Analysis
-
max time kernel
139s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08/05/2024, 09:59
Static task
static1
Behavioral task
behavioral1
Sample
24530b5c3e0b384e43016f190328422c_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
24530b5c3e0b384e43016f190328422c_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
24530b5c3e0b384e43016f190328422c_JaffaCakes118.html
-
Size
67KB
-
MD5
24530b5c3e0b384e43016f190328422c
-
SHA1
5470acaa89ac10c0c0dc2ecdf5a956e1461571a3
-
SHA256
fb84a25c918420575686b8eb21ca739cff6f24595deb3f516772fcc1abd5fb38
-
SHA512
92aa4c5fff454b8bb291d182eee416de3fada2bda72d51597fd0062cbfb7e54cf6612de6459e0dd3ea41e4352f9e1e4184f94d21b7f3affae75ee731110a174e
-
SSDEEP
768:Ji/gcMiR3sI2PDDnX0g6sK667NzoTyS1wCZkoTyMdtbBnfBgN8/lboi2hcpQFVGo:JdQNMTzNen0tbrga94hcuNnQC
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A27CDAA1-0D21-11EF-8E7B-D20227E6D795} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000bec872cfa76a85681aa4138a66064d4140670c8a254cac22dcaecf5a1d0d14cb000000000e8000000002000020000000c67bdae3ea76b5ae40abfdd5b51f97fdcdfa5a25bc31f5c55ae9144f55e2f81720000000ded3dd5c9002234b602dad0d7c4b886761ceec40cfbe8f979fa84e4a7729114240000000a2d07b0618c7f7978b6058f7889bbec7f482ef898ded7e11cd6400ee4b2f264f128423b9e7495002668a1402f23544d4779059bf687d420265be252d0ca192a6 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60bb25772ea1da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000f93f4ac4aab10ee5888fe67bf51ded403e09f13347964abd5a839c1dc10cf0bb000000000e800000000200002000000084bc6f21d2b1464f437c95f081280aa71d226d5b080b06fe90627252a0d3f45590000000dba47b6debcf584bfbe64d97c1cfc49b3555e3e76dd27ca2bcde67735bb03a970bb1a17645fdf3c5f6724144a7503dc7265f4b6d23cb038d667b13df8b33f7a3911ec665a032407059caa1adaeb79b43a5af6d1fdd9dbd33dd740a714ee887d2b4a0651fd6cde19028c3c841246be8ebe1a4bef6217968274a52e017d1f4583bda0f2c365a10845c12aaceabe9a2a00f4000000038c878da9811c0ad87f2fc50f11527e95f67401b7da7f3c204fc41b520aceafc3ee9b7982f0870d7fc109db643e58f6bf710ed26914984ba2c98aac7a86dc365 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421324225" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2740 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2740 iexplore.exe 2740 iexplore.exe 1156 IEXPLORE.EXE 1156 IEXPLORE.EXE 1156 IEXPLORE.EXE 1156 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2740 wrote to memory of 1156 2740 iexplore.exe 28 PID 2740 wrote to memory of 1156 2740 iexplore.exe 28 PID 2740 wrote to memory of 1156 2740 iexplore.exe 28 PID 2740 wrote to memory of 1156 2740 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\24530b5c3e0b384e43016f190328422c_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2740 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1156
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD504eca521bb0d50f25272ecdc110766e7
SHA17a8b3bcf54aba6ebf2c3533699c4fe4729b80a18
SHA256c8565cc7bf0e539134bff5f1d7f0dea06b2fb0bd0e0540dac146c6038b38f3bf
SHA512912dfff1811018cd5e569358970947bc27d10eda84db33c9fd459b2f1f30f7b667b8df60cf1a5839fcff1b342dd7f45365003ba9c96c9a3dad696199e7a50b1a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55fb2ef082933d6ec50af5ece1bea43f0
SHA1f6ba1d2e33829495a405505800154893e1c359b2
SHA2568ece5237ac3f6c5802c27a9ad0d6c0ad3166c1572e2772ce7123db42d1b903fb
SHA512d01ea3232d8944f4d80a7aba133f35fa7bef281db45da861bf10058219fd766687dfbdd5ce153f1b323e60b0cdb566bb725f3c0d36fae1f2955cf4d08dc0c8f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d54905f404eee30fdad0b840fd666a09
SHA19e1d6296431c95e465abdebbb52905e8cb9f3897
SHA256d004234790e21f3767276477ce7cdc19a6aaa630a55ee401638a0f7ea3d0dc27
SHA512ebdc0737e5a0b354fb596bb1cc959f699c4ac43c603769bfe485a95e27e42bbd11051766a13d6568d64ba967f9928d101a843e893be7e21e1548923cfcf0e2ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5086a71a1393d77ff32ecf8788cdb6593
SHA18401f41bafb7d487af35f22a923ff6b8de6d29e0
SHA2566712beedeecc3005f745ea702cbe60e0aae3a479e9404090dd23280843545122
SHA51284111768a70a9d3c82996d0e8f64092f78a20e0f17141b8c373c1a20dd73337b7042976aa1fe2f79aa73216c708d97078137e9d3c99be6f309684784a1621301
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dcaa12c65380521e3bf452f9d6770745
SHA1fb509f9cd1e8c68c2fc845c707c9440ffa2fae78
SHA2560d55fbb9d9e49eda20d8261297ae8639dd3b067062f78a58b506e0fdf16698dd
SHA512f840dd34903a01f5cd9348e7e7c3f2d08dcc25e641b1d41882d3986a43d9213f575fd803a7aa1d2d32a4663a4c111768c3113288eb028a94d67b9884fdd91eae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59c53ef9bd5ed64b4c96f89580c4afc30
SHA12afb52c512d882c0e52c11125889c95d6199742a
SHA2561f34cca086d46ab4b454c5b49345eef91c77a95fcb3f2bd8012ba00e133487a5
SHA5122208065854026f4f8c70b5559e8508ffb02160c6b812c4565ab1c954849d5a7f7b4adc4b5fc89b4e4137843740a91f67327fdb86dff2fdf912a9b3834767bf9c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58ace12422c5838446219f59585dcce54
SHA1ee5d05eb51ac0ecae76431968be2ca47aea0c75b
SHA256abf3d8343ac8b6ac37dbcd285099a0747b71cb3b473b059d5229874428695e0b
SHA512631d831221c11c539a6899688d041a44e3bd1323822c0f5dc4d8ef6e053d43381c833afb1d712a508a8cb3a03578257c2187c2f93ad5e566a999e6214894754f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD586d2ddb8ba6157f6efb346dfb3d296f1
SHA1755dfd5c28d8d5a33e5be9ff8634e6237f764807
SHA256357452ee8315c09bdd84c63801d612a13fbb0055932cd7734973be7f057d9373
SHA512ae87734e9c5e742a9aaf848c7b47d059e0a295a5cf24870b31307a7e4eeb5093cd8c7e409232b27bfe3d9a4cd425b511a0dd30b39c0f617ba2ccc651249e65b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57194980d216f1203eb579e02a21e1f9a
SHA10c18bf9752fee52488f91405f2fd84f76132c2bb
SHA25642c6b8d43c86490b52268e54ccdb64bb344f1febae719ea94af6514c66c5d685
SHA51278720088f4daf7d9a5027c6885122a242934bbe8baf59d7917ddcd216204c6d57b1324ab78ecd4f4288ac51b5fa4c9cb4a9eac5188e8d328ca7653d485d212b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d3116136eee972a5c166e647b1f70554
SHA10a89b7e4d43bc6e6f812e61d016959ea256984f8
SHA256e9cde344d567cc496846eacc847e11079675b3e3737b373dd156c1a2236f4b3a
SHA51283c47bf77a4c5389129da80a00778d9e625e9e3e0db634d3c8a8b4443d966c1dc5d4168275d7b507a2292a7242df4e8dbf8a9a12f4026b9b8ac96f8876f3fa8e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c86323bae471a381e6fdec0491074281
SHA1f2a0fae0ca6f1fe9a542e564768a1772aa1fd743
SHA2562172b98069b12f6acc4022b6a9da5b674eb0622f7b581b7b3819f909a35dd374
SHA5120238e9b0c32d016d733fe615de451e5a85f671d931af924526696166838758abbfc29fbdbcf91431275ccb4ad8a1ed3717fad2ce5cdefd08d4e3b6c0c63bc93d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD503bf39bd9d62e5c54676c1a9ffaf40a4
SHA1d695af8af6c26d135a51d8627f7f4d00e1cfb408
SHA2562924d89dd1a71231800de0c122b8f6a963c308d5db2632c2d7a15848e34c8c6c
SHA51246f59231687030c816a8df44999d60adbc592012f084007ad8e284265f6ef9664cbd3c3a203f048244abc00ef06a828dad0f2083809c93a5caf7e77c2539d6e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55ace313a9596a7c574e791b6ab504aa4
SHA187068334525d6821c012a48342b6c5d7e64d591c
SHA2563a52483a4f7d71ad6d662ffdeb1fe72ff7703a77fc9773cb437ea5a24afc460b
SHA5120aa6e4e051f9098b2b4e1be32b0fce456c7c4393d48ee7195da28025e0feded9a23035c22bd1d0f69e68727335c4638654f64158131234970cd14ef4984f2748
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56fee6044b649bd8f53692e88805f98ac
SHA199e8082c46801015d8f1de7901822b95b51c37a8
SHA2562ff733831da299dbaa048e40329ebe6be1ec2ac05afdd267576cbeb71e574a09
SHA51275542a679d676c4d9425d8d1a521921a10c57bda41f72c2e770a0b7a687c3459586b087c6296bd326b3c8239a308184083481652ced91d2011409213c2e10ca3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f0b41fe54789c654064f02ff2ce436cd
SHA1ab5c2c6e4d4be9ee30966d809a1d22bc9e691451
SHA2567ef428762cfa10cbb952504e9fa02f1a13f873b23b19d6e5e9b797f8bc4791b8
SHA51294987bcb885ef1b5bf5a32224b3c07f8cd07e08ead7670905eefde2246f3035ed373ebc1d83cdf8127628615f28e4b5bec4de5efc6b4e0facf8fc2184ec24426
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f97d6c6b69d13b74d644bfa41f7ee7de
SHA1b1f15cf490b3bb5ad7953772f4982e9da770ed1e
SHA256583cc928d267fe2bc3f10fbd73330c97934237c1a8020eb5fac9d341813b5c48
SHA5120509dc03f1287a2844992ade455a38922b19f19ef15bb2f0eaa120c25fae249f929f960fb6ce919667083972d78041eabe51ec2e733d428d29d079820679840e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58294750c7ce4ca1df7f08b908ff3bc67
SHA191f4ac60afb20f450dbec61919ea04018f679948
SHA25619ac13cdc796c2dc453d1717cdcf678962dcec573e4b0d44f8fbea77904478ad
SHA512d80bc8daa995d70221352a5589992459ee0bbf1d3b62ab11d1fde600c653153472d58ca6887617c3920d6aff9e8af1504db4c54d948f0c1b133479e2004702d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58445f8ca7a1d7f3918706261fb8e3143
SHA141d9deea65b4f5447b03b7eaec785790aa248e28
SHA2560a0fccfbafde676622f60f86463f86e47e441662143763ce60958910416bce79
SHA512c7e295c2edec70888f3ce9b307d05235936409170005867c17b80adbc8c2265f33e44e55add41eab7cdf2382366b9f84978466dafe13011f69ee39326b5fb8b7
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a