Analysis
-
max time kernel
121s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08/05/2024, 08:49
Static task
static1
Behavioral task
behavioral1
Sample
241557fd20d4710c26e96f615221452f_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
241557fd20d4710c26e96f615221452f_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
241557fd20d4710c26e96f615221452f_JaffaCakes118.html
-
Size
67KB
-
MD5
241557fd20d4710c26e96f615221452f
-
SHA1
d9eec7844de254751d432125b3f49010795c244a
-
SHA256
488515e72deff1bb6cb0cc4c11e2ac1b8be711f60e016c92b2c28066d1ab4796
-
SHA512
be12daeebd50081952dc872ae246694c2a220fbd1be01134c0f785f8e4d19f0c5c079f9bb4ebc9deb9977c4b8f6b0ec4f31ee662f4936cd63f8a0c716cf873b9
-
SSDEEP
768:Ji2gcMsSZ8tN99OIsBxdpFpxpsoT2fQCZkoTnMdtbBnfBgN8/oygcRWQFVGys//F:J+WGpFpxphT6Pec0tbrga6crNnz8PJ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 205a2ab424a1da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DF4B5DD1-0D17-11EF-93CC-729E5AF85804} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000bcce7ee7538772fd6f5e134ceb684e2a86f9ea388467129ec6f6f970e0e955cb000000000e800000000200002000000040b64fc3c33b344becd9671305eb1acc88b68160879e160e89a94fc4e2513651900000001d2e2570103c7e457cb3298b79e8d741b22d3fcff20bf8bffd74d76256abb498ce94db016a7d79f0d3de4e667e8f1c3f21c1d59c0532bd3b72614ddc53ee1feb8513cdcc7ba13e1f8932e282a03a68acdd97c6ff80aa3054c805824324ef85c025fbd534784ccf282653c721baf4768022710d8dd73e103ea628d54c510c99cc6055d296b9f57fed3b5a834557d4493640000000180d9fd6f81ced7e0e5aaa81ef8c495a70a208e130d1c0193e156c07a89ad9ad0ee21fc4d510abd3e58bbe2ad19f6aedba8a12dd5eb07f9b3c11c0e167210723 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421320033" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e000000000200000000001066000000010000200000009a61e0b125f0f6688ec4483984539a2bd6b31275bc96f16ea403415e4e4da25f000000000e8000000002000020000000578dc400cb70300424f2d258b35c4ca5ed1b017653cd6a9f1c77ec34736bf75320000000233fb1476affd39138d449694226cd55c2c99f7f4cef2ba486e444035f0135454000000031dc2442e4fc867ffbf93aa6caf9f238d06cbd8e99766b8f15904807b414d3de82fb85bc8b0d56b4aa4cfebcf319fafb0e3256d228082c24b64740de7ee67ce6 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1196 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1196 iexplore.exe 1196 iexplore.exe 1720 IEXPLORE.EXE 1720 IEXPLORE.EXE 1720 IEXPLORE.EXE 1720 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1196 wrote to memory of 1720 1196 iexplore.exe 28 PID 1196 wrote to memory of 1720 1196 iexplore.exe 28 PID 1196 wrote to memory of 1720 1196 iexplore.exe 28 PID 1196 wrote to memory of 1720 1196 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\241557fd20d4710c26e96f615221452f_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1196 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1720
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD581b865addd39b22327a96072ace86880
SHA13a10f058c1452c29be0bb5e78ec8e9bc1e90a151
SHA25682b858752077f8289829eb3e63293af55463eee496b756005cc2abf6061d51ea
SHA512f5c5b24d20c04b723aa96dd4b9805bd87a0f2d53eaa78437e6712880a723ed42a1f9185126788fc8eb3884122702f9f93a8282b0358bb3e9b7e72f27b1d1caaa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d3f2ae8af12aade0978c7bee8cd40b85
SHA1ad4e112dc22d8baee8aae1f4acdbe691032dad54
SHA25695133e8e5f8ca9261de987c68a7928f24165383b5e905ebf331c3fa645bd6475
SHA5124ded64520fc98c0cd17ef4972af33baca93eb9f64f2701eea453999bc88cd3352d21f0d35434622002563e6ba9661d971f59255df00074d701c3fcd7811eea74
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c505d4f3fc0d448b60eeab01388949ed
SHA1afee44f2079cf20795d8c9cf3d09fde5220488ff
SHA2562848934ec0a1964df7e212c081c3f255f25e8ea383f1c4605bee34333b44a503
SHA51270c5ae7d1f722a75c30c3e74546f80ad30cec09906fb55bc2aa7952139ba4e8f6da5d2eebfb04118ea173e434ccf7f989496c691c4f048ac3de4ab2456f6e587
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD534dff38aba316967e071017c3cae6edb
SHA12a572030e1a0fa99c529cb825192d0ff91fc5301
SHA2564e2405ec9ef34bd12f0731613b37546e72d7539d46319e3e8792b96821b32ba6
SHA512a5fe73de04be1d3c302982e25b3a2f81f6a4cfc9aafd87a613c8d9a8bf550814e34da58c92cf01e4510af8bd627f177ec239a4f4998e0f502bca2f8209afa926
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5965e9be3135303f6962a60a3be9aa2da
SHA1606d40d2c927f08dbb1121c4ce58971c48c5f28f
SHA256ae9ad288695df62f3bf219b7175f3d815ca3e32d2905348304ed4c897cfcd5ab
SHA51246162c3e9a6607fade183d303612ce48e8cca2eb7f0811880d912031cc84a2b0ce129a17dbf0df114fcbaccf700d99c58f35fb71d7ca4eb3dca89b7dc3bc513e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59e9d65ad3b9a1c39d21759a067d18500
SHA1de38c4d2115f59c535e3e22a974aeeea1e2037fc
SHA256222ea104430c4cb6db803298fda0a364996cbfb032e42664bc5f7c0d4eae6b0a
SHA5120542dd6b49c19d6702a1e1dc11b289be90ba5eab782382c56ad76b4cf07869f2a6c51c26dc9329a6ccf6f88c1f1c424557db8b55414788e22e2165f5129e8224
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53d191f4d7fb944af9ab6e84408991900
SHA1daaab5dae6fb85e27db6040db7df35f9d6dbac1b
SHA2565329f4508dc19b5cb4d0acc002da1864f7ce61cfa24726c1ae968b01a455946c
SHA512d0d0c5243b787babfc7fe01d814338994b893720ba70ecb1b1f5318705f14145a97680a3968758aa837630ea03450f981b00ceaccc2ad764396a2f3955370ff3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a6e4aa7cd6beffec4dc6240e44a0c7c9
SHA1b95e484993f065eaf666c59e9c9f8747c4dcfe54
SHA256b79daad8ef0ff9a6c57e20c9ae4c6fbb17fdffda74afe8005e7407a0dd164edc
SHA512cb399ad33f806f4095fb43eb0682919928a57e8068967171c17adf0a1f2c4367cfd6b72fe2147494253e5b33d165f82dcd4f65457add471ae23f0488d9e6283e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d0a5db76f50362af185cc6a49b8c1fbe
SHA1b58172ab574a2876bc994ffbfca5a59f39a23906
SHA2567fdc89a189d95cadfbf236ca8e711a366e1b62537a64be8d6429c2121064e534
SHA512dddae049951db18968f46f0de2011feeef506596add2e296d92cb08712ae0163d940f73573dd526edea02f645519cd8762d21960a792d8dc182a5052fbf03aa3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54245b62234dfaf6891720c2e60c334ac
SHA1977299a7eacfe9d1036bcabaa7f3a0f5b38ff99e
SHA256a0c14fcab0440099bd7c2c29fc5a49f19f59be67b669b644ca6e1b80cb4839d0
SHA512ca0132f897f6416d6a2bf0e57db5ee4a9dcd403148c2fd7844512c3fbcb93a8f8d1e154ef0085e6b89d26ca0e5ff7145ce7f5e4c2470816d3ebefc7cbde85df3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54a617d5968da547faf2091ba5bb6b5b6
SHA1fa23bba56c55dd4f2ea37cb80e6f172122c204be
SHA25658927b0e0941ef621a054b1bc9af5b8ce5db6a04d9a32820b8a40975a9b3d5f5
SHA5122f7339f687226885f1e2334983a00eb4708f30be71b89aa65800e50e04e18acd5ac8a8247a33f6ea90c4218ea616c0a95dad6d9e0a4378e5f30a94708e16bec7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f1013ce55ec728a05a8e62b040f019f0
SHA1d5474eef319567fa5cffa46c6c92dbccf14a125d
SHA2564e55e793ef1ef505c1c3408de8ab0e309c93ff7800f6ba7f9fa171d35c27e97f
SHA512a9744f82b8d770a5e0047e5d46126080ed2df650a98e78dc0eed3321ac20479235a61d34d726d703f93d36d67b52a5dcdbe3a2bd1d075b77d26209c9f74ece4a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c40dfc293450303ae5601f3c1daefa17
SHA19eb30ed8ef62ff9455f4ec6a83c752b68897dcff
SHA256d119b38b10baa350906675329362e3213685cbee9317fb564fcd75ad17530777
SHA51256d5bd02bd26d66b40942f4032f86948ac483743966a3019c3aac851a3baf890ebddbed3d6ac1902959cc41b5b5c75254244587673dd2e7f8265fed3bf12f60f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58358a00084f4dd77ef312df2cb6376e4
SHA13d73e70c8c41b9be02421b44a04143ea1b322ab4
SHA256da87eb8a4a669ab9e61caf3d22d36cd120a6288f4156474ce419da560a330647
SHA512174da09ce8425a9a94650b52f8c3435ff06c3e597c56003df69127b0844966e10a92070e8dc46f18deb3f52e9478d3f100c2e929552aa3f2d3a2c28f9d90d949
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52a42ad698611b1ee7f777d37a0dc1504
SHA1f643bb0125ee783b809c081ffdb7397540caa6b7
SHA2567c9a0732a8f37812c95473f98020744d3edacf49d68b579262e43ca6fcc181ac
SHA512e6b04c7895efef957e8f9e55304daab0c0a02a3ce0ffb27da3bc0fc8b8a8203878e2aac955e810313594cb20d21403bd9da7f2d2ffce134435d06d7f8652482c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55551c1ee121d35da49fc434382ce3240
SHA1a8f8a6175cd9fad7e26ce8be902e89f0b498f19f
SHA256c43874c67a7fd4d817b2065ab6743032099829df24736e66c6016897f5e92c41
SHA5124525905a047074dbe67ca7aced99391fe380595529290572a17c4d1a4d54db8eaa62a29114fc596698ef4b7f7854341e7857619f763e37e31cd4e0086bb53496
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d0b241219053c8ee3b5e65fbb7cf76d1
SHA1c3dbd163102fe620e2f46946d9e0e67be4dd5ddf
SHA256d1ddc7c9b8de3f17dba88101484c2d25e086ed217297cf46eff0e7b4398c5be6
SHA512818af1d0cf0319f86feee84d5c87428f067546f311cb3fb665cd4e622817c03f915baa06d01f933a04e8d003bbc85267867f90e4a643565f7ada6fd770f30b22
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54dc7911dd6e1a8023a10e87c2d2f29cb
SHA115072ac6efabfb999ff91aa85b9a83a863c89f67
SHA25668ba61fee84ef682570c61de7850a55ce2b678b66529a107cb5f39cfa9431c81
SHA512e517bd3ecb8d3f4db5e67faf4f50c5a562d7edfd98f6f1ba540c2bf161d866a06f0b4a7af67ac38a80687c69a2e6b29dfc1a22a090f3fb03c4ff0ac4f16f967e
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a