Analysis
-
max time kernel
134s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27/06/2024, 18:40
Static task
static1
Behavioral task
behavioral1
Sample
171767cf781a86bcf1e5eda73e85b723_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
171767cf781a86bcf1e5eda73e85b723_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
171767cf781a86bcf1e5eda73e85b723_JaffaCakes118.html
-
Size
10KB
-
MD5
171767cf781a86bcf1e5eda73e85b723
-
SHA1
3d0cb54e740364a8db72b61c6e8ad850ae56bfba
-
SHA256
c483bfe7836c6e5dd283c863bfe2bfa5e73cab79ad7dc688e7258df8710e0498
-
SHA512
da8fac94b80b1f4880d56e02fbedd5d42721943582079a52be4340abba95f40a78f3e1920949d8560cab8cf2c5af4afe52748bd42a33f2402a1b20ec1b7c00f2
-
SSDEEP
96:uzVs+ux7CTLLY1k9o84d12ef7CSTUVGT/krIpfLWN9xzhkdZMVeUWN9xy7lVHcE8:csz7CTAYS/cizwAUVVwQPHb76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 303efa8ac1c8da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B5F1B141-34B4-11EF-A5A1-E299A69EE862} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425675490" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000058f00c469e0fd43857a5cbac4c5bab600000000020000000000106600000001000020000000184654e7062f9c99436f8c79aa2a8135bf1503d81fd94a9f52bf38b3f31fe527000000000e8000000002000020000000b5dc36e0c2da4c309a063a5c084afad5be11390299603950633d1aa6299e10df200000004500341d83b01573c7d153bd9d3ebbb7679ad8dddb12bfd2ce964f4ae1525ab8400000004e73d229cce9636b8e9f0c7ebc121d6cdcf9baad97f5c5fe347de08d30b3a1c7bfdba434e3999c97a66957f20fc74a3c34a6c1c0ea5ea67fda5a260d8d7e0a09 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000058f00c469e0fd43857a5cbac4c5bab600000000020000000000106600000001000020000000120d7809ee9ce0711813252f5c11a6dcbbcd019fc4d5b54c96c7c7edd4bb8efc000000000e8000000002000020000000c61b2772e12d563cc07582ddb7ee9e77193dbd884714f045a573c06e8fc3a64a900000009436d4b828ad29d2365314f2c4c26859790bc85bcba26f28a6e98bdafc35d432bd7aac2d5fbf9191b28ac380df858b52fe7aeb206c1d42ab5c3b216b60648e778cc5af01c2a8dd66b366ffa6ec69519d2eeec298a7c597181715b085d4e60675ddea03ba717a63fec4759c0aa388dc80e117f5701b96b01e89fb07091cec8e12eadcf80f05a1a393a2ec1635217b65a440000000dfe94b9960c30882192de5cfea98e494240326a69e1fce7f4ee7732bdd8224c3caf74bdbf98ed9dde6bed0b279cca4a16a45255d163ffed380c25467b0562479 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2112 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2112 iexplore.exe 2112 iexplore.exe 2748 IEXPLORE.EXE 2748 IEXPLORE.EXE 2748 IEXPLORE.EXE 2748 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2112 wrote to memory of 2748 2112 iexplore.exe 28 PID 2112 wrote to memory of 2748 2112 iexplore.exe 28 PID 2112 wrote to memory of 2748 2112 iexplore.exe 28 PID 2112 wrote to memory of 2748 2112 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\171767cf781a86bcf1e5eda73e85b723_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2112 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2748
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54a96a0a78a30285f167fed6bbf16c261
SHA1fc2677517aba9742ec2662be5828aa988947b123
SHA256a456175d512c5c3deb22cf0d55fa4d6498e8c4391e8ef8d712b830f24cb9b21e
SHA512a1e5ea57e1a168b454a758e3096d0fe91db97c690bbf82e0946761a5b0098a564f7d95415fb1d8756e469e4958b0307406f3d512852c87e176b648eb6d12dcff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54cf62f096bb5e9efd7a9866d9480a70b
SHA140257a55e1ed15ed5806f7261b9d081342c969a2
SHA25693c8e0dcc963431b346eeb4058ffb6d6617fe52f931c5b1dab40b8fd8351df27
SHA51239c43578f604616ca776430d6ed5de3dd263cb65bb0a6392e31dc0c865a83051398283758c8721aef2163f2b50cd7c467f2efffd33bf14c5b1d09e788206d6dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a01ac84a41990ad64fa00429629473fa
SHA181c5a0a71932ef54da915c741516a1d59ddbba1c
SHA25607671e3ac23743e785ab6742cfbcb446be7261891b05c0f6f90c95344d1de16c
SHA51205960b314967e5847c3da06051075aac7a5c970a60d8f9c0a207ef93c415c2b43678f6a3416e7e26a10ab285d75f2aea10cadf4445f69302892ad4b7c2f3b26c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58f3c17484dc4f9ce809ccf87c8177639
SHA1d1d94c4aa53a41fb257a6c67e53c25458f4761d8
SHA2563acc960c6b0fedcac38d888cd2e9579e40690f469275e9932bf9b9a7ca66a759
SHA5125de685135517c4753de23422ed41a3915aac52f364aaad6104b4a0eda3c38cde9dfe12ddcaeacb689c0e17a6ac9b13468c8d952bcdbf88b5037ec25e93861d2f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f1866d15745a8b6c628fe167d3eb324c
SHA19ff22ed156a4014572df399085776f3a8c81e125
SHA2564151b64f4e589f739279eece8fd167bcfe6b9567606ab6b795952850b48518fb
SHA512b2b834801f148232847b04c42d8844105805233ce6254f6dfa5dd7f9c2d7bcc4af8aeba0a761b1a7d0d7154a8139728c1549d029b594fe9ef54b8d2790d1380d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5145cc0e2b30ec2adf1e67d935434351c
SHA125a6ecd44014a1a206fe4e95e432f4825b14a17c
SHA2567e9a8dbe177c613b6f67e76dc6e4e13d7899788242aa55071951bc157d1f9cd7
SHA5127952066c218a43ac2575d35b0805a3170a9611ded95a7122fd9df8568db326d7e24553dd6388ffee1e30496dc08d5ffd104931d2e1733e2be1a9b96f8551efd5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ce78a4e4a2574c836bf93039fe368c42
SHA18770b73934a41e14cfa5e558e29db2450172f52c
SHA2562d1af1492dd8ae89652d92cf99e5fe6ae64eb1492fc7bfac899fe3bfdd35873f
SHA5126337013e1a680d9b3c44f27b996061b584dfe0c384108519c2e354c9cb8e81a7d058ee828e76e7bcc4d11a01a5e7c21598522b34407f2c209189e165b341031a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55091bcfa33a2ffcc7dbb8f41baf381a7
SHA1fd2a00adcb5056c06b84ed6c5f81434dd898c4a9
SHA2564d284a92a9590a3c4fc75646113aae9f105e74c84a510cf1633abf4108228a20
SHA512743e0591476d6cfaa1a086eeca4eaedf7420477455574a8978e0d86c1fc66b304aa961441a357e2297614c42c84c3f5bc998051117852fad6273997e00e91a63
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ddf2ce28fbf407dc1f669e425944438a
SHA14248ef8c5a7ab1c74518c93118e311c87ce7add4
SHA25655900d70fda9fc81b48e3b9815058894041a812cb3898e4ea0d2ee490d0436e6
SHA512ef3849e44ee26d8c40c9ea92df0fbdbddd18a80f469c585f3e2a1c5fdb7a399f8fc62e78a61c3b391b268acfce2f7cc3a16b0ef0c60a6f4db67de0ec2227ec54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57ac9e43c755ba9ca329c4c3e3f4d07cb
SHA1de9241da604439c9d1baade4f5859acc206c338f
SHA2560be3c25757b3af0e0737b71e0cdeab53ce1ee24d82fe2608f2c42fa44707b714
SHA51210ab9f2776497765420a9e7c0e9c5e6b4f2a4c4e25b54263086f24e5b5988a4725b0b3d6363cd1c3f1f6dd04d682fe1ee428afad30cbda43003bc2ebb8f31acd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53d410cf363560680bcb325a1140607ae
SHA1e51aeccc13f3e0048b56411492cac0055ffb3173
SHA25645427715583c19bba126784913b9a7007d82ab1c62a1fea0bb789da398565a3e
SHA512ca9c1c504be92dcac79c5de5e551d087c1dc2e9c76667bfc2c57b542f060780033ce8fdea65381cd7c916346dbf2f10f55bf1b173490b6ed2270355ce4cde70e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD522aebf6e4ff58fc3e124a0a1054269d8
SHA18d15cb53f2706e624caa48ee70aad2a888223619
SHA25669e1d61fa414a9448141ca392a339cbbb35c274e5d14e7e8257277fe8021d937
SHA5127730710195c7ae00e842d8a745033df13bd91db793484877184e358533f7060f374cf87b87a89e2012d441c64cfb980017f39e94097673c20b02da9f84bbcce2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD598f95809ec5a517d2392f055965ee52e
SHA1db1f81339a3e61af905ef3052d173fc898cdeb27
SHA256459adbc74bda0089746cebe0678f035e5f3b774e8e95a994de1b65bcb8b243cd
SHA512ebdf34cc29cd4cb9f8e852ab92262cbb00006a57e711e2e173b5b2b266667809958603c764b417e9d204561e61ae55c94c6e96c5aab2655f3fbb799fbc7038c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eb3afb6cc3c4be858d2c3470f4ea674c
SHA1cf8761aa146eaa5b40abf3d4d675f2bfdc87c466
SHA25672263ca00dd0e6adec8095a1bd5e30c107b107da2f96826a5332d00fe3f705ab
SHA512c9f4129e201340164f37d2be8da171e4c68e2ede73821f06661455e65ff950cd786d0e939ef1a68da89b219b1f1c14fc1cc402a3ed465b1ae20eb89be514531f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5906bd65960e347211c6cf1df6da9b734
SHA10dd1f7ae98a5d565cf2bc4089c48d07b933e33da
SHA2564ebcab953bf0ce2fb6f54800d087aa2cac0c11e35d5a41b38a9350056846876f
SHA5123ff52683e848b666261069c7088d9d7627b42031fd75b1213b007a702479599f6d58b2cb83bc460cd534431f4ef122775197d98ee9bc46f71e94fd5e1516c931
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d011d6a41de4b1fda2fff01f17c1dc93
SHA191cea3b4cda4d96146315edfaa68a7ac96b428b8
SHA256dc1100ad4a9a5121efb16d30c38abb7b6ccd27e14af55ab7caf54a91ecb7139a
SHA512bfd92a0b0d5b555315d97d9341ceea83bba229ccb7f9aff90e42c99c73bb4a191fff33fc0d56048c4ce1e72e9eef96ae070e8de0fad8cb703d992316c648b208
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5588264430611df7f4b992d09dc1565c3
SHA1867372c9427b7a26122eaa777e93285b962a6187
SHA2560e3964bf5e41a9df55cb7916c56b02e6a9455bdb08e5ad9d27dd4807a11294ad
SHA5122fecd59cfcc87d4429d40b86744a5da9c985b4d8984892f4af551346100436abc67a09b6d23b9a51e7b060c519a60a144d9f2310f9e46957ce6c9f6801545471
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b