8061d8ce063f641ec7b53461af359076657fbdf363084cfcb4295703047e1f21bd5aab40e5d8d537eb318015d06024b109d142334b0 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3008 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3008 iexplore.exe 3008 iexplore.exe 1892 IEXPLORE.EXE 1892 IEXPLORE.EXE 1892 IEXPLORE.EXE 1892 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3008 wrote to memory of 1892 3008 iexplore.exe 28 PID 3008 wrote to memory of 1892 3008 iexplore.exe 28 PID 3008 wrote to memory of 1892 3008 iexplore.exe 28 PID 3008 wrote to memory of 1892 3008 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0944e551bc71630595b7831a7e25f7b1_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3008 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1892
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5063883ee28cce4bd2997d7121869c260
SHA16c7694a797c823d8812ca496554c918ebc35dbd4
SHA256d5b4fa43e0ea2cde040283365fde9e94833db891e23de2c3be9a8ab793b0cb14
SHA5122cf283e7aa38c683767f5fd2a003918308ded86dade6f584deb66bc61a19b8e2b70bcb3259b8532a3ebc69a65046a3703452a6563bd0e5b1ee7e7ddc049706e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d467bb996925f0af119c68d2a5f09fa4
SHA14e3e10e97cec02206f9bd3674b11051b43ea535a
SHA2563b600c0b74b7745d6e7d6ce21d9aeca38336392632987f41ea5620c6704efdf3
SHA512249b44999b08f4667ef0ca41194e6b54a12c0f709d578289b009b3c5d4fe5eea8e2d5bd6844fcec0569dd879cbbcd9b89c95eb89cbbb66f09d43081460760f61
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD555e5f1c9632bc9eda873755839767ff5
SHA164672b95279d01873316e6849581213d03ce95b5
SHA2561bc93d59b370824c3a549207ef97e867562ea3a8e4e5ffb6f16f7765a7271fb8
SHA51216e7e77476c0e24c380bf1d8abd7df10fa3eb90ef88dc6ba60f146520a6ee847b753192c54092caeaae6a0ddd9d2c221f99baf3710ef0083b6a944fd997b1c14
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b76fe08f573ff002206971c8e4e86526
SHA15b386f3c4aa3295938f65e051ff762e6a9350da3
SHA2568620c151cf4d3f602cd618adb4709a02eb95c2aec9dad9fb474148fbc312c977
SHA512025141cc73a34d23e59280070f76b224671033a682bd13a36f8d5779427ba6f9c64718add7bacf919422fe266ce6f20198fbc21248eabaad2cf2a739026a39cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a192d6f1edca4e42054e724972438721
SHA16abe2b94113bafe36ad2ef264e41a29b0ea48974
SHA25672dfbb3ff304d84b22d4a4ddb0be228131b9f24ea21d8c78ec306610d62d91cb
SHA51234f1f1f16e36a6a1fc3b7c40bc9136a3fc25dd2ae4f01b128446ae36979ca5207e6b57753994ac01638e44db67fe312d034122fe86d9e9e5e4f95080b357c41e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d4e635162ac819c093282188de72180b
SHA105755f9432e0f27f0fa780ad3543220d9235ddcb
SHA256724d00fdcef50b3763148a4611762363959bcab75cfc2340cf2d2ff3b9add749
SHA512f4e83422ee205f6821e3cb3242e05358c36ddc59bd6505b4b447f773c1be6848c027bea751970393ce2138840b52a4de6d1034d7909de6e4390235028ef48e3f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a9949cdc2d74e7daa013ca103ecd9fe4
SHA19661891b0a4c6488db6131f161c7b21ab65f0d1c
SHA256b25aa69442334e6a6a630f896198e3c5b29ffe1fc0aa91f292c00a1443786b02
SHA512778bc55034d8929478d8ad3aa0a4ea1c0477254821941326600b1b8996d35cd811c91c8643c7d1cce94831d1a92fcbeb272230cc73c4a5db25ab0f5b71c15d2a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5edf8a2b5b80e1ee0ad867317aa010c8e
SHA1effb8159ed0054719a882326142f9e386d9e0546
SHA256970a3a6f45981127f85294ab62f74dd7eefb6cf30688d37cd85eaf48fa033e4b
SHA512a0a10ca15532bc66646ec09cad4551e6283a4c321b1fd96fdbf77bbaedee191430168048468c47e9a8acb5bd096ca687878b27b763d3be48e20e392affb90758
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ddd2b0ac8bb9afab6b2fa241bbbd0c7b
SHA1b67ff1add2d72e02cc1ded70fa28b85667981642
SHA2562822971eefd53cb5021a7defbdd148fcb6e568713aed6969eb7ac3bff4e6590c
SHA5122131e55245867da4f01d5c5cc9c201a9e47142ac2e97f427f4d61ef6464c95ee6523f5af06b94083626c51e163d6c3212d1fe9e19409d783fff154a097541d03
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b9d13b4385621b399119e781cf2e48c8
SHA1f0844cfedd0032df640fda673803dc4745618452
SHA256b977480af0e748a89148546e8cc13983c99f18b88ad664b23e1ddc5d3bfd236b
SHA5126fd227c5608c18e52080b97c8aaae3af30ea077f48a5bf123bfc39224c969f1098ac69346ca11142a696eeba4546c2ab439fb0a011bef813e71cf201c14370f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bffbd5d5004a5585e1910936d099acce
SHA1631422d37885977d33e7552cd77c08442cd446df
SHA2563f973a64192a01a099df6132f63f5d4becfbd4f1286003246014c6fd59457be1
SHA5129ce9ed05598a887d8b680b5ff5703fc550b58cdd8a57b205e537c163e8493aef929677bef731a91aa566e072291de38acebd201b31f1292b4f235e82b84ba462
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5791cf35560dc6c56ae90677a5e04501b
SHA11f66946b5147fdf2e320a3328eba64437f5fc523
SHA2569e27a47590f0bf85e0cc19c82b57a803159cc34f9880839455d469c3ca5b8ff7
SHA512d54477c4d4a435d38afe0d5a897e1db7b7036125999178041df1eca88c5f8d7e2b0337a5d28b39ba3675c5d44bb7a59e84bb75bc1e6183ca7abd728d839e7dea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52abceb78ae4bfc4036f2cfc61180accc
SHA11d47f1b1c637e5dfaf85616aebc33bae7aadd50a
SHA256ff804b1706c8f3937066636da590f0c8723e2d97bcf4bbc82e0135e2e3677ca3
SHA51234196f1cf5bc7d03bd46204f287a2494527c1ee77d7c69c5401d72d790c459dc6bdbb3c307f93792a42f7999a1d21fc732f1bba50fba2a163bbbc7c47a784035
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5751fb8490a97e147f10b57e0418832d9
SHA123a40b9534ca1b3870378aa956e2918e14bdddc5
SHA256a12b8bd99a501923872de0195f68c4a3304867ec0a9c56b282aa93c6cf23a51c
SHA5124d4791298cb5bf7f972f01dc4e1d9d37b29b58e8a9e73d99dbcdbb583a9824a9310c3d32e81a84d61839c16f5cc2867728f97a6a79e4419b0e526de5d38ddb11
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52f9625197e4cf82c0a7bca1ce87361b8
SHA1927ac5cd39bba921aa2899645e08805d8357cd37
SHA256e09d108c909c5dcbfae58ee3bc7c3cb144d61da27d2d80d50675b053a08b32f7
SHA5120b66d4a43cd94a4f8501f300b791875eb77b0425eeea73342a3dbceb82bfa1fe72c9b28d5ffe3a85260d30d1cf918dd9a613cd71d89c8b57605d05764174b47b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD514f789076d87e30c84fd96443b5d36d0
SHA14246933d5d43c146bf53a2fc477ff8dc5fcbb7be
SHA2567e7e17319a3b63e90d8fb2042bd09f3a5c4fdc76a3510683432eac1fc88553c8
SHA512c603aa5b3733d9ce6d2bed7871fb86899902fe030e1857ae5c2d3c428b84b6395649d846087d4aecc23d409166ba0f66dcb68dad4d06b3fae520be1fc3ebb167
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a2b64365de90783c49290ec0ba8f838f
SHA1a8a05ce7f407436336e59769510dfa0fd47a3ddc
SHA2566e749ea5b3f7506d1a234845e2aa9fa71525b9d995656091946ba47045e1387b
SHA512517b91ef9dbeb23cdaf5c8ad540ee29c80945c06623bae69691df5e305b5de50a7d18a60a1ea3b1a64a20360b202c1c852321d36568d3eda51928eb4f85e0357
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51c82f13c3a085458c905aa2058296a1b
SHA173f1601a0bfa474dac80c4f8b7c6656b5de712bd
SHA2569f0da222e7351d3b1aeb4fc75a787ec59ece0ecf3c9838793f548c31239b09ac
SHA512eef920c0317a2ec402c371ef289887836ec682ef35f810683d9a12b7d8c6f9ee144919c9b12e9fe58b7e73bcca88d9e1c3beb1c416d637d068193a9dd4ed9926
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD505896900d710085a63db6fcf2214a0cd
SHA172b1a0f9e51acc9c99de31f66bd20ba5f9cd7c74
SHA256ccbd4056619064ffd4914c689959792590c6fc1650bf92c0a8a22cb70f7f054b
SHA5120d21c58cbd461f162649c541e9af77fe68310256de85b75bce1e6f06100d857f80c99eeb996d2a1ecce4da7c63388122ba76fc517208e383ebbf40ba49895f1d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b