Analysis
-
max time kernel
134s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
04/07/2024, 18:09
Static task
static1
Behavioral task
behavioral1
Sample
25bc824385e42b85be0cc2a51190fb6e_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
25bc824385e42b85be0cc2a51190fb6e_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
25bc824385e42b85be0cc2a51190fb6e_JaffaCakes118.html
-
Size
51KB
-
MD5
25bc824385e42b85be0cc2a51190fb6e
-
SHA1
a06275e1f515b5998c960c8d8ec2c50d3ad6881a
-
SHA256
8605e35f87fe1042eb9bcdee55ab5dd91a57b1c6515824e849d91c24d62d1b2d
-
SHA512
c55d9be48981b55c401e698e2b1bbb46aaf9787bfdf1f03bae114f25f18c1236b1f93778ba480cbb682b21dd1129b89ab842a986d48ee3cb53aa88032f6525b0
-
SSDEEP
384:qr1C8ldpEt/e6vSjkx0SfoaluApuntcvd6v+SWkaS0ajf78cVHDMu0ncTw07x9CJ:qB3xAcq7hn+7wuVzMM6
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CBE071E1-3A30-11EF-AD30-660F20EB2E2E} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 207129a33dceda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082338f2b06517e408606279838b4cd05000000000200000000001066000000010000200000007a68ed9d206997c57badc11361e28a89a83fca6fc09ba292f4feacc15413b24f000000000e8000000002000020000000a30b0cabd714710a5914eea1d1c38648e1150bf21d33ddc11075f2f56776b4d5900000004db523f246974434dd5f6fcb4a37bf7e34c4403701f2d49066a8b2dd5244d7dc7dfe50f2dc1e3a6407e6ca59598978456f25b4a0324f3df0417d908f3d62b8fb4cf4c6f055f7096a79b916a0fdfe9ddcfd8c87ab64eb72e688694c83b5afc3454481e94e31856746cacc5410d5c04c408eeaa72d0ca43be1a88623a60cad857834c14bd325a73b37635b54604cc81b01400000004ad894b8d2b02a0d8e6c6877fe3db338f712f72c5c762bf113ac2b37f95edd0c72ef41701e7472f7b43471de0ec00968301260697211f9c0b139070a0433b4c4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426278540" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082338f2b06517e408606279838b4cd05000000000200000000001066000000010000200000005442b611a8b2dfe86fa5cbc2c88f202d6e9f68e2f2a82eedff6c14bcc57970c3000000000e8000000002000020000000c6c7835962d21217442d343a7fcc3309ff951b1b3d030ee6228db2bec043454320000000fcc62de5822349e6751129b234b1eaea8fe9da87b10bf79aa54b4ae19918932b400000003d1e86b8f7d79476c65705c96b4b25ac85aa70b6243676e24e358690863ea878820eaadef74f69a75af19d55d43731f3833990de620c466d4708c4727ac145c6 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2088 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2088 iexplore.exe 2088 iexplore.exe 2080 IEXPLORE.EXE 2080 IEXPLORE.EXE 2080 IEXPLORE.EXE 2080 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2088 wrote to memory of 2080 2088 iexplore.exe 28 PID 2088 wrote to memory of 2080 2088 iexplore.exe 28 PID 2088 wrote to memory of 2080 2088 iexplore.exe 28 PID 2088 wrote to memory of 2080 2088 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\25bc824385e42b85be0cc2a51190fb6e_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2088 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2080
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52731cb85a24979b18f5af5a1304392fa
SHA1b4de85c45e3025e1b016cde4e703a6b640ef006e
SHA256c37bdd89f0574c8d3e49f8567087c777581abd33a0e41ba4b2396645b5f00bbb
SHA5128c315f2608047492e9c602d3916a7524bfaa69b945dc8ddd2d85442f711808ab4b2757f2ca13d53f36f1715ecbf673344e61d87832f5ff9432474bfe8d3d870a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d8480335c257da874c10da9d90ad6622
SHA1b6488fdf4b29b4026fff3715db6def4f0695483f
SHA25637d785d610e04565b35288b744e80a9ae2cc62cf2766b8f56e526a19145da522
SHA512fcdacce75968aed63df815d073339a7646e7e5d41c4d9bb618dd7879c7d3986ca1f18c1d9a684526b55c104163b1efe6d449d88706448cc43ad74f7ade37de4b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5457609a8101cbde1c593e24ff13a6362
SHA1a99ef274e18576e13f8276e3f8553ddb2f22a0e4
SHA256f3988be2224c870889c12b381a951fcf976fcbf18f2fdc1d43cf68cb4af90407
SHA5121485a71dc7c0a9cbf2c30b1094cc5a864d66b6428d0acbfd2053fc24bef7507b39c2653e2f28d022f8813967f7ce71b4d7f830af9a6f6b4bfee03d9a6fb1cd80
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD562cef894413a58f5da912e0c26dde723
SHA1137d736eff709227710602e622ef2761642b56f7
SHA2568803b507b3e24b31e582c5c7dd429671a7b2c57dfc294fe2e508756613dbefd1
SHA51200f5fd492f120d84926931a80c9067d5da503426cfb626fa41faf2313e328069aaf544f86549cfaa986f217e9acb253fd6cd0d6592bec0fff4d0e42236140344
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d93738f1fa6227072106d88b40332b5c
SHA114ce91eb471602f0e3467b9bff2f2390c088b953
SHA2563f5ea291e920f9218259abf2dce0e5ceb36a625753f7225fb7cebd0d8c896c67
SHA5123d6614140beecb5074ff9ee5da1c7140dff9b9672543691124115a5f6066827c578a4b3156376d3ae451b6bfb358022fb3b2fb86c5bfc343d25007f6f7711755
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54d95429738e9764eef6e5aace5c93360
SHA1851a1e81032651ae0f86ef9c6936acb7c17a64ae
SHA256e4e66b523df7ff225912027df1e180da27e5518d5fc4dacb01f2ee37c2f800db
SHA512304647e61d6386da4cc3354298bf5720ea14d26e8118c84c3e76f393b410c2d69d9b425e3c9c7f5480e9497eae5e2767c9e5db9b6e791a8ffd7594e5ffb849e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD550fe4c97880a4804664d26885aa9bf34
SHA1a6d4d679083709e938c260517144637e223bbf80
SHA256593d345e95a3e38b4690e9331cbfb74549621fc246943b5972ee4cf17cee9e1d
SHA512b2467cb53e827b7eeacab1c5ba8806700a95c8cdcb9acc59b322320421a658b6819c5b0070e5d36a7040503b69d2a9b24d6aac84f65ffb27b32a600507182da1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD522600c9f180a45c600fee8ae0bf73dd8
SHA12d1bfd83290cabb2b48901dc37834f7eaa51efb6
SHA2569e38d5c661a636191071f45c76b421d89777bf0ff80357531f6356b2a4cba167
SHA512c6a8c4c92d0ef3c90152cbea8228b4ad91a76a4fc6d7459878f8e3c956bae7c7f436055104e4b98411861024f1415e1ad06b7aaf13edef2197b640ce7a795b7b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b1d6d01b03bb0114240a79adad837bf3
SHA13450ea9cabbb64f3c96204edb72a1a0cfcefa721
SHA256d59270fd8ab9aa321399e0fcf7257ed9197a9ee9463eb548015ea313997402b8
SHA51283f468194c76256bf9d0046ee266b0cb957d03cd56f12c1c63e348a574461cf6b43eaae71326d405166655f76df4ca37ffea6163bd682282d243beabbb0f553f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d062feaee9a1570ad56f0f720659e4df
SHA16e0aec62e8d6caaa7653bd2f37e288dcbf5b0bdc
SHA25656df1ceb2a17b18571f31bf5a78aa2a39d1077d0fc0742768f287aecec0fb495
SHA5120ede9785bfe707c699f172ac64026fa4bca84b102c398546f13f6808cf2831f1c1076b6da88648afadb5aeb3653d33906adf2130dac1dc7bc9064fccb2433099
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dfa26e0f26d821abca9f8372d0685195
SHA1842294148de50f9e770113ecff84a7a87a646db2
SHA256979f2e8bff5b2389727d1a5b6990f32211adc0afef11f9752cc34d67dc16f6dc
SHA512b44f81784db77038994211ce4c249f7cb1ae1adb31241f7f3267b30d4faba10293e7647b73fcef762f7a3588242569bead9c19c9c7f81df38aabd8daaeda4c3b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50aec8bd6dd193351004af5f028d84619
SHA14df71b8a12d19057776767dc5b04f9601046d5e6
SHA25613f45b65d89b6cbe00e453c9f08658f494e7328ce17c868b98dc905863e6b73b
SHA51234ff2d961b61aef3275c9e3da29293e2aa6e632b9f5313c42e68f0f9ca2ca3d38add95ac681d1778b92ce76fc24cb2501f13f399cf0968611bd563b710d6e485
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e3b21c52a6afd52c13d845877f4a40b5
SHA11cc86dacfaec00b5ce4e45ee24955741f2369dbf
SHA2560eb5a3d097da8fbdd30581f8fc9fde048e135dc733758fb397a99fc2f5ef4dcf
SHA512f4c9eaece40f6b0a2b8413209f31d9217d20de075b524f9f449ac647679025f3e3e5dda3be48a8db961dd4c285a7f3c9a1f0c4745c200167a66c5f7035f18f51
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD557972a086f7b24a35fd59115b916963d
SHA1bbd5e6018d802ccc4e2ae0c7a960e8be076bbd3d
SHA2565ae920da399d5b70b7896f186b7fbfd2a2b53cbfde7dd1b020b75e4a4c896256
SHA51282e9e46f531d87ef7427f2d8947f138590ac286081757812bbf71cbf57d0b96c1ed498b3a20ea33e522e58cfed5a22827e7308f0000f568b0e82a88e731a4fa7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53bb3a4970df5a91e213cca83d1959fb6
SHA18b026a4752b8925d57b1955638a5435992140415
SHA256594875f426c1dabe58c18bc5b117b032b0ea3a9aec6c5b6c2883e87f5f7a8c8b
SHA5125c7edd66a66c32c550d2074faeae10b411b4e2c71b3139f2134d1ff6271a558e9df4216a1c486a45f5c068fc5e59aad06a82a633fd40da018613901ec62c400a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52f8b994d0dd6b9de1dd1156246e63197
SHA1da089d89d1226d416ed0c47ff6f83c1d12a1cdea
SHA2561c05632838550cdb127ff5688210fa2aafe57b429118b3ee9ebfdcb65c9fb957
SHA512a65ad08c3c24e38c2bc47686aa4f76cda2400cdad8e3ae4eb001ab47b66f3744595a2f8ad8a6c542f2eb02d6b07fc192e0311dc0c3cdb4ea19b4058e8db39800
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b45f1ced82f374491814a017dfae136c
SHA10a5faf05659e84511febe78a76c795def6d06546
SHA2562b837b3a136b1d85dbc9b93bd803ae370ad363f019655013fd3f7c4ec04b3366
SHA512643e6db4439e3b04045ea094e5410002bcbf2f6acc650fe18b99d87c256aac6fc7ae8d2e9843261428cc2f930727a13e543f8937a2eae7645305af564922210e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54b19d2a685ecf71bf2cd80f03c05cdfc
SHA189046289e372202c31ba969b94c62a58558d4ef8
SHA256236879bc4fa471ba44c574d910ea5bbb0323692db8384118fe7b74301a2f3f71
SHA512bf8e29ee12f0f586755453d4bd701d02d193658393d9f1c6efd8d88667229d14f26920868d3e718e7cc77b800af076c20f39ea112ac1c2127000ffe6c7966972
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b