Analysis
-
max time kernel
132s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
07/05/2024, 10:56
Static task
static1
Behavioral task
behavioral1
Sample
2061050ddac18968440f8e384d9875d6_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
2061050ddac18968440f8e384d9875d6_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
2061050ddac18968440f8e384d9875d6_JaffaCakes118.html
-
Size
11KB
-
MD5
2061050ddac18968440f8e384d9875d6
-
SHA1
2abf3e5064e4aa45466e6543634e7365b83d2afe
-
SHA256
b26ee272096be3cfa41fd4ac0edab2a4610d49a895ea175414e335c568e33bad
-
SHA512
a996998b2c81f61cdc59dc5feda6aa78d0096ec4f8b9e4a4e6a97fcb9db5049acf85bdef63f326a476804a48ef7a5c1c535d6b6445f2ba059ef57b5bd9a5ec94
-
SSDEEP
192:SzDSgZ7AM2AMMEAMdAM5AMkdZFZp+jd3oEheIaiN//nxEcjwXZQD//8UcMKWLsgj:Siky1R1QRZQR3peIai9hcJAH8UcMKmdZ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000a67559fecb808366f267785244541d757d78f917b6e22ad07de32414c30ed98b000000000e8000000002000020000000e9040120bac9239448976b01f5ac87796cd3db171849821faad6724d4436004720000000c987999544a0794edf47e862736adb9f3364891188348dc414bb6ec267013b8840000000c995e414e50229334c5481365cff23a46819547efaa68980ac431e404865384f15ae168bcc694ffa89e22b486d23f3d536924e517bfa2002c884c21a342f247b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421241283" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000707f7753ef4310e1ebadae980f82599c7002709fdac88f9cf94a68a34877b4bd000000000e8000000002000020000000f96951efef97c8b3dcd437f3599a2cc6f7df58c3210e4b7b480506c44261cda7900000001098dd8ad08b819567202004c48b4a54ad6c5cde0a4c9a06d08abb17fe72091e45cfb53b00c27ed32c02dcbdb1614aef1339f554a7dce142e2ebd3057f7ee69d7e8eef2b98fbf1a860f4770cfb0b10d9e1ca3baab5353a939878dfc64eb126f3e3804cde87209e1db27dfed6fc86d532399f9202bd99f27859c01cd8cc9829cb90b98195421f83a05e41f20a3af7a5454000000061d27e0044329024da0a4d77f6f01dbece448a7a04fdab9ebf811249aa6e7f7e89e3e1dd10bbf240a3905261182fbccb5a4a748fd79cd7ece79970069046419e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90beb8596da0da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{85392821-0C60-11EF-AB95-422D877631E1} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1180 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1180 iexplore.exe 1180 iexplore.exe 3032 IEXPLORE.EXE 3032 IEXPLORE.EXE 3032 IEXPLORE.EXE 3032 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1180 wrote to memory of 3032 1180 iexplore.exe 28 PID 1180 wrote to memory of 3032 1180 iexplore.exe 28 PID 1180 wrote to memory of 3032 1180 iexplore.exe 28 PID 1180 wrote to memory of 3032 1180 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2061050ddac18968440f8e384d9875d6_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1180 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3032
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50720814608ec37b077502474088ad63a
SHA18ad02229bc79adc684d6d9ff085f9d4975fb58c7
SHA256f6bbd3699d669610b4316270dcc531608fbb5757944391ec5ff315691447820a
SHA51226b6b1009a70de3bc5f790c28297a86f7b80de31bbf7012b147cfcab1fc9a794e1570b4e51c07974454c9412a716df35d24d8df73f93984b0a9ace1c64b1ca03
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54d4d75f8135f5e255d9d58806f8b2197
SHA118cf37a0d06b93a69cdf29a41b9cdef3f1dbb598
SHA2560a073783ec9183224a143e3a032e2326c45f1ec209a29728c3ac8d58740a6465
SHA512cfa88d3bbed12b5fb50f79b6ac7bf46d28e7d67149f234557be0abb43513063d58409b81e73dbf42b2c0dd20fa15de28578b095aea84a895046f42f688414151
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b74796e34b6d877603f4f578ede1c33d
SHA1978fb862c216629ab359b5b27f2bd399f06a0a7c
SHA25615be2bca922936535bf6f4babd7822db717854420fb36d7acb60cb9a8ee2cdd2
SHA51265735b8751820c6042b9bb6edb51d93f6fabea609ead6e8ceb1ab7231d744ca4acbc36e519e05cc92c4f744cd430a6295f98b426edc20a68e27cd94ab2c9318f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD528739e54300e4b2280e78f5910d75c7f
SHA18f454b91ec9bd856877a7644af81c8c3a5706666
SHA2569477e339d769ac5c76c5158ae2998bccd7137b7a421044eefde3f588d8c08cf3
SHA512e438c889875c31d82be844db5e0ed254c67517fb1f9213589362582232d29b2ebf080921abe12bf26f532c7a76449fec786b1b43e61bec0d781fb4697c2647a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD534f930fdffd96892f219b57024d0b03a
SHA1098bd71dc6343dafca17c0da2359de1f9d1a312c
SHA256c4a26487d34cb765ee5a2ac3798a390c359ed3e1c8152642071437554f502883
SHA51267c0d36005522fcf5159404adc172c9fc996fa158b077d2464be448fdfaf957e701528345f782a2c8dd9109c353321f0603701541e9e821b978a9bfd3ff1b6b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD538210bf768ef4d8d78baf346feae0d71
SHA102df614150e70ab18e1517baa0cdd41e6dcc94f7
SHA25655b471cff63402bfb2f4c079a35bab9f9e7cf14ebbe31757e3cdbf0d9178eda3
SHA512cc2c37716bc6715b222d7748510196f461cce8624781a47fbf3059c60a949ce7728998ba3ad3558833c304b69b6285d57e0d754503b9b2d0b8b0815e84947f3d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5620ab32940ff30a5eabe091abf7b25b1
SHA156c960f500e9e370c5592230ee50d0f39fbc5ffa
SHA256e1c2aaf232edcc7948fd488da86957435d72f365d854c3919e56fb72f765f402
SHA512347e9f1975a2dff19b1e487530a43fa1f77dd683ceb16f6c524c34593d6fab7eaf568e06636b4cf6d1249e41899b5715e61438de8f600c5ba2f204de71164a6f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD511b6a2c5831bfed72004c264514ee5b2
SHA117f0e39ea006a31ae1f55fea74a0d430f1dd6143
SHA256cf96199682510c0b4a00358fe870def8f4e2d7bdf6f6387419f11786ecde6f9b
SHA51295d0d30584c7aa409c2bbb87b124096211de0dc27688fe02a7687e4c9c2b751e1b817fffb08a82a973a76c20d0dcd1e36503184affb2f212027367e7b0e69af7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f9988a6fd3d84181e3c96c071af24870
SHA18bb475b63b7c0a3cacd95c779e23e247277538bb
SHA256c5056aa2d294b57986ef85cf69e9509482f3babc3b7bfbf58bdf09cad51ef5df
SHA5126a34f83661febca13d1b0d125edbb59613a081b526902a41723ff93188b9c66981dc1aa7bb476ef98e8d49eb816299922e735988d44f5ae58d1b91c2cf179580
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a627315b3eb39d21da4533d35332e067
SHA17180a6e5d23e05379ff97d71093b319d4801e5b7
SHA2568ea54c512c4f656745cf5f0d6e2bfbe17d949fffe9bf94828eac64642402b5d4
SHA512df47f3b985d336347206211488cb8f7c24853c02becd522506bc7ef02f385e4e1952d34078245844407d0a03feb44da85e10fa693b62f870f4dfdf960d0fee2a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD537c574229190ed579d076e6e47281340
SHA15d52a2aa0f037be48d5c8a2760e7a60367560a3b
SHA2561beb045ff48bea302d5a6fe839da2280e7b9286cf0fd3705a7842ea211c092aa
SHA512ef343d8ca9fd200e4bbbe616ba68bb90eb43a62f54b8542a1542d23384a78a71ef543694103c0b084cf0b3c1e838e6feb22eb76b47aba5ae9d052314d7416874
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54f15589776ccdc955a70c08808ec0619
SHA1be826c4dc60249aae10fddfdb9a22644424f80b6
SHA25620c085155b20357811e68d8173a760d0c17567424b55d41c64b185b5b70c848d
SHA512cd3ae357ce7ab142767b208a4d829a20fba7f8beb7995f8615a1442ec9ff0bbbe0928f898c9df1a01419c187d024ded04a1502dd4d6ff116da93f2fd7baffb45
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD539acd7b1ba32ba57b382e9eb27ff901e
SHA13ad3e9de59b763ade682365c85d7a1a6357a35d4
SHA25613d4b2ef7b7f658838c97f2585ba50a77095d58a223dc30b8f09e2d485163045
SHA512fb548e5959550cd146ea11d1e723877c018586246b72af8aa149915c1fa2d8595bb1b93fcefd326158a502f82ca750f2461f83116a8018d022509d2c5b30a5d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5572c4c09e6067a6e07b1f0fd13b91150
SHA162fa8cbef82c0aad6bbaac1779bfed064254cbc5
SHA25663a3edbeb10203f0211fda7b2d1ab8394483d47082a928807b5ef1f851356756
SHA512a1ba843fb3a6359524ff4e0d0e17d294c68940e768bbaa1b137a33eadc543ad2be903979cbd6256eb828ed3f481440809e9b1d6f2de4654c5a57627d21a8b064
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e2a06bef1c83b5acaca9d7eb4c9e163a
SHA18c393565452bdfc2de5c7756744f1f816a925ddf
SHA256cac5474ac2d56d8456e0f4eba18aad415e2dfc6d604ab13261e95ca8c8a4eccf
SHA51200c067746fd38f70a2fe0db808c519434808ceb5d714d8e57a72544d9aa8cb542a0dc0bc30dff5e22da341772dfbeff3ea49bb036b3aad5c4f9f78fcec075c3d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50133af5e3464a316824824e2f88514a4
SHA15a32d54119615af71307ee34482feea8275ba853
SHA256213f679a7c13ffb99ee023bea6561836125bd42589f995fa530bec0472342825
SHA512422b22f055459533768bfb33f64cf6910a6504dd4b7c5903a9608bcfa7de48420444174e9ada24aa387de14478453d51cefc5d178d72c349b0c1c98ac46fef26
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD552ec39b6895adc6130191811e51fac10
SHA19d3b627d392752dd67afc90a9834c3bd6aa042fd
SHA2561893302873e724e947e8c33f394397cddfcc68a6a85137438947acea989ab92a
SHA5128079b47a5576b9775ff4ab2b15aff1079e291162469bf8b2944d45a5b275c862592979a8daa82d35bfb93e9d1ed2cd8ef7f1e08daef6b8544c852a150162c43a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52e73a68777f712dbfa823c439a914021
SHA1671a17915ab97c4c541916b2e79e42722d26969a
SHA256c79a5ead3269ae53a813909a4544e9776e2f5cd68593d7ba02cff30e7cb5213d
SHA512378ffa7fc4e6b8fa98b1d22950555986c5b272137fe6e0652b33bceea3d723d4978ef2b9cdcae197423fb93cfde58a150bf334e373dfa42a07e93ee61859ecaf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ecac3779c641ee696fe8b142cdcec143
SHA13d6da511e750d3172a6635f98a030e36290ebeeb
SHA25680230254e68ac2d915bfb9312280d858e3b52aa16f0e45dc399e239a7b7e777e
SHA512c816e89b660da36fc7ce3ccb4dc0f2df04c42b85bd0ebe2b692d692e7a5e128fc34354cf08328822074f9d03533dab4dcfbb4fe30e98a28ec08d57e4fb7e55c2
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a