Analysis
-
max time kernel
121s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25/06/2024, 03:20
Static task
static1
Behavioral task
behavioral1
Sample
0c434468c575ace22ac35ddea7cc9fd9_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0c434468c575ace22ac35ddea7cc9fd9_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
0c434468c575ace22ac35ddea7cc9fd9_JaffaCakes118.html
-
Size
22KB
-
MD5
0c434468c575ace22ac35ddea7cc9fd9
-
SHA1
958b3ba55cf404a8992e88ac7b9d4c15d1839e52
-
SHA256
05cffe0e3f4e2d709adb3ccda2829882902fb92528bfbfc85cce90c05c5e8a14
-
SHA512
b702d6c2a205b1f8a3664f5b6809b3ba461048239f1c51e41483df87a4642ca472e61dbdaeffdddebab7c42a4c38e6d2a37d4a95198fa33469004a582373afb1
-
SSDEEP
384:yWUvV1FsFfBQYm5QTDWGPoKCC1YLojTMvsfLJsFQ05f3gocl0HAUjqnsAWnXJbna:17m5qWGP7CGYsjTMMLOJjcCgUjyWnZov
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000005a34169f798c94cbec955842d416c76000000000200000000001066000000010000200000003c6b6cde1446e1c81555699fa171fda424ebeeb7a6e19d3f5307646549130a4e000000000e80000000020000200000000748a10293d15b2cee075b1d66ed1b41a89bfbfc59f04e1aa74d865b2d5c370d200000005203821aaa03f3934d3766241ab84f56914cbd65169b8b31a19cf20fd25d944b400000005e9d748f1f568b8e77498e644eb4e36564242008e137a6860581205aeb9ab640377f9611e7e3bda311c6dc46f60a6e62f9a309834bc683e93c7e566db1834f7a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 003afdb2aec6da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000005a34169f798c94cbec955842d416c760000000002000000000010660000000100002000000048ae12a3bc5dfa5978e710a54b25ceb0eeb3049ee2d1784c9e0667dcd255def2000000000e800000000200002000000063cc1271f61caf6c12ec8d8403df06dd7f1cf9289b2ae631b0df0e2585093487900000008f8a0803da16aebfcb118108d1c73a4e47cd4dd9e01490f3e950048e7eaf267198abe2dd82bd3c03a4e1411c4201f3ef893b6a49e0efa772a14cc1a6d8a4831908ff402a381e037b5283d37cf2065366cf13ca55ad3c70b597b09eeabfa9665c6779531200058145ab57beb20bf537722107d9aaca0c00c0e75fd3a7994d83fb217199f7eb47befd575d60eaeb05c40a400000008a2aec9f3c27cf36eeff47e47b13842f7796e02796d9f8460121cb4cc7e2f9060d3718eb796d7a87b0b198c97963ad6116f5b573613531fd6dddb7df5bff8951 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425447495" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DE5C8ED1-32A1-11EF-8414-4A4F109F65B0} = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3008 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3008 iexplore.exe 3008 iexplore.exe 2208 IEXPLORE.EXE 2208 IEXPLORE.EXE 2208 IEXPLORE.EXE 2208 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3008 wrote to memory of 2208 3008 iexplore.exe 28 PID 3008 wrote to memory of 2208 3008 iexplore.exe 28 PID 3008 wrote to memory of 2208 3008 iexplore.exe 28 PID 3008 wrote to memory of 2208 3008 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0c434468c575ace22ac35ddea7cc9fd9_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3008 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2208
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a2ea344b93201d732d1d4bfad17202d6
SHA1f72a9605a558e112d1a7b73dd0e7a51290a5e4b7
SHA256a930b465b0a0f7da2400a50d1666310028ef3f3de2485fb5fa5ad67d9fe0e5af
SHA512121c42424d9c0ef181bbedf7a90356809e8698989a56583dc4fdc8c95558d11905142625709984faf409c83a8076c7b75f784b0d9743a35433f991b357edad4c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59dd9ae9b6bb6708d0f3cf88777457a89
SHA1980865bd6741899a8a20f5aa95d322698ccdeea0
SHA256eba79910670e2d6f5b000a53cd29233437bc73a37b28246175f6409b05ef469a
SHA5122e8f14a1450fd68ec9f8d0fa51c1099f77938a45da3ec6451fdccff85d30b9a4ca4da14b2ba22713b14a5810d81a4534080ca3e15fb978a8eb0ab246893867fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cdf6e09f01623e2706e0f0860664d13a
SHA14f1b1bf43eae71af95225a49aa25970866debeb7
SHA25656da939bff19d3a46c631d0caaa293765ac8024fced00759495c15814f176efa
SHA512a93e76e06e28848e9255cd213fbfa0d0eca8a5032451c308eab21b46b6e943b2880683120cfe001b67348393cc7c7f013a13f1db45c771e9dacb100ea7af730f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c404881e4fd60205022c018f5e072cdf
SHA1bc4329b9289033c5d860a3d72ad1da38683301fc
SHA2560f28e1e65c1d461bcf8b7932efe6e2740ba33e734fac3815d9be6e3d64ee2317
SHA512ceeef89c60d4361305217c2238a8ed5e1f313bd4980062626b69e051a74472b9760c98b2dcbd144ec113115b5a5ff2dc5cf49e3ab39ad491ab1da76ad5f1bb2b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ff9e538ff14f3d9637f8666d95f74c55
SHA14c806589d1bd167c6b2dfe0faa2c58fc0059761f
SHA2567ca736474c81c52e2dfcec504d9b9d2f23a8e9aa95b3f7de2de8a9b343a3adfe
SHA5127436a6175d84bcebfc4cd5cd217dee844f1f669430a1cbfe43773f6601f3f027055683b17fa183abc9739df9f3c2206c0f594676d818d1761be9da3c68d80260
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD559a85b8029ee63f69ae1ecaacc86036e
SHA1a08e2926b776ebedbd221ca7920aaf1cd55d74c6
SHA256c0029b68f851074dca6c1cd72a1a4c39f1131f9a8f77d328dbbcd96f89f9c82e
SHA512d2dd9b2daa85e7ed904c4ab949f667871ce20867d824bfd721a9e6fa4954f21597a48907a652326a878f51773b2274ea7d44df33c282b5a3bcd2042f501f3f6e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57de2769f4ec86e0804e80cf3d2f51488
SHA130e061347921650ffa660e833f2e1410291cf61d
SHA25690373a1de424601161e2c6f15aa58c56b6a0f85a0ef2814f2f48d4c06713b041
SHA51227b621dd77f3bfe2b2fa57799168f386929c059fa81875acf25e38c17c541d409ec380cb0538d1166ed2a2f5cdab1a0713f66849a6e057ae1342408942f15742
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50ad6e95d1a53262a35e9228e0788af0e
SHA105d2abc4f80f5523ff9b442490ff420ebaa49709
SHA25612ca01f3e2e19cc678a55406a518efb8f0ae00ad9f1cbc4da988a63ed784ad32
SHA512d75962fe78b876d6117a3dc2d719597a0f93cf1c949c32ef8010c0a65848891beadbfd4c4576fbf806ecb10a5b7787fff3696b98882ef8182a00642b503ce954
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d2fd266cc6f039eac1676d9d9a1b1ce5
SHA1ff274e586a9b6df1207d5d3ac201bd4086b48d0a
SHA256db1fcb9de002da6c665f7c861547a7d4eec199f42aa570fca1024012bb06de39
SHA51250534af7d1c1c89b8088cfe9591a121f6afa63c9d54e6ab8685b2b07ca37a8a2d52a121b1feb6617e46e637e8b16e5a04c813de13d743861f01b8c3ecdb6aeec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD598784b2a828d92b5ed0de1b7549bd21c
SHA1a974bed0c9518ce9e69a8308edebf27bea0be39c
SHA25669ba9f4307eb9d2d1149521321de9558b109d6ef7c2ba176da3ca509829d67a1
SHA5129e16e587bb0800d062349a293f1f4161b5310d6d2d26f828183c7a9a016e15a8a006e07024fbb258274bb5dfc927324b15e33505745511fdf955c720e94f340d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b689def7f17a8390b40a578278754b68
SHA1ea54db6a223027b4280ffa80233f7055fbf02c81
SHA256ddd98589e8d72159395d313a3a1f530126fbda1cef477188ffb7d4c31b73873c
SHA512e6cd5a6aff6ec9171de0fd58692332b0b2d0afa1d855f5e3a694229fb07b957b30adf8478d22a803f24ae653c1cf01a0f7d0ff0b51b5de44db3131628be8973f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56d73bcc65b26fb0844b867fbd9d99719
SHA1c5abdd67ba8f8a34d44e2475cc4b0359948d02b6
SHA2560b91eaa0b11cc05c89e61665709b78d93af81b7e7e861eedcf71c11473224a07
SHA51269fbcb9c2f8fecc68d4ef1b16230d75141fddc809d61b520a812578f83bd8dbd82c4a027220c0fd9920d8ec4a193454259514a31ca47ddee3981c43d5525e699
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c246c4812d8d11a488f7264e564abc31
SHA1e8883ba412af81da248c4ae188f04a8e0613f5ce
SHA256eb13c9da571d0a6f4d7beb38ebc7173a8b3f753533388fb753125f9fe0bf658b
SHA512ee7ae51f4e72068edb01c1dc8542ab3831381cb41585413529f07602f1e6a022275c2c8e1229c4095ee7f0ca04cb77a83eefa975ab01c093a6320286b783edd1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59da561cfaa70f3c9d4af1e9d4b22c2e8
SHA196d33d874d6767f4ebe31b907a327dad69cf6af3
SHA256cb0ec7fb276dd997d6a6906265333c5ea1a1b01c13f8a3ef7e19d2c71ecb074c
SHA512b9a37b07d87df45416fe517980d2e47ddd959a8ae7d131e3bf29038f6487b3e25fbe96d673f5771b91bdc27b092aba0edace21865776ffb71e38083dfbbc0b1d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5612cf9c83a79692577cae350fef19bd5
SHA1a3897a40e0cdc82c3113e3ac74940fca7b018eb2
SHA256688585b8d016af1d689b021fd3cf23238ade33ed96c23c83c0feb601f2baea2d
SHA512bfdd46ec47d106ab4ddda38fd578317093ecf8ccb7c794479df9fb8fb9a2f6987c18c3c726fbb82ea0408c082badda7d991be4fe508a514ef27ed75d017280dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD592341cb4726a005934b101e50d576f0e
SHA1f47d52694cb742de1985e4e836ccbaf7bcd6e647
SHA256d4997c0cff39e05ef355392593f5defbb1f292be11785fea9a40984478c89cc7
SHA512822449d39a1d6005eba8c96bed721c4d6134db48a8efbcd7af01fa821262dfafe160ce07ca1886e81226b8647b2985b07b0cc10ff85256990aeacf877cd6e4b7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD539769efb360d0c5bb6cc245141554026
SHA185972358ea5cc0bc3c46142668b3171f408ef15a
SHA2560cb42f77e7041ee1ecc6c3703a5c2a6a62ee1b668279dc133115ef895dc6d162
SHA512677159b0e775b21c8a5e0c212b8839c271be2f94d3140e07c96bab603748432a590d2763f3613700466d56b60fee24f962c7cb378ad575f94ee8186a383eddc5
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b