Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
08/05/2024, 01:27
Static task
static1
Behavioral task
behavioral1
Sample
2298c24c0da6b63f914fc43e93e268b6_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
2298c24c0da6b63f914fc43e93e268b6_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
2298c24c0da6b63f914fc43e93e268b6_JaffaCakes118.html
-
Size
4KB
-
MD5
2298c24c0da6b63f914fc43e93e268b6
-
SHA1
e9f03b33cd3ff45b78adb3a624d6c40e149da61a
-
SHA256
e4bfbac6702a29fcdfcf4b87dbcdf5b3a205f1c7db4f9a2159fb6149bc49918c
-
SHA512
4c7374f13ea8afb554b008535b07fffec62940bf2cc8bef96aea34945e39ec8d6a1f5bb84bda58ed99a0ebefe462af15595b6f173390a1c2af75592f6749f13a
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oH6td:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDp
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000009dbbdc654efda5cf729e50b8f927f0b6f69b9ea68db3884779eb9c4ff14972f4000000000e800000000200002000000063f4cbcbf8dafec73e1d3d58b72ae70f7200496a51a8ec07efc49a149a33a005900000001ce5de6cb567dd0b3ed0f976c4f0e02074e6f2d8212993981920af563ae0533057e061064c2dca62e650c9d66f82b1be3214e686fc2328f74e94e2dc7ea54eaa14cf399a473288032b15f34757e7fe04d8d8c915d261b5089aac4eca975d522344d8acc2338f5d23f8878a6fe572a62165705125dcefab3e1dce533a60eb4deabe4b5a80d9f2aed51c8cfd9d8225ffb840000000304ae228b964caf58d01e79c98986b3c04ebdec64a00febeb57dd379f102461b738cb073370da507f29ac6e6ffbf96df9b2f8db355e4bda0637ddca63205ecc5 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421293534" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000004e550c37a5227999358a80b34b13d175c8809fea56f153ea46dfc156eb75767f000000000e8000000002000020000000c0fd95f82350d1331311093799a868d3d94747757464226e337606ad4c38c1c32000000040fb596e57eeef278bb079f025b6d88c160f81d85abb101a0439871e6678d26f400000008bce6086fe2e8cb23128b7d678a907ec0e4d81a8c422a0328ae7ee12cf9c62bfeefaa6bd6887da8562dea1cf95c917b2bd0b4eec361b50b3b31323bc8ddc8e13 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2D3CBDB1-0CDA-11EF-B082-427DDB91FD53} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0e3c201e7a0da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2284 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2284 iexplore.exe 2284 iexplore.exe 2700 IEXPLORE.EXE 2700 IEXPLORE.EXE 2700 IEXPLORE.EXE 2700 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2284 wrote to memory of 2700 2284 iexplore.exe 28 PID 2284 wrote to memory of 2700 2284 iexplore.exe 28 PID 2284 wrote to memory of 2700 2284 iexplore.exe 28 PID 2284 wrote to memory of 2700 2284 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2298c24c0da6b63f914fc43e93e268b6_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2284 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2700
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c4fe1fbcc7b5aa226810813bba3b6e34
SHA1cb7f0cbe58a3d0179a3c51b0139e4eba1ea2702b
SHA256b4011862aa6d0f3c44f054094cb48c2818ab9c1576b481d53b4fae8d38099dce
SHA512e865d08f5b3dd1a76eb4e02a5193db55e1d6e2a06ce9cc97f240f66a633f6dbaf3f701c41af53c237248323a6a737d783696808577942c0cc9bed2f96779a4fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eaa70efaf5d5d17c907c9c7c75d22ca5
SHA114fc9a40882bb80d9a9fb7208bba3b67f9515367
SHA2562eef62124bd1d2edd48a9935bf1573077a65bd015c141ca3a75ec20fd664ca62
SHA512b7f9286dcf8af9fe53508c228fdaa0842f715bd4c983180c503dbfa5a1b060594170c772f9bc47a72f0753b7cad0aac15ccc601229e11f89f05fa4c7cbd85ba2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54433e060870b4a92a05adf978fa1a815
SHA1c92ff9369473a04cccc9e12e126c7dbb50c406b3
SHA2568e0f942e7e2e101131efd4c2945856f4c74ec650834c41a543851c22a4578ffe
SHA512994a42e639515d8f227bd53b2646d5d7e93b72798e32bfd5ffc8411db4212195248b8fb6105221c34d39037055c78bdc9d51dddc9730c43ccf17b660dd829388
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c14aa30a4ecf4d0009211e7f2bab7430
SHA1b32912845c9e307d34f7d77ec32e4c825b3d857c
SHA2568f9e366940facbaa038f77029473c0d4b3b492ae7f9ad1621d85a46687504883
SHA5120988c2bac8a67b10a92fd3cdba15efa86c3dd2c249151c48322dce886aaf1b27cc540c2d8ebe958d817f90f3577cf62c66b5b3d1526d524c49605c38269ddc35
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52ca770fe80b7cbd773ea5a6d65086560
SHA142360da7062e2927220fa557b94aa62cd698e138
SHA256f9bbb0a291db3e3164e193161160e0801c21eee19817c0355258879363fe136c
SHA512f69a242490f97fe8879e30738bfc2b813cf3f8a30834d6560cb91932a6381a1536ef3595d7c17443c1001ff11c1be9b626107e6b97b3a700b5403ce2b6fd216c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50def646d30eaae827260743ad5da5b73
SHA1a38876bdf97807ae6a990f226f0fe4fb29ceff74
SHA25653559213d2ec82f0536684b086688c37e6c897be1863bd8eb905e65563e40080
SHA512da6c0805519ad0ac90180372c636fe91c61409f8a09178b6e912abf6ca4732a85086103e7785e8dc539ace9f85b27672c03d90930ff1fdefdf56996eac85062f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c0dd5f12934f2e8c3e9af2592774f479
SHA18aa28d2ac4bd14f03c698cc7fffb7d04f753c650
SHA2561fcb206ef7b28dff830f7ab103e7983c48e25cac94f0595330766af89a7525dc
SHA512951667c4f470f5accd08abbe11b859d39c3bb7c72df445758b3291e576d57478e71a0eedaebb3bcc89b72d2cd050dc1565b0cb69f48b022da1a951e57d0f3c5d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b6b08e5cff34b42f95fb4511271e58b2
SHA15fdd005d99a61215c8ac885ed28779694f42d8d4
SHA256a14fc13ad8238c797f384be1d07d6d64afbaf535af6372dedcf274b8b350c182
SHA512ff7e6c5b2021aebf2f212884a022ffdeba0197af9cc26253a2de107812555afb592c1ffc8665f851145b2eec972359473f1b707150af5d09bf75901391b90892
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e494f1ecb1720c4767b217e12b792baa
SHA19aa10a82c0abf845196d47ae231c44f1186f0548
SHA256355cc0cdcdd63c80c0be73514662ba05a308d19c356969794e3f97f17ade4967
SHA512b2dc4b506db6d0d3d0f25032a9a0fe5f9b1da981186ab9e8fc010d81a801da9611bac65e6f62c03c4695fe6b1c0a870355744a6123d9990e0af64db8cfcc9ee0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD571a638bb93526d718ea2db5811c10558
SHA10700fcc4c1d863c56153a931a7cdafc42b395ad8
SHA25620de7dc09cc4136f18ec79cbd75f3ed789379f7f2bb8af1c2dc280bd5d56a4d2
SHA512b1fdba2568a4012f87d1a04ff15bb0cbe943f36dbd13d1b7f99cd8db7c3f30fb41dd524881ddc746ab86c64e3796cd69a13db0096684a621252b8c7def171821
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD514444591d91a25deb311a1b58ae28bb2
SHA18dab757c2834311da278d260b52bc66ec98f44f3
SHA256ce830166c57aff0259801edc3f86aadbc18e2a56544324d3b60d8ab784296b83
SHA5123d98b2027f53a1980870cef5e7ac2fbb3a343222f6a299e34c6987a5af3b49caa30e269ad27a4f5063ab8530918d4e3961696bfb8f5df617471584ac71dd2ad1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD551c41d84dda0c0a2ca0c99bd156f8ec4
SHA17d377f1dbefd92b4907239e96e33fdc41458e051
SHA2568adb1aaef8fd6f98eb245d2b6b11a7ae0bd241ec419358042fb6518086866442
SHA512ccc245e3cb3804bc35253848988285dee66f0d8bb743e743c1a59a76f36ef59305c7eb1da538720ffef7f0a591f338036bf0dbdbc8d00fe7e099fecca091d3b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD591c553e51b6f06711407a49770645e92
SHA1717a3261791f6aca0bad660f10a1ce6b8af2c2f8
SHA256de2ffba4af4dd2b25cde1eb2f4e9f318d87bf07e806a82922d0b98d69c2614f5
SHA512239d556899f4791885cb5780bda5f7f64e65010b10623b621fc5072a417a04b5ce538b06466e1347d9425cb6c437b55d0220ea7c284462d1f844e47bfa5ceedd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5db736e3327e3e1c0c6c919aa1576a533
SHA1b35c4ec569db7d53ea0fdf8060888800b543e636
SHA256ecb7ba996e4effe056d4b8d834f95a4e97a8623b1a0bd67dc1657050aee24566
SHA5123364ed53d7e473305c30966543f6beff52d529cd712c22939db8c4479ffcd4880e86e7d954c9dbd703f462d3b4c8e7ed17b8ca72f25d53a532184153ee65ec85
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5876fdf69da9d86be678e1f47b295db75
SHA1b4874df997e5ccb2de8a52c2ca2077db95d8c30b
SHA2568ccd6f02d5633c273a7346c5b2be5697dddf09149f3b3f553b000636c4a187ae
SHA51205d866e3c7a6170feea1ecc7187e2e39dc4ef2ddef89769287f5059ceb2dbb73814cddb36149108da408cc1e0f57f1e1afcdc96c2bb7ff0688994081631f581d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5760825985d59eef2e604b3c1eb60fb0a
SHA1078456cc33e891581028da1d4575017193f3d5fe
SHA2568f0056177ecf7564038e9ecc538f7fbb3f1f82e0a6a76b6d2000ab279502379a
SHA512518f00caa2bc7d0404ad25b0fe820806519511ef3ae8e8a91d0dc2b4e47088793a8e60fd9b6f261c06354ed4a2ca488ce85f1677dfb173a2ec5bf622895828a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50cd6aeb44250f674ea95a1b6c7ff2e69
SHA1c7aede1fcc5a77f087279ed632343175273239dd
SHA256cce3e1ca9b4faa760915ac615df8bc40e69a22f8a0848ffa91971256bb3eabf9
SHA512d2979c53429715f0753c9858e671c93b40491f2b8b29574642a4fa0a03138b36786fa426b52bd4d92bc497554ac8aa02853334758736044ece018f876ba1aad8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c265971cfe84a31429d206d8c50c8cea
SHA12606a6d8c9184e20e6ab65ec08308b6af35577b4
SHA256fbb9fd184932d0fc3d99f54040dd48da69368d83e31bb5bc58f52e09f2d78ce1
SHA512cfb9988fd9bc5dfd689aef28f358b8e25b9ae2f97a574d28f417db7a87f2d53511cbcc3f554d95eefa05c0c8916a7eb43cf71e025ae85655a406c90eaa791e1e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55088cbb367996d786e2fcecfdd8e0c39
SHA1a875e993664b3450d497cc8b9e64b28be0e038c3
SHA25673d914652da3c5c20b7c44b3c75b59e0c912868632bff689b3f1dabf682d5ee2
SHA512b285f67a6b0ff58b295027d77e4f4f7d67958e4c4f7d20fc0d75c529361c6e5bb69edf6211ce58016780ed83d7702566223c477508a4fcc20b5120d15e12ca34
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a