Analysis
-
max time kernel
119s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
01/07/2024, 09:20
Static task
static1
Behavioral task
behavioral1
Sample
1abf14ead75ea9598349ceed32a8d355_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
1abf14ead75ea9598349ceed32a8d355_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
1abf14ead75ea9598349ceed32a8d355_JaffaCakes118.html
-
Size
6KB
-
MD5
1abf14ead75ea9598349ceed32a8d355
-
SHA1
c96710ecc6178bc63975209c36bcf11e3fc98ea5
-
SHA256
1c5fb72efdcd080c29301261b93dc8b4644a23c9c21f697e61be954f557b4c70
-
SHA512
f0cfc415599ffb99d7fc4fd1c05e88f2d5a93e168131cd2a27b881941e33a0dce82ce1ae113c1f0221aebf7c60c6ad2952cd35817ff4480942c341ab3306d306
-
SSDEEP
96:uzVs+ux7+rlLLY1k9o84d12ef7CSTUiocEZ7ru7f:csz7WlAYS/Ab76f
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4E2F5F61-378B-11EF-B267-DE271FC37611} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425987560" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a03905000000000200000000001066000000010000200000001a8058fe14d25708fc856920c40d538f12f9e5e13c2d658157fbd283187645cf000000000e8000000002000020000000abee2e432807c08d40979e6c2a4dfa95bceb056ca6bb5ed01cc47c7f2a1a20cf200000005cc53ccf7c7877233fa12befb156a8bb175e5a6c2417eda7abf206bce6ee866e40000000edd1a3ac0ca33e17e75548e5fa6ae7f68e4110a148d88477d70bff43945a5cd17e95411abca835d133867bd97ede4d3e9a85c996701051a1c7371b7aa4f6b4d8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0ad372398cbda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a03905000000000200000000001066000000010000200000006fd8968f7a83902591743ccbb515b7068c412f99caa8aec2898228d52400796a000000000e8000000002000020000000b32e5cf5e5ebeed0ddb90d2b87791d33d0aefc80c5d4c1f30e5bd7c90d6596f4900000007081ac891280b150c1dfc57ba51e863186474ea237f75f72874713910b3cd2226b968e254838e0e1abe72c225578b3a41edf08263cb1181bc285aa7b47ececfd65767a62764f8c2f3e101f202e5c9c4404105c8a5b26bb2605d4a84f08c92388dab1733cf2fa3ea18400619e5a6b406912b55d7ed5c8b1c0f8746e3abb433d1d1acf07a82bd6af348c19f43d5d62901c4000000043efd16dd928fbd07a536c76045afd24da50fa85607793ed1ee9011c0db949f2c2bdf1ae9aa62cb913fc67171ca940ee760e4d281430cac1ecca45101694daca iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2000 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2000 iexplore.exe 2000 iexplore.exe 2188 IEXPLORE.EXE 2188 IEXPLORE.EXE 2188 IEXPLORE.EXE 2188 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2000 wrote to memory of 2188 2000 iexplore.exe 28 PID 2000 wrote to memory of 2188 2000 iexplore.exe 28 PID 2000 wrote to memory of 2188 2000 iexplore.exe 28 PID 2000 wrote to memory of 2188 2000 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1abf14ead75ea9598349ceed32a8d355_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2000 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2188
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD564ca9ccdd9f64c29dc8a8974dbcd4e41
SHA1dd76c44efc7cfefa2a359598fb9b6a2baa7125c7
SHA256b90e437f4998375b135b7c1644712b06d0ac0205e8168b099b4c8d6f6f69527e
SHA512d38f27b709b6ad3eb434b3cdf9d1f7dbb039e3a009805cb2089b36fe64c92654df01fec4a1f51ccf9873acf627b51da12309805ef31d948f28f71d8de6bb0171
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c86695aa5dd48815ece4a0742dbbe5a8
SHA17a64e77d69f31f8f9be3cc2b59486b5d1428145b
SHA25679a0ceee074fe6c1be0f081fa8076e4444ba0d27f8f1b6ba72219a966401d479
SHA5120abb16f6e9444537268effb89b5533abcc8c0a6177cf820f9276d5b44c90b7a8e438a8ee0c50a8ffba7cc1a8f8d19cde2827ab429e9fd050046dd1b5245967ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57b111ca389f2b99579e4ddca00f6933f
SHA12a14a623449c7cf2bfb797d35b5cb5da2212be77
SHA25693fa47ba8fa5051161de5b093736db4f3ffe669a3c71a92c3024224cf76f2eca
SHA512b22f28107a63068d97f86af1ae69bca65c130a816bf9d1fefcd485e5e1dacae1171f8d29a54551acbd5ce8c206de4a20f566bda2e5c15ed689858af38ecb158e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54560ec81377b65826796bb81426bf522
SHA173f36e4ea44990d52672b31de2849582f47469cb
SHA256f346acc6871f3fb74daf8d26f0c6527eb397b4638754e0a00756db26961f2b60
SHA512177063bc9d4af2c06c9afc2b049b648bbbb61f4c38e3a4f0448798ff9703ef01fa3f59c120bd49f3530ce31ad470f6761b53e5a4d0755c17ccc06bf60cf34ee6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD512d71efd311fc7d4de3a19441bf29ef3
SHA1b08dbb08e601a00dd958375db44635252e580667
SHA25636f71e1e7420ae9196f9e7d10009535da1a63753cb05a62f115242a333b6cd4e
SHA5126a9d18d0466e0eaa1352b67ecd144188e4c120c248932083445987ccf7cf514b757ddc43570fcc7155da10ab74efcf4f05fddf9ca7e5eb14cd001f5d96b1d253
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD595850fd637a35f81ea92738869431024
SHA1b7de0300e4a61509e255270fbe7ea69e93599231
SHA256ce6cfcfdd8289a2bc19c9388134bfd68281e95c5dd5c4eb5abc68abbe88206fd
SHA512291eede376065d793613a5615647c7e2a8d383189afc50a1c033f5547c0f315739a3b6dee5ad9c9d8e283d07d919f46ec090bafe92aa509a8da910bc2929754a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5449da44ba4330907acd5ed39d907dc89
SHA15bf92eecb34a9acb73300d9301084678805120bc
SHA2569c52f23d30f4d33ca89e6c7e4bb8a7cf050aa8664f0bf97c94b79f7eed481e66
SHA512ff6eb980fccdf42f5cb3d0b35a7cdc357539f4e9e269d05b7e89afad8ffa3ec2fae4722ae1a953c211f4420a92931ec2a7fd42a38696d2e7670838ed5b5ee340
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d28ffa547a274f86b9d09889d66e5cd5
SHA169277344a297e7bcd1c514f9ea5dafa8b51b73ac
SHA256f0fd34ae2aadff44b693eb8957bb734344ebe36601ad5fcbcc9f19f39b950b73
SHA51230c218b6f59f636bc30c0936602381180c602a47a2f2b402189899a6582c82ada8b732fdcb6fe1c215cf748a2803d84e5c163ae33db40fc1e71d580da79f892c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5756d7432553f0723be0b9da4f799a644
SHA10de2078ab062bb4cee7ba845269af8456531e804
SHA2562c295405cff81c34d4ec3cd50f401cfa7326e516bce640fe12fd0f475ad4ad37
SHA5124776f1b25bb0c997037af917ef8e70540282ed7f3d246e5bdf2325f9a90982289517a89d2808ea2fda55863197aacbb68e51129d9b4ef931c518e4326c6f695a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cd19ae96f0094b144a823437ebf82597
SHA1efc543c0ba0874fe9d2b5fb22c51a5b9f23805a0
SHA256ef4fd92c1589c918fdfcc447ad1007a5f06ab78b47ac1d4457720e552a944c69
SHA5127dbfdda07b601516892839ba51861e6c9a5e0b62ad2965b5270685cbe38d77945329dc91a005e1481dc65a011ea3d47d4ae02780af11abd15d1f7ac6a7fc47fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5671da458a936c651201047d33dfba18e
SHA1cd5f8969cec287db196654d3e46c340508494371
SHA256957439f5594074d6ddb2cd6fb89a5dd704b4b6a252645f2bc3928d869684bedf
SHA512839518219879cd4c7d4024c8cea413d1c0294d418c9c5dffbd33d274063aceb4c263682f7a4cb83f819ade5a93ca4e69d6dc55aca4d775e40028236c15919334
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5207021ed4c3f4e6cc945bb120ef0519a
SHA1aac458be5adf8c5adbd74669dc1392f70c503508
SHA2569e9176a5a5c9000e558be2b341e561ddae6106e9aeabcdba1caf41033feceabe
SHA5128924a99ceaf2f7e3a29ac27abcfa0808adaecf7ca7a2740e22ddced802f07f705018de5e9417b5c90b5c98f977746b6a458e8462ed65d23c18670afec2699558
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58ead9d152f9894f95707ddde49c3df9a
SHA13cb33caf50b26dd9f769c21f3fc38e709f02c34c
SHA2568b8138963818ac73ff68abe19afdbe641d9de0e39fccc03054e40358131897d4
SHA512e11b42d5e82e4acbe046b8279fef1a6c7799e2fd9c47d78dc7819cd2404d6cdc29000b2cca207db3a0a47548846220ccfcf91113aa7a77a6e4eed546b6c2fa37
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD518d35b4c82a466011b7353b16bac506e
SHA1c3d7a4c443b52cf01bb624aa56439094a82f0a66
SHA256a7a2ae9011ea404eaf4c70d276a73ae1a48982bc3798db7f23c3df702f3754c3
SHA512078b830bd747aa1169bd127250ed5998b3d6fd673a52aee91325d72756f3e9e6f07501a5bec2e2929bdcc03e770f3ddbe7efff6caa4230c89a2522b5e85d213e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c901148ae220dd53d7e2a9bd9e164f0d
SHA13fbac6198f2e95adb4a3c003ff3575a72d48ed1e
SHA256ff7a28611625fa6088321f5874fd87e34a8da3cab878ce9e6f55b836f90d2a9f
SHA512fd312181198dd014e4bcd441c4c1e93dd3ca5b72604981868f0c1ce232147e25e1b82bdaeb58243c2b1dab2234973d56d9eadbd0b5c191a76960037b7225fba0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD596a564e7f3af4661f1c3721e706a71e4
SHA1e065be50a3e53931e06d6eabd7c6b8096bb37586
SHA256f794e669715500cfb9e0164c6013b520dd53a1b7a1840d058e957527be023b03
SHA512fb22827e952e6b65ea04e72081df9df82b5b6d262cf424cce44028b29b4cccac41d7af0bb35fcb1deced3bba56ab79505c8975489a6547bc75e9e21d2a94755a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54a37b4da47ee59300cf86c490de740bf
SHA1b8fa362e125e48e7642520425602b8f2f4b1bd37
SHA256704cbdec2f574692a98f204210c4ae0133dbfd99b8ef0aade9e5f584b510bb82
SHA512846ddb61348a7232b50f330e7d244ce99a3e2b805026d3a0426fc8ed3f6b896c730784313bec9fd67802c426a184db12d57e763dceb51b34c2f2c3c8f0ed23e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD583915262963aceb60823b02b2b58daa3
SHA149672978e18c1598b08344a41a44563ccd806876
SHA256da6689b6e78096866737d9f2f1c2d5ed00882aff6834f7f2d5082556d1656f01
SHA512f922a2028628965e8505ddff6a8e316f070cf33b23a62f087c577b295b280c7c8433f4101b1741f0c60f754de79bf7ef6c484559b5d151b360fe3da0ef9b96d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5068b7ebcf55b998c30ee64a1b3bda7a8
SHA197d80855321aa5c6584a9f4dc074a540a0dc02fb
SHA25688f2d8205a7395f38fc18cd82c227e01176ad4bf0e6bf1b854b94e2a9bd0c6d5
SHA512053ab057c875ccc236266be876b17ac89ed33889a18b9d1358dbafd1cf264724f96cb2e2acc61514004007f57f779476ba158ff0dd6fac525ae87cbc6255720d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b