Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
08-05-2024 09:20
Static task
static1
Behavioral task
behavioral1
Sample
242fd42326e5b955f4191a6018f16524_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
242fd42326e5b955f4191a6018f16524_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
242fd42326e5b955f4191a6018f16524_JaffaCakes118.html
-
Size
68KB
-
MD5
242fd42326e5b955f4191a6018f16524
-
SHA1
975743e1cc218b6bbef9e158a8d17b8d7b6e12c9
-
SHA256
715bb1af374afa9568da5db4ea5551bcd7b3bbf5f5b6349326ea9d0216c8e532
-
SHA512
71774b4734fc69f0ee39dd7589458dd8fe323e9a5a728fe44ad20c9a691218e971cbd81569fdc0233f02654e28792fba8c6125eb4d075179eb3b9e6781809248
-
SSDEEP
768:JiwgcMiR3sI2PDDnX0g6mwfUmWBAkUmWKoTyv1wCZkoTyMdtbBnfBgN8/lboi2hX:JkK8uTcNen0tbrga94hcuNnQC
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421321869" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{263873F1-0D1C-11EF-9F9F-D600F8F2BB08} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000004dc7a73402f1e29a0fe9234b294d6703efc0214b4655bad08a4198581eb615d6000000000e8000000002000020000000cde643ebcab4860f871ec8c4f40f131da8294d8600c24b0b9e5327dd1a69f8fc20000000848c7132728f0c160ff3d5f70032bc2cc842f0f7bf2a11c4b37dd1fc06ffd029400000000335565195f8139e43a601d8397a0207b70d2ae183eabff495d1305bf3a1c9bf0c259fc83bf75335f2730f2dd7065619be9ff7f17c8a0115f21f1e46de52b3ae iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90dbfcfa28a1da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000e7f99f776d80cd11d8fb8ad7b74ea325e36334f4f530280cc6c202cbeae2d875000000000e8000000002000020000000a44d7ab683dcd6bb159803953a8430f12832b29f69de0e97efbd2fe22da73565900000009f2ff9f46ef95019cd1174a1d3d84d7ecc6e8731444d2efd406bb398300d11eb56d312df3aa4aa48e75de4db96ecde9793cbb222394caf3950066ac08f6f2eaa7f7ccfb36362cc975d366c623408d1d0103ea2017761d3fab459e1f3603fb632de08800ef6cd200a98fb3ed17bc6ebf42fe456b929f748e5d721a0da6e14b3fea842e7c40ef1e763f04ff6b242923b5240000000e4966d121c76eaff0488859b4bbdcf827c9fbdc36d8494ebcb929f2333ad00f71b61c0f3f6abf3e526e884cd93f80b9a70fd4d03c9b74d8c4d42c715cd2067ba iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1648 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1648 iexplore.exe 1648 iexplore.exe 3056 IEXPLORE.EXE 3056 IEXPLORE.EXE 3056 IEXPLORE.EXE 3056 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1648 wrote to memory of 3056 1648 iexplore.exe 28 PID 1648 wrote to memory of 3056 1648 iexplore.exe 28 PID 1648 wrote to memory of 3056 1648 iexplore.exe 28 PID 1648 wrote to memory of 3056 1648 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\242fd42326e5b955f4191a6018f16524_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1648 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3056
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59892cb93bad92b814ffd20f9f4d79cdf
SHA1c544d5f9c4be8f87a06343aeff7055bcb1e6446f
SHA25683c4a820ddbe87e61104909449f040b43e007518191c2c81aa9f2adc830f5b74
SHA512c768652615acda9fded5ca1afb6fe51a0cf2d6ed6faad266cd7ebf2d3ab0341bb77d1c8ffac0a596f142b58961ba48e3ad8b845c6ae87d2534e8f4a2f95c7366
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5302b70101da338331b0ba6975a5ac123
SHA12b1cc398b96813347c13d52a3108c36cf3ecbc1f
SHA25639e800e636cfee7a57f128283d8af717b773b70600e1947d5aa7b00199a14663
SHA5122b3d10d2da2562a8d53c84053f64dbaedb1ba994dd079e6bfc0ca933f7f779ab48f18e58d0db83782872dcf302cdebc0bd469b46a0b6a96de00750a0ed054e5d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50e01ec54abcf344e78b6d1bf12de1384
SHA1802186948e833e69d7aab4d7073c4a21c0e025d2
SHA25654281ed732197ed0dbae9f736f1cc00bbb138df17b87f100f1da7485fef6b4ed
SHA5122107d82abdafc40e225da49b17ecff1f952b74179eee781382d688e9fe12f264d7e1c16c2e02d2c728dac9b3673b6a4ec0ebd5ff0cb40f0597a671dd3d718f61
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD598a9ffbd815e7f7dc136fb0c58474066
SHA1c656ca23631c3736016b9630334a90bd6f505e8d
SHA25683422db6388ba6193d0896cad5d23597323c15ed7f346438b1acf59e5b56748e
SHA512fa439f57a8d478fdaf38d0db926f2858097015779e46248dc42a21e23323166869442315820d0f89bca74a81e4d11bdf11adb263cb245d0d254d5b9f1d5963a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e45c57e87d146543d7d59211e49d1354
SHA152d370cbc01de2aa9a90d7de8efe0c60734fd385
SHA2560abef1db4c506106e9c3171ba22a1cb8a7d741c453b37d42ed6142a9907edd57
SHA5128a2602d79e77da9224212acd911123ac26c124c79ae06a7df8f8f359bfbf64e8719e825e87095f86bb6d4f54f74a64572b660ca65c6ad20d71063e4fd01fe619
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5652219a9216535172f971a27f38fe7e0
SHA13a67678cdc51874d57d1fd0b8d2687f727fb31cf
SHA2566532095bb4f25c435bf1547f7826bb63c154918d50ed9bf78ccc412cbc181fc0
SHA51231980e37ce2ae9e2044ed8d85d5d1d327a214caf5874e8f4b7d8a66f54205be4de91debdae4303f57d110dc9b6953846acd6b15c3f0d09049f1b2db5194204ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54f7c979df3e75cfc4d021d1993dc164a
SHA1561cb04e253383634f2b454c0999252e40d14498
SHA2560f7dda7bf540dc4efad36706dbcb837c510b488cee79b6874feafe49e9553a03
SHA512bd1735571e8c77a1f4352ccc943b5f83c6aec42b57b280ff6c423152af899f152db858f6b64436c838a911cd50d8c8b3d87d3d99cc89b10b4113c720310cc56f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5db76e22fe9e0e67d0e715a134f31ea59
SHA19e2a4ede39a8831f55be09fcb4e04ee61953fa48
SHA25616ec849901dd6755cce871aaac956ac0eeb92459cf2cb06dc10c258c117abb8c
SHA512f86ea542c3ba4f89dd8343c18af264f8433a46f95d2ab110f93d7378f83923406f62058b0181ca20552151083d60cd85463dd5431bd4b1838bfbd23bccbd5552
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52b6d236f5e9c36780bf46e1abf11ead3
SHA1f5ea64cf617acbd97bd05aa1986515fcb6718076
SHA2563e7ac4cde97072911e70090a48d81552e1616e511515953dbcacb605bcf33fbc
SHA51249f92220e64033b79a9f9fef52c011a1236681b0cbe59b75d5d958998f1b474034ef143c6fa537707cbde76377f55468f56b6d1d12ec03d1062a51dcc48a4b4e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a7c2af5fb84f1d715c5adcded1142ef9
SHA13e0fa4de0418d5f7f51c68c595293ad45f0ba522
SHA256316b0de6a50e6bead9598a45f6ded280ac4da71a67d9c163ba8814e0b0268184
SHA512b7f15d4827e3acfd7f352107c258761ab171bc69e64cc4958e15c4cfa69eb741e30c856c23efb0d252e516735518bc715c1dc65d377f92924679da4d7b601ecd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53a362a723dbd80d9ad11702de0d152ae
SHA19dd48f4ca6e5b37eccc2de70176adada24f3eafe
SHA2568b6fec9a874991ce119462f4bb8f06fdb1ea1a8591986a38a39b46691b959cd3
SHA5120509886e8e9e6c8e3bf9f1f92c31a83035bd179d599e9e88d8ee504004ccf608921df0213a509797707d5e12c79264096a2de97f72331a0df0b916c3597ff46c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55fc5f6abd5f9a47e780fc987e5f9c334
SHA18c2a46008a0674ed15488b15a40f9199fe53e105
SHA256c93acfd2ffc97454618d510b43f78cca4008da8d1f99d385e2e93b007e4e00f6
SHA5128647a1cf546db61ac707259443f778e2c45aa283ccf05ce416665d7fdc33de47766f516d1c21b8294ffbac552bede1e0ebaf68a94659192199dec32b1639c9f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d0d6659710ad55229c8b411055d34347
SHA124ae36a29f34dfb74ecbd76102cb03e369d7a5cc
SHA2562702ba2b50590f52e6b006d6bd95cffb6fe3c0f58d964d2a01d5ae75f937f06d
SHA512d1b706d070b031fc08a169e4216dc33af01679b736e3c14f267c652e5c39b9de1b223ae1006dfd355dd7916fde68d8be0075cd811b372419ca9e4941a424c2dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56c7e851b0d0e3f7c8b1a2e6e0b93142d
SHA1690f928918a63a3d2f8c3eb39de2c82a10633852
SHA2564d9a33d7deac6943349fcecee640dba8abef4183202802c7cfb2ef4203914092
SHA51222133464151facf3747375d6bf96a299529137eb73c2f3edc0d58cc4c00a744458e6d872edda94b96d69d26082735571176d3a3172976776d788cb4ddd279295
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54570ea2e53063d169321e5a79377c3b1
SHA1c917becf15620daa34bf12fa744d3917d88e18cf
SHA25652de2e5a9fa753750bdf70b00c75bb1b056fc1f14d5950b96f08fa4b4162c666
SHA512980ff2f18d9e76ed0c9d62bf3deb795c1380706ba84f425c58e479b888de1d678fea2e0e700fc55ebcfc8c5f751bf2586fe361439e3bf858e490338dc038f1ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c6a86faee6a1fa28b9626dc0b05b450d
SHA105bddbc973af65f32344259f530705d266e4df67
SHA25624fe6e9e00bededd78fcf5c1f503ea5fc10f2fa2be62c40117fdcdc0b5215e37
SHA51222758875e7489bd6b385931983c2e62d4655ef742758cdf6f510210a047170f48f13bcbb4a579d15372407779927b824157fc129c6a922c2be9441fe26eedbf4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD592f0247911bdf89d6e3930b89189298d
SHA1953ff957f4648547ab9fef2081d2fed76d7e7889
SHA256e4d32582e2cfabba7afa3d0b0556950e684648cdf4f1d8162264dba6a23c2db1
SHA5129997ad1394ef2a986f6c47b5972e555c2fb752e4a048a472da549b51dc29177495d6d9518f6c9285061b881c10a276eb1bc253d3fb9733cb360e973bbf4764b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fc1f4e3714135d0ac92773b1d6069e5a
SHA15b1c2b7265f81830e9fbd996484d8c76361df186
SHA256699a2cbd3c10be9fe3da7707c9b5088c27efad5c0ac5488e3b6252d63eff9291
SHA512890bde272d426d9ee6a7ebd50d490a22782dc811dcb128334ad5035f5cf449667beb6373b8841f4058c91fd2f5b389b56eae02ca6a92848499f96fbda39a6467
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a