Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
27-06-2024 21:08
Static task
static1
Behavioral task
behavioral1
Sample
1788b59dd1747dcf8b67b16bb599d906_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
1788b59dd1747dcf8b67b16bb599d906_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
1788b59dd1747dcf8b67b16bb599d906_JaffaCakes118.html
-
Size
61KB
-
MD5
1788b59dd1747dcf8b67b16bb599d906
-
SHA1
26049f068e99b5b61865f2743cf2bce62024a4c4
-
SHA256
e930487b0a070f6c23a8833d14933c96d5f0d951816422dabec7b06b782cc19b
-
SHA512
46f254bff040b1e52605bd805003f0ce55fcedee5f5ba4af396beb993d1795470eea72ccbbf7199bcc9c0c0f1232dd4ada42a378685110c26031642bdbef6548
-
SSDEEP
768:ngvGB7IQwAX2vULV3JEEhEhRKxdV/w1NCfv4vwf:g87IjShIExlfwe
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000f0c3ccfe5e92904d51d79a52098b057bd8aa63f8b618402725210efa249b85f9000000000e800000000200002000000053acbbf524557dde5f25cc338f30c6be0d2b96699cd921d311264c588a1bbf6090000000b452179c191b2a590e0ccba0a5c3c13bc29f6c4c198c741053c080fbdb3b1eca0ba8a83f12e8df57a8f96ee47939d09b1dca9719526f8929c9ee5b050136a6d343e806779e8a30e30163c7e8f745eb713c6646a64b7a72486fc180af4ff05b336c976b495384a7caad77f8b7e1e532d406bed077f4de435d1f8e796b2863c57b0370d337c64c884e51f1f1debbfb891f40000000e903591d5da4f13be9ea6a4f4372476de51a8e12a9a9613981a77bf72904ef88bde20e4a08f55910606c3400e87c099c4874bdb31713e3f189d880f4fd563659 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425684394" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000b6aacfc0135b51cd174f1e0719210e431005bb40b1c2ddf5315cbfd0284ea2bf000000000e800000000200002000000066a5ddd6a166d7f734dfbdce2f36ad1acbff5354fd506e30b387f5a2abe95e5b200000004c7eeeff7a3c6403318b7ca9c102dde4e70d0435d686ecf8f6a8aed8b6e9cb804000000015b76f59710fc30799363fbca8d965cacaa8402ca55866281f1e016ae4745c0ad60ae4da82d9047c1550fe914decd8f6fe005420ac4d38a97ec6a9613e84f504 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{71BCC451-34C9-11EF-BB21-6AD47596CE83} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30f5fa3bd6c8da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2320 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2320 iexplore.exe 2320 iexplore.exe 2028 IEXPLORE.EXE 2028 IEXPLORE.EXE 2028 IEXPLORE.EXE 2028 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2320 wrote to memory of 2028 2320 iexplore.exe 28 PID 2320 wrote to memory of 2028 2320 iexplore.exe 28 PID 2320 wrote to memory of 2028 2320 iexplore.exe 28 PID 2320 wrote to memory of 2028 2320 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1788b59dd1747dcf8b67b16bb599d906_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2320 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2028
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a1e864e4dc39ef392bc0fb6c86807809
SHA122194c4677609e59ae8b3bd583b313e722cfcce5
SHA256adf15f870b7de078fdc01de64bbdd61cc1cb3e7a86fb664179341e9dd5c9c5ac
SHA5128015edb0f8748cbc3185877ab2cd92cc1e3dcbd95c5a048a34f5ee80e0f28b7fc11ab9ffaac9223142eaa96dbd0df2436ccbf1dba8c0b62be6865c8153722d89
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD541b88986d29ca93154c46dd16208760e
SHA165585e2bc6b1232a34c1b42fa028e11c92e74339
SHA25635756ca4d1922ca7cbb0a7f824201eb1ae72da53c5229c1bf71afcd0ddeb33f9
SHA512ebb8d07b6dd245c9b9a1ce44bbd4bf84988de90dd5a5b166bc288ff43627e34a867f79e3e19e8c05a72def8ea44b7c0dc470bd0ee0df272f938100388e2954e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5946a78aee28004fb4239b17905726da2
SHA1c390ebe7e6718f0706f4c40a3885226f650da212
SHA256228a87a94a3987d0b8936e0c3bfd23e64a36960cd905942cc8a2b08afa7660a9
SHA51209ac683f5241718cd2e634d0819a4179d3df8574262e4300e8e5fdbe53e6a2c6f7f0e8703b08d940d54d92b1dbdbdef7cd452529811b4a4eb202d60ea34dcd9b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a3999e0b4d886bab072b466004a56ecc
SHA14c4fb9e0354cb7e8c748fcdd2ce5f393f4a71ee8
SHA2568c90507d31aa86353c4e3bba23d5795bbaf95d09be7850202c22745526d0aa08
SHA5128e5e378d9a0397b2e8bf41410a56b273e1b9db30284573dd4c3787ec3ab7311aa2110a7036a77f866ab5cc14487c8b7df38a723d7b35493999cf57cd7266a3fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD528044508c3a08489dd9f5c40be3f8dd2
SHA125fcd8622e74fd485a1c90d6f632492c62916942
SHA256378238f3071f2ae0ecff57fe28e17447afc71c22323f6a782ddbf844fb1afd00
SHA512f6623dfaffbc0322e4d981b092aaf786ff772c04692abf823701873659e6c4d1ff154e1ee16878f581cba9604c59c51a52eebeae6f6aa3e14ff665d9b9839246
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5da7fe6c654759d47f259bc655e8f46a8
SHA16c0cbd402738c38bc1b19f259ba487e8aa7f4526
SHA2568d3cb8e4ed01b64df74586d30382de3aea006285b492bfec3d4b39712390620a
SHA512aad389a890e27a27a68bd5638a8d03c1e4954c3e5a007670d2454e23e8c861d54ab2fef8a7ca7486e68b5c72104f4b86c6ad89dd5c895306db015ab7f7808529
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5be14c197a03685af1bfac9769527f7b1
SHA113a62707aff1f8f47f6bdc9905786d72cc21a9f9
SHA2563d4edcdcf373fdde85ddf7a1f72ed2fce3d94013ca59ed6c9a3594c5387b36c1
SHA51268333c5332ea3f433a0489c804c3cc5ec1f5cbbd500e2a02528ebe8d8654cd41c62febcb05d44bdc92663ce6d6abdae6838f94c8c783cbbec9be02c2f25c2777
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dfbf57c09c74231b320a09b7ab8ce4b2
SHA1f11005996e6503375670f816bfd27d1e95da652c
SHA256303f272febadc4062b4d0770d4817abdc203c2af4fae6ae4658db930af3fd27c
SHA512822be474fb000915b74af975d4d3954a296d133c4a570cb3074579247a583f2473d07f85e5343d0f21b74f4f742b434ca4f532bb2881d7ec832d0e2726a22966
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fa184d52c91021b7b40c398e007f6efa
SHA1c906ee7108e8a40746f6406325bad2f4237546e4
SHA2565e4fe08059e448ce63773b3cea29c13b102287e8e68fe0cfe7e7f5b98b80115c
SHA512d61de74d9b298fe8618bba39dc0c805bb3ee35773ba9a1a86ed2930dd1a6ffc2be2b7746291ae0f6d99d08bde43fabdf18b77f98001504481dc85a88011d45b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52f6050bd822154cf44b49b53f1a46cec
SHA187fb914e58ea2eca64c81b015ffd86941146b918
SHA256c1451ac6db7de30d9702b92ae59d2d50a8f864c241afb54ac42a41ceee77f04e
SHA5125f09b5a95cff9fa448bf6ed4b398d4c5121b73bce558d7852cd484b27f536d476ed9579a9bedcd5d86bdf2fbeb0bd12a91725d850790a2ce88b95a35fbb34d9b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cd7fcb70cb31f2beb9f72c917192c240
SHA1c1e6c4dc4b8ffb6c64e4e56d3e048c48e794a26c
SHA256c4a41ffd819ed6bcca59ee956046c0c05f6f4a900b1e55eb0feb931a6389f842
SHA51205fff84863ab4191af9f6d97cae75797d298fa0fca686adb3e187d7be3882ca7cad587e58d6fe7b7a591eb43cdd0a2aa57acccab5133d806f026076eb100dae5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55566a2562479842d7ff8bc820e3db10f
SHA17d4e9fabada93a5796e7e3d150511634be90fa3e
SHA256644bf214aeb7e0db2ee7d265fd333dd130feb42d8de02247f65f5ab5c3804f7c
SHA512aaa5a8eca027d9528b11f169ab2bcc7d2391fb74754e078f6c399cac8089062774ed8597a494f90933bfb4de4ac4d930854e15e2b689a92b8ace41ceb275e7fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53acc5c52f5d6da04842735b4c01447ef
SHA10bb458c357cb9c759ceaec970454b22579712566
SHA25621601595682270b87ea59d70afd9245197e656eff73b815634bb5d2e66e15ddd
SHA5123eaa5f6e2ced0fb9d53e682dd92e5c59edd55be48d3c172ea5d858538466ddc2f5ff82c3da456a68121c813ea7cb54b3291cbf93f18392996814e00a92ae4b96
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD572f12d4bf105897da1f380f5320279d5
SHA103282b7637cf8f7c386f87f7fd9dad3e4afe98e9
SHA256a57de7b733b1c819894012d66b4e43f31f579a00270f9b45ea6ef2e84dc6c218
SHA512a56db8405c5a3fc5d09351464119eba6921e329753d4050b445dbe5a07e96c9eb6be7b71aa4fb210610bae81db621499e3f531776d595f2bb840654c7b4a6f8b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD576bff20b2f9546b96c4a4e8607da71bd
SHA1d18ad08c9332dfb6639abc4fea7e7ed0bb5a0e09
SHA256b68e227764f0afa5d16b69a7ee5737eab6433c3594b46582a18ef35dd4cafe4a
SHA51207312f1ab89814b202d72f6b7e22afc1da673f77735e94aef941cf5411cdb442661a4048c949dc8c1f7ac6d9eeb5526ee7052ec9b022a75e43bd5c908ae1e95b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d885ad67a713131431f5a81e42a6fcc2
SHA1dd2d109ea11c1950ffec7c2e184e15534788d7fa
SHA2566b4e397fe3cce64d1d39effa64b2037f0d5cff3ec9d47b89170a4134ec8ea546
SHA512a9c7afa3ac8a8fb85448aa43fa50904b834359bf839393dec5f5040dbf357ed993f6d4c74dfd89084d28c050c9e11a38a881f6e069f3630b5759e2153b54b42d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5235b8d641251c61a52cc9ce95efdcf3e
SHA1936a6f545095fff14731a3c6067c58efbcd40458
SHA256eba3a22d96c44b25b8d3a5fe1113c3c6d080d117301f6c16326febc2d2c78db2
SHA512af76621aff7fa120ce826c122a1df636d5ef3109a1b01f8175ef49682647ca13d1ebe143a1211d9418bc67235360fd898230b9423fedfe5fd6697989bdd44e60
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d02685987aeeaa2dcfb4bd6bbef545f3
SHA109e934663d0c9202d2a5335e89b8d72a910e0408
SHA256653110f7fe3743d9a256c7a756c6d0c6875f54618f50ea3f04cfc7bed0a9922f
SHA512d1d1ba34edb65954e35e1a9249433453f19807fdd3be1bbae0ebcc3db08e4ecfbf927c4e7e06944791155fa8d9e3145a2a8956ea7b3b752316d3812319fe8e05
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b