Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
27/06/2024, 19:01
Static task
static1
Behavioral task
behavioral1
Sample
17298a676248f0b36257144dc49cd3d8_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
17298a676248f0b36257144dc49cd3d8_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
17298a676248f0b36257144dc49cd3d8_JaffaCakes118.html
-
Size
11KB
-
MD5
17298a676248f0b36257144dc49cd3d8
-
SHA1
2ec11e4cf800d91d098d222933e37a12fc6fe7d0
-
SHA256
16a69a77c9ee4f04b319d78f1ecd28c28d1bd9b09b48649259e701f9fe2a1a91
-
SHA512
987b96c9b65617017558ac49108a183b013d2ff1b94a7baf2ee8699c85bdd99d5eb515700b9d1164d4f500c6eca34097711a6267e10cc17430c7890e32884c11
-
SSDEEP
192:2V4lIsr03F28k/w1wvqyiBqxnQviYbk01JauBuLbdU8d:s4lIcuFG/gciBqxnQviYbk0JaguLZ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10d13688c4c8da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000e298a368422551d545433157258ffc4356b889f6349027241e68d33c97d2b16e000000000e80000000020000200000007704d280f8d11d71339ba6c4e5f923362e923cca08fff18ff94f09e7dff9ff4c90000000a3c68c1358de9521f3582fbf4f1593b823d15528827dcf89b5a238e0912a288c06440170b83adf71ac85999b42884042384d68da74003a881fdda1152fdc8e5294e08b9bd04086f6c5dd8ad42cc60c467f100081737bc1729093e82f772cdda0a478e440062367c0bf8cfd608997ba0c225a92cbdc0644f1c44df6007f24e00ae0e190f4d4d3af2695d4478125ed7bbf400000008f6be4193d71fae0884019fba9d44d304cf3be018f3c6e116f9c7cc6dec6c92de732ef7524c8e1dbbb503c00964592c2bad4e7d5d76591e69cb3d4e0d5edab65 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A62BE9D1-34B7-11EF-B04F-52AF0AAB4D51} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425676752" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e93610000000002000000000010660000000100002000000032fee8ceba1298443fb497fdbd92263a4dbc81152e2dbacb65c67aaf71791dee000000000e800000000200002000000017a8341e2e3e0332c6443e30adc3ba88921ece06f529c6a44221999bcc0e95d3200000006b1bfa50fb82505b2324ae04185974826720b0680d2c8402fdfe5dd6dff3e8fd40000000520edd204e4e2839da6aa7a885831724590b276566a333a049dbd356e41704df19a2f77dc426f1b5af6b279ac0ed6f0253cab1d80080c6365aff85d4e9f866b1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1844 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1844 iexplore.exe 1844 iexplore.exe 2980 IEXPLORE.EXE 2980 IEXPLORE.EXE 2980 IEXPLORE.EXE 2980 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1844 wrote to memory of 2980 1844 iexplore.exe 28 PID 1844 wrote to memory of 2980 1844 iexplore.exe 28 PID 1844 wrote to memory of 2980 1844 iexplore.exe 28 PID 1844 wrote to memory of 2980 1844 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\17298a676248f0b36257144dc49cd3d8_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1844 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2980
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ca67cdf489d0caae2411c09c330b0ffb
SHA195097dc792380b38b445a13ff344ec5c3b44ce23
SHA256b1c770e98adf82dfd1e00a5f59bd28130b89fc244e3e46e036c80c3d668b4f49
SHA5122554b5f1d70398cce7c20c0dd13bdc4298dceafd00e21b1433512dbf13bef05855c0d329268b2961af18e78c2072c6c2ace343193212575b3b6e768503dab750
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5231340ce8b656b6646af6cb7ef5aeb4a
SHA1fcf2aefdd92388752bbabb89c9befa28f6934c21
SHA256bdca06421f370d38033300b423dd2b0d64136c33afe1087b69881313c8c1dfe0
SHA512dd98984cd2c5cc11a10b24135a4942685dfb54229618cf7208c0c207d1f5f6c10935f79f3e7f28e1dfc5bb50475e13d1cce373ed9a958104aad4b9f5a1e9d8c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55c68aa94907dfe89255b090526cdaf47
SHA125fc241a7932ec1f9d6f798976495cd23a7e4e0c
SHA256d68f2192159f8d3265712eaa9efd8ce59cad9ffdf8870b10d3aee34c1457462b
SHA512c80cd01309b41ea42ac1e458990788e1de822d55d9896808a49cad3dbfd128a3d6b41042d981d749c945f9d1f1363917dba24808dac95a37da62950604e0494f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f7c25a6b531d2edccb3726ec6a0cc870
SHA10866b75ec76f3f2510b9d18310d57b32127fd4c8
SHA256ad0bc4e55bacde8fa9867b254795167ba5911149e47a1910ef9a2cfe89abe479
SHA512d957e2c4e33c05a0cb4ca4372be70f43eef5a6a78104dbd1de167f3d651837a0f5804119f04e9b603748e165f3ce2a0bce9e5f48f4f8a02f82de89b15c3ff7c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53fcfbbc361674df3da620615197f098e
SHA12c001d8cf7a69a302bffc2dfea346639c32ba441
SHA256cc9826206ad0a57451b5bc8bd4c6b108927880d7bc85e869ef440de139386638
SHA51259b03556ba112c37ea2650902d133a02c358e9f9b5122bb04f04ec0da93ea9f3ea709d3f3e260b501859cc282d9c2f5bc6d39d49b8996f69cbb3d2890449fab4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD518356fb7ff12cb6f34e404e35d8e72ac
SHA12147b9ff5d580bc9204fb49add11fdc0789c01db
SHA256c0c1fce77ffb0aa4c7440806073e6821456c7ee244cfd747eee95631f2a40adc
SHA512c550683cad0cca7374b8e341d64bb11960dde956668cc947ff5cba0ff7a50699afcfec2ff47c992d3fe7e92d0f9c0827707d043827e14f40c35a4107e8cad699
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b9cc451efe49583e2d108d2da27a25b5
SHA1d8f2b0a6e229e73cdac5e32313f88a6ae6c72128
SHA256062055dccdc91c524c09185b3e25c2303eeba0a34a93cfe1f25ccba3a8c73089
SHA5125db322a5840a31d84b02e28781dca7bd375dcd1fb7e80f243c60e7e952649b1136ed49d4506bca1f23e76fec788fd836c79616c77a95c6499591829e5e9b4c9b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD532e25e6c7910d43e99d4a20add6f8c12
SHA115383b2eae6338169b8c48a8c9e34ff3ed01acd3
SHA256669167d4f6df00dbbe24ae9a3aa8a87b985b508744f70fa43f3e0db378f9f698
SHA5127d84003d5046fd99fa985ba3b3fdf5dae204a3781fc0433823778c5a29171df22d61b54ed343c2eac8e8d8d959fb9cf207bae783ee25c2d261c41582bd4449aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD584676f6e5c7a317b84b34fe0e9d70d8b
SHA159df1859974da492fca8bb6404f2812c96556ba3
SHA2563e2af1710d68ffac67ca0e6da2da1755070774ee997cfe03bcd27d8c3d39ca1c
SHA512a22da1631481fe6a3c5a729667db29c8550c30edb30d3ee9b218de08658fd3f8e788e5632d297a4af80c496c74893bc0bad609894e3c463df8c9fa38b2039475
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f4eea0076e8e2aedf61f388c097c6488
SHA195434dfa1a7f1e0230f97f5fcad5bee8a1084689
SHA2565aaf12c5a40bead1ee61bf04ddba81beb19f064050e05ede9dead98b5eb18e9f
SHA5122c130e38818a2339b8f2f295aa21983cf3665ec08a436387c49b0d361cef24829ff045a5e51fdff467c1fa00bea1d0b3df5ca3d167e490477b958d10770f2d61
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5610d897e00cc658f31463f3ee97bee9e
SHA1fefb3e2c8bcd47acda217f07391f988dcbe31dec
SHA25622f81b04164138bd9b43f6a8d1c825cdf35549d90f34002caca7e224d3497529
SHA512a6d578af9e150473045d8929f9102fceb5eba4c15a0a7c3195409a00c53f5cc7a02b35343a3683762c9f36e23850dc2c748252d1ac43b055f2ee52b6f632cc2c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54228b35f7825630c68d8c589eaf8b2d3
SHA16674e40d0f740f21ad1ae311efb3dbd67f6506b4
SHA256f15ce48d73ee346e2cbdc6a1966a21263a3bbc1094569a445b59878fcea7a948
SHA51240eab2b473dfa5681215355056913406744691433e197f931808032a8e626bc5c8453f9d51250602b4181231dce0aa4c259813327479a4efba32871fff26890b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54896bd2d53ac6eaafe89b82271895dec
SHA1b2e452affd1bda2e5775725f9294f60d75c12f1f
SHA256aed9c4e5400b005b48279fcf4fa2767e66f34ec85a748afd148fe7e6c863046f
SHA5126b60f4d87978d9395edee7d31a766d6962d4d3d325cc720bb3d1c2c632211fb305e5757c8d7d16643544ff2b83946e658d2ba31fa60b3e0f6ddff7c7bf60f462
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD560f7b1d801ff619eccb49342c0130339
SHA11d4fe0f1de3465f754429a171fcc446c245aff3e
SHA256bd164b4cf6e01db41f4956a87f8c9228643663f0d7f910909b245b77d61fb54c
SHA51282bda5397306418b7de6aa008df8c667b1485936e51b70845cb296d6d60faf29cb40543fc3430d2533ac3ace1ee8ac25e789548d58c6c819291180ed5780fefa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59fc8beb3713eaff0fc91d0a7ea661ab7
SHA11f342bf56f3c798d304c8066321a6f9d47a7b07f
SHA25650d20744662975dc04c162e7e9165f5b9eb5c0a81cef982b0b626750d06a5f44
SHA512594e27d54a5c0ed813dc91d1f590f3f72278ef965683fbd31939027c9e968d5f4c047d24fa3700e531876d1c1c143e30201ed9d8b3859f617ec4b1ebc0675b2d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53b3d6a3846fe6697f1c70e39353d65ee
SHA177d0ab51e25793ae1fb148971a5af7e256ba5e36
SHA2564d29469fb6aedf32fb1baa6021a91c452721255d160e2e7ea64f0b337d507f7d
SHA5122992a9866a62bd948dca3a840d53d657e8af67af322a382bf673038a0f9e368ddbeedb929402a35278bbfc3caddecf568e5fef75eb0d70c45dae1d6e429bb697
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD519f17dc595c8f358eb7628e6310867d0
SHA15b94d3b986023ac92917d3cc8874c9a1a8fdd3b4
SHA2568a9fe8d2f558b711e9ba5309e06e8217cbf94c51743fac7158dc58fd53770979
SHA512596746d718fe7684b6cae5a85a14c373752bb6903c33a27775bd99c9dd5747ef0817b662bc9fcb9d9d0eb7d991e0be9560daad2101ed1b344cb0b1ca734fbd0e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD511e823fdd039bfe38d5aa57ee6eae298
SHA142f1159159e607bfc4bd74a1fcf13c4a454de6b3
SHA256a0558fbdd27e2cbf45479916a09794863ce1e7f8450ca2c05eb478296dc37d83
SHA5121c18857128d19f43289bc76c46101871d6da7a85aff213d5d28a95130321605e5f3a91f0b98bfdcbb36a556aeb5ca50d6d4bd26b07196d07a373f17b8dfd2ace
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b