Analysis
-
max time kernel
142s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08/05/2024, 12:09
Static task
static1
Behavioral task
behavioral1
Sample
24c534bcc8f1be1e6b5ae9cc35dd44fa_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
24c534bcc8f1be1e6b5ae9cc35dd44fa_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
24c534bcc8f1be1e6b5ae9cc35dd44fa_JaffaCakes118.html
-
Size
139KB
-
MD5
24c534bcc8f1be1e6b5ae9cc35dd44fa
-
SHA1
52c55ca76d407d742d9b5a1c5c54f18c99cef929
-
SHA256
f5f27cf474a810422bdb2751b95bac781ea2fee8c56f87eca6aebf6edd795582
-
SHA512
4441232023d1364c2489a625bed40b8eba7e338dabd7219b264bcb50be018251b33fac439fb1e8cdfd8dd628296ae8fe8f7ba80b0472ee89cf5a7c9ea3bf7fee
-
SSDEEP
1536:S4v8KJ1mlXZyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBw:S4xWZyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421332023" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C92ED6F1-0D33-11EF-B671-4AE872E97954} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2460 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2460 iexplore.exe 2460 iexplore.exe 2116 IEXPLORE.EXE 2116 IEXPLORE.EXE 2116 IEXPLORE.EXE 2116 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2460 wrote to memory of 2116 2460 iexplore.exe 28 PID 2460 wrote to memory of 2116 2460 iexplore.exe 28 PID 2460 wrote to memory of 2116 2460 iexplore.exe 28 PID 2460 wrote to memory of 2116 2460 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\24c534bcc8f1be1e6b5ae9cc35dd44fa_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2460 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2116
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a015f250f1f882faf4bc5f18fea0c802
SHA12e939f620c40c97fae82493db7bf1aafe002cb9c
SHA256a812e6772475b09d7d5e65a33a620faaaf04cdb380b05a396f6ddad111646e80
SHA5120163cb1e5acbed69facc09450329dab468caa87a6bccda3c8c0e17291f216d26c16484f2d473a133734500a693ae4594d453af6245f098d6634f049358d73d18
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD522c5b70ca954f89c87dd4b216bf3f06a
SHA166dcfb9597c4d44ddef59f3c061585efe1094c34
SHA25661a477d984373798578e5941a18d0384c5ea9d6d282febe659b34070abbb71d8
SHA512f7698fe1d79c49370ea95aeffe566f2880593dc4fc1ee45aadbb9236a1ff30822574685e57d76b53de1105b911a4559074af5e142016b0e1b487f13534061ad5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5491d0700c2e56d3ea1c11fa16dd567f8
SHA1dbd31f7b813e8ca8cc9c21de8fe6356133477129
SHA25654e7a5cb66dae9343dbe14d5be8d5823fe075eb280305bd2fa62511ad8460698
SHA512128addbffafd6fabc856e5a2a3c3a099cb86341e0141d0dcca184687597e7ee0a977dfcacd6128446b121961d071887237bce8bd4c21c4099003cda0b7baa2f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54ca28d6d8a5488a3f207e51f1bf459c6
SHA1ad8025ac25daefa6df41aa1a60030628ef72ed4e
SHA256ba525a1663de291d353b7469268698e27957f718853afb68dad0f6a4c1e6a20a
SHA5126dca3517282a71c938056f7dabb827307c03d4e395bb78d2be789f1a753bb473d0039ed6795c009cebcac59d3949688956ad2d7f0ad65338e665683697d38ea1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54c13fa1f93756a7b8bdd52b512899f1d
SHA1e68df97c6baf1b82aa897300001e3bafca7e51ab
SHA25670b25e531b3d6ad6127b41ff92aa20f417d4420cb709c3255b6da68048b29a55
SHA512944caf4ab2904d8978596c4662a0e1277496f8b650ad471be1ee5a91c5db4bb49b8c1d5b297059891db1d1df72ef1399f09156681c98fe4f1368367d83bdcea2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD581d907a70974410f28a65deb1d7f174f
SHA1fd39f1c26475d9ad5f62c5049e171119713f143b
SHA2566dadbce500da7107098cde8e95bc0f87d139969f9020f0343c82300e69b6d71f
SHA512a5927676f46fa85fe72e889bde9f8b7642aef14e91b7cb1f6335a0adc96bcdc29972fa6c29e8106c7c618c9663bb8f4e39d45559d1fb5ab8b39be906a5da4d7a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5da4d73b945b8764004d4e8e8d915d81f
SHA17ce1ab0d56b2b1b6d591f0dec00cf70eeb97a30c
SHA256a95b5a7b595dc29e97c4f8e2f8f925fbd319e294cc8085e4763ebd77ebe3bfd7
SHA51294e0e6919cd688824bb447180c13a0786f8d3782c8d5ba55af1ecf00adfb460984f00548fa4362aa2b0449224605bbee0d7962e84159db38572c41170e04f22c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD546d97e98954cb04e21f60f5a72b8429c
SHA18e990931c3a5ad05b6c4b72af297b603c70db597
SHA256ce8aeb2c43cfaa7c82fd528f1df2982dbc4ba342ef3c21ed1337b9bf3d51e5a0
SHA512eb26424d0ce30bb5766b9151d35b835998aaedc76abbeb22ccb7689d457acadeacc859f59164bbdc70072e4a6c55bb1fd5d0bb64f2f347182814954bda4e1c14
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50e8bbfad782e721f6560fed75004b0f0
SHA182ebc08437b8b46460bd1da8e0e829fef32b94df
SHA2561d217e8267ad040417026304d791a17c3b268f5597d71ec20208ec875c68d603
SHA512a1691709a51e1e9c25dbe7693a0f8a8fafadb7d4af6d5f024fe751096e38e5842c08a6345d8a1a6eb9ddec6a2b256ad9748a3171e79e2c7406e0aa6923d712d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5195ff24bad1004fbcb59e2dddf0d6bbe
SHA171072412c1d395707385c4a3926c14040e38bef3
SHA25606b3cf136de3d9af80a5d420184750a58bb8aea369e5fee78534ceb5bb77d20c
SHA512c51dc9969cd4192f6405c6454839e9c4663e9bce3c2b3837daff34d5ec94433f67f6f9d7c23b37d79a23a63ee01f99f3dc73ecc2da039b54d3c67fc803145e25
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52f54321971ea077c7ce228da82d10981
SHA15c609eee926ef3adc44ac31f88345aef5ece6c2b
SHA256c57d124a1a57266320f038a91763f3b21aa20024a4bbea08e9259d634df8a44f
SHA5127ad504b5666140319711bf512a87757ee63a5fb6335a1796ebe3bfcef431c22c8cb432a7399fdbd1e2a333074793080d938cf94241095aaba2b779f7510eaf96
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53b1ed8729d89cdbfb7a80a45ec006f80
SHA175de6402fda39c1610a87f06f50f9c10ef2d8e7a
SHA256dc9b6bc3a1c1c7024369e2a2b696f441541e0086542f7a760e67cb5a248c1b77
SHA5126ad07c4a5415ff8be078add15a2840bd0dc5e242da4f75c349789b836517ac2cbfb99ed1aae5562170451119e3c673d6c068a125e1e332410b7d93c46b7447e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e462225a3e380feab51fcc0a9fc0e7be
SHA1837002a228528d54efa077e52922f2b50fb0b0f6
SHA25675c45c938376e62c7ba466ce801a4872ecc8e2f29d8d75d3a4b60510cbbd1fcc
SHA512adfb47c0e5f6818f3f06781dd8bd52eacb4119c1ee61174651f915a4f22b2f053ec1dcc21fc7b03637282555c23ec622324855e61848411938fa3999966078a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50b343f49a4b69b204790c8b6492ef3ac
SHA156668a330bcad2b8bdd18607583e9b7828aa4182
SHA25603d8c4dfb7e9bffd765cc04b38ae285fce9ba90136c2c1ef2c3dbf5dadd83a14
SHA512499ac78044a584cce7953ac7c88ba15792ecd7f2721a1a2533184971463bf779ee59cefa4fc4e3e14e113e95c70f1ea2358a433b277bada10f1c190326d27d3b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54599a62e89036ff4d3230ae6189417cb
SHA15ed70ee9dd7d91bd660fce039a421af19068d3a8
SHA256a525ccf430d2315ca7b630aa853d116952a7d19e92d4d2a3590d3aca39c0602c
SHA512d71f1632ed3f1ad3d9a9ce4e5e7c190acb292ee6e5024c837dd92ddf3870a52ed712c687acbfc09d71ae77d89444515f261d3b6742e06ec0841d9d0fd580b0e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5358fc500b27836987b6b4016459cf2b3
SHA1f26b1310d07a30d8e9f2e461f7f9469db2fab077
SHA25692f5d57f5a09309a664d5dbfed18eff0f65aa610f7cf7a6486fde6f3182fc72d
SHA5124dd2392c11c907da33dfae0dd48c58b3d3e90c3b3dcb226d50dd6b3e5b67ecbdf012223d00a722968a4ee8829479490a4a1ee3a753067f4a08144998865bf8ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c1a727ad791ea60d9b33483ff09d1c60
SHA129274d3dc8e77da869d04f8c2e65e1515bb25118
SHA256dc9e856d2086de585c239184d9b249b98e9e4627bc7154b49870d003aeb8ec52
SHA51246b72872a31310acfdb8c3facf74602a4e41c098f1b85b8d3f46f4f216f96bb6a646531480bf5f4d5ba24aa253c8c2b913ecc3cfe71f70bca3442ae51aca87b7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f607d7f3efdf119c1eea9ec4c555e56c
SHA1693591c711e12286513a65e4e837115ad7a0e94e
SHA2564038a3df8104c629d8fe1ac655d1df10ec2b107bd0d799bab2996bc08268bb7b
SHA512366608df6ed9bdf1929f7e9ad71564107cdec449296027bc889b3bcf2cd387787bb6cec939fbb6824c372cc81b362ae13fba370a51d324b536c5399193787bb8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD552bfab0c4bdae04cae5587f325b65373
SHA1eb8af4633098278652c697faf4901f3b8f6fa5cc
SHA25656b1978c770b04ef7b2518f6dc3ddb5d3eab185bba3f34929952e98e60f1833e
SHA51256d0e53e09760896a0cc46ff7b54d1a693cfce9053e8450b4a963ca199d7681a838a9a7e38c7b0f3231edb233bc3b48f96b6f5fa8a964949798e36ea1261e261
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52b456a572f3a5865ea1ee79ef4178d5a
SHA11650ce76375d501681b4eb62addebaecb741b4fb
SHA256d2172ed1f5613eade0f67129789a9e09916a53e6927e8161dd68a31d74a975bc
SHA512ddd8a5ec940c3d8e8a0dd5c61cd665a6dc2dc6d3619ab47af3d1a19c451d6e0c80fb1d7e487b31f5f5ffa8025f33a2fe1b004309f8a04b407eb2c95cbe5457aa
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a