Analysis
-
max time kernel
139s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
04/07/2024, 18:44
Static task
static1
Behavioral task
behavioral1
Sample
25d88c0809b874f6d6797a11c5a267db_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
25d88c0809b874f6d6797a11c5a267db_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
25d88c0809b874f6d6797a11c5a267db_JaffaCakes118.html
-
Size
26KB
-
MD5
25d88c0809b874f6d6797a11c5a267db
-
SHA1
40c89d261687fcb217756af6cda2e3620cd95853
-
SHA256
d8db09a56623314b2423eb820608cc236becfd7399abed8ee984548e40b22fc4
-
SHA512
c202b0ae21ba2f4d65be4c1813ff4797278555e921c99c5f20d3132a7898468c604daadeb8e8cf41f64d7697899797dfd2653bed9af20bc50af6db2a3f0395f8
-
SSDEEP
384:4+QfPFd9QZBC7mOdMoGBKfpC5IgSnbmFe7Acox6XKkJvAgo0itA+Pd:Zcd9QZBC7mOdMoDpC5I9nC4VIP0itVPd
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6DE75EA1-3A35-11EF-9D87-62EADBC3072C} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb81000000000200000000001066000000010000200000003cbe630c2c0e616f004cd72ae35767c500f4c57d6962c99acffd7189fdbdde5d000000000e80000000020000200000000a1a991aaeb3b06395d115f0e61c88a194b726f53e337c0189a6967bbb3d27fe900000004d8504810753e7352bbac717626a56effa2c8b1b78cc3fbcf4bbcaa1aed5600c3efedbaa3628c9562c3bcf65685c680e48fc60cdc05fb6657dc2ed3b7c626fbcfa68b456cb09ca316c9d7dc3386d060a9f80f492bb6134f591b6229375bc7282618a159894bf5c867950654f1b22bc43ec01fda43acdb5bd5684d1263e7ec2da011993f5a0b15ac4bd0452ddcfbab81740000000eeddc20f6f6e0b29a6a9850c42da59936cc541af7f73ea02238d102a57952220d31c7e2599bcd143d5ae581f7c11df407bec1bc84d5a7fa050b8744bbd9dd778 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426280530" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d05c894342ceda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb81000000000200000000001066000000010000200000003f2b0161825d1835e498fa11cf53d699d618547afee336d0f782db5ed78a94d0000000000e800000000200002000000097534e12fbf2a9d99c3824db3d5802531051e98c1e6edaf750b7413a14a956eb2000000033a06b4f9074fdb8630b2ad4db418f8fa8224db6aa285639aead1966a46b91ec4000000076c41c3dd225265f217c4d3f27f0398e1b93445d6e9dd0727fd47051e17f8f9f78dbf92f493a5bdd3c2fcccd47e749c9690a709e620e4adc6e45fe6fe86fc991 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2348 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2348 iexplore.exe 2348 iexplore.exe 1916 IEXPLORE.EXE 1916 IEXPLORE.EXE 1916 IEXPLORE.EXE 1916 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2348 wrote to memory of 1916 2348 iexplore.exe 28 PID 2348 wrote to memory of 1916 2348 iexplore.exe 28 PID 2348 wrote to memory of 1916 2348 iexplore.exe 28 PID 2348 wrote to memory of 1916 2348 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\25d88c0809b874f6d6797a11c5a267db_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2348 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1916
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58347484d19f2584cdd74204fbd298e2f
SHA1467fee20b11face3e92dea9bc929eca7500d765e
SHA2566757d4dfcb5dfe9e7f284ce66233003362458e466e6f4bae50f579db1bc0941a
SHA512ffa23e95972b3651db32145fbfdd377df43c3a6430f2c3382352515a68d2e9f766439fbbc9244b7b7141acf1b51cbf5f6a0666b13b314cab50d41ee444e24ee7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5de4318b243bd3308d406a3912d38b5ab
SHA1d618652c74186a288822cc2bc0db8ecd35259618
SHA256a62412f089857f140dbe3da5e99091023d2c7168985ecfdb3e1a0e37e174498f
SHA5121cfeb245f43a45fbab0aeee6864b50bc1bf58537df3a0dcde0b25c1ca5a222fdb37815583b37b52a3e74c6d059b9e44be4271c89651a9f8421e7806befa8c682
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD575afe0cf4c9f555c79c0f73ab80ffec1
SHA1df85f14d72f0f5a3577775f147d287b2a4356a16
SHA256608c3db07a685c3ce841c2e7737cf27ffe4d14baddfac07185640ad1f8685f42
SHA512de2589210f311ec6df3bc20d2fd3fe025076f740679d513de75bd8ef84bce3d0dc2b177252f7d97ee851d6127b72b172c83453ec53ed5931958f721386d0c701
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b78a3060edf2f527027330353be0cd8d
SHA167a2b5145ad46a6128ddd04852c388f96ff4f67d
SHA2562b614d61ab1516fd45beaf02315ab0c5a07959a99a472ee1d8c96c2b7526aefa
SHA512844b7ae118de985e9704cb0d29f4484470ad32bfd97297010d19dc8e00ca24b826d68718ec9e3d16fd220d9e2938cb18546a0df15f7d348fc0c5a3002abc5e76
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52c6f4af23dd50ecfd4ea13eb7458c23a
SHA1c8ed7befc8d85c0d93ade2a1f39c29dd22388d01
SHA256da4866ade238934fbabb2a271eb3da7590a655a42ab9a5d4bd5c540c73903efa
SHA51282ffc53b48d8b0398acbe7d4e5c631b699750f686549dde9a9f0c45717f06e058b79e298f6bad63cfd8b802dc9503701d174774a512bdd6e31112f86214a5201
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58365a5dbce7626cb12caa1b0b46f9d14
SHA1b73dd3e86ae15bdd6438b00636b4120a5a70f270
SHA256c2e16cecbaa69c8d065ce29ed0cd528014c0188c1446ed49c94f57f3c7bc9050
SHA512fdb94beb23a1b55787d06afacb90acc71253bee9195a9cacac4ffd944bf6c6735e83ec43706e9691e008598ae5be3bf05a452eb669a4afc2a0a8426e2b33415d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51490820a1a9039d0f4a046c9ea62f803
SHA123e6309ff2853e0ab1394b7887ba3c53095bb455
SHA25605338cb2e17897c5b75395344e2f28fb5579403061f79245692f70e013626bdb
SHA512c33f655afdfe96e39700302458d995550668496e03601bc4d1085e544457d7b25d2dca5bdf7ed39a234287051fdfc644d2aac417ffbf15dc71cde7b5c460ed91
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD511ce7b0ab1141d54d420128ff4e0f8c4
SHA18cafb5169df1f039df0615d7745ec9374cdcfd73
SHA256a4c77b6e2b57299fc044390d1129fcc3008691e7cd006b0cf10bed2d45fa3314
SHA512f20e1cb79335933a0ea20b9150798759012a04bd42448582a3e57d6e5ea76ca1223b3d1e0c336f8762d5e36a26390b9f0069081dd6434a2597daf39ef28601a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52c12441a0db2f801c4d551182401f301
SHA1e390da6cb6b9da7f9868b0ba56235bea6b7b36eb
SHA256068457ea8d6ab7b89a071dac36af45f206150be9d44b6ffac9aa988425d9dad7
SHA51229376ea5418d588844a2877654c3cad2aabc5eca2518d32d493f7a55276643b0552aacc805748ca7087bb169cc52a90ae216cd62e5b904f8c15915aeed3d6807
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD504b66202c511d77b28042b8b40fce580
SHA1dea8491ecf7e8cb125cc9cf2dd2c707b686d1852
SHA256c1affa15c91538394da2288725f512f148ac397a22fe0712e9e22a08fa3d8a7e
SHA5123269c72472477e2731294e5f18e2fb5ebdfbbfcbdb0f5ed3c63740838b88b84e16a10de0a0646a96462a4d8d3ed7747e8433a2469f2420921ee214e819df8319
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59422b782970e181c3061e9e9355e32a0
SHA17ffd5ca3833831376212531cc0902f568d0ac7b4
SHA2569b1b1c129373e078771762ba4fcf8d8db9cb9be2ca05829bb9b33f2d4bcb9e22
SHA512daab5c3424d82c6ba825b3e906fa9c278bb44c35d28af956330c57c334f62e595bd67b3babe77d73a6c8f4692f93e764c218df1d7448f2adf98c9313472a238a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c43b44cc0b44ef5b750ba2f39c6fbadc
SHA1162e887f3427d2ecdc5e193dc8290efd90457c14
SHA2567b21d136037d58f2ce0915b62582e68021fe31587ac34e2d1a968b4d1235b6c1
SHA5125eefb101f31116a5b07f9cad55ba722a41d084f9a2d976a1250a0d5229a69a5e0b29b5ebb7b117fa9e56b28e72a461ddee9eff322395ec97725f179f7cfd66dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53ebc78d4f1c71f116ce539ba49238ea0
SHA1040878e71edc248784ff6df5fbdcc45163895bd7
SHA256869f667fac0b815b8520797c016da0917207a336c887ae78121d8725dd41d154
SHA512416d4e09a17521db77ff97c59c1f1fd6372a91145e5228838ff21ca22525ea451da53ad6409805b582f39c1d18cc79b3e0869959557b943d47751612f290aacd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD512c7a0a6e429d256de6a68aba5a5e2ce
SHA13766e36381d165dae41e844a3f728a5968983c09
SHA256adc76e8d2b220e0a8892011b5015916101c8c7fbac176542cfe68bac8bd3a223
SHA512fedc23e1df47fbef4c6d662f23884d71f59dad02dcec2e328a8c7dd91475eb567e3fce66111462d21a7c641bd3b2e7f993371c07343eb58c4dfc9bce47ab5b71
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ed11f5bf0ae4848485bb89750f6b609d
SHA118b0aa5e69c9711d9ade9822fbd4367279c98150
SHA256c229e6c963804484e5384e5ade0fdb4913fbe9a97daa76c04ff05de2a0a53b96
SHA512721da7bd12091045c66d4b537a09212cc316ae3950203fe9444c507ace3aa239266ed2b5bb2bcec6127dc392190c3d98dfbf324a0d28cc7156b6ed7259c81d5c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD505dc08031fa6cd8e81c082e64f2dc41c
SHA118d1b17fc6b3f1789f136376d40263f6d52f44b1
SHA256440d611ed316203b228d73be8ab2f9836b98de19b1ddfb770b7e530509869516
SHA512255563e7be9cba40483c2bdea2015f528f064ca6ebcfecf955b358e69e1cfdb52c92ec04e4c27b5b06bddb9719fcb818c0805533ad658c84c8bd8a01d321105f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50e6a14e0b3afe61fe3ef13d3646919ee
SHA1e1eeaa96c9ab48678db33b2a924434ad56942586
SHA256f6f9fae3de69a6d2c10401a25f2481003fdf2232a3e7668c924d8ec246e67407
SHA512e121224f9846f5bc11e84b1dc8697a3eb80873caad3dcc3f6b4df9de9a7b7a3e036ba031481c51b1193ad9ab48a4f5ef4dd6270576a1f829d1e98d86c2ca10cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57bc450838694f531f7ce61abefee462e
SHA1e35414366a3cb19da4e3477141dbca22e37729c2
SHA25629bc2c2086a3203705e0a5381cc647c4185fc70dcc904e71f10aaa6f7da94aee
SHA512aaee3d5c76ab0bf9d01f3836bb0aa8d0b1b8c0474370aeb4fbc74d608f2ba34522d4c84b9747befe6f03d483ac46b5a004fc153b41e9d918178ffc4ca87c73ae
-
Filesize
67KB
MD52d3dcf90f6c99f47e7593ea250c9e749
SHA151be82be4a272669983313565b4940d4b1385237
SHA2568714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4
SHA5129c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5
-
Filesize
160KB
MD57186ad693b8ad9444401bd9bcd2217c2
SHA15c28ca10a650f6026b0df4737078fa4197f3bac1
SHA2569a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed
SHA512135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b