Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
08-05-2024 15:03
Static task
static1
Behavioral task
behavioral1
Sample
2566463f1ec13c5238007f7074185283_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
2566463f1ec13c5238007f7074185283_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
2566463f1ec13c5238007f7074185283_JaffaCakes118.html
-
Size
23KB
-
MD5
2566463f1ec13c5238007f7074185283
-
SHA1
06563ec95ea63d191984f6878bc0da74eff2e893
-
SHA256
23e555c1cda5663ca8eb946b7c3fc818f7dd20c280fcd232984ac17744b32c91
-
SHA512
d7dcc86d219c25c55202b96d656940897d9262ae0569841d0f28dffa62a10023452f4e17fbb85d6c9b7aa6444f47f989ab2815c12152a71995cc28069693a2cc
-
SSDEEP
192:uWrwb5nPqnQjxn5Q/WnQielNn2nonQOkEnt6MnQTbnFnQrCnQtRwMBFqnYnQ7tnG:WQ/Unmz/
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d01ee90059a1da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000040b85753852c9b2c32f38a44c9a579fe4dfbe20d3ae550f390610f9a9a335bfc000000000e800000000200002000000010c6edc3eed6a294721a72f7b0e9bacb22d8d42ff1f3ac4c500096cf298a6a432000000048d84d4474cc64cf45b09ee29f34252c2b2a2ef5d559f0a1c7e9cb489c83e9d840000000a831d80bd16a9f363b6c5aa4e22171aac4799b93fbdcfbe241bde165dbba0ed0207e7f3e7a141185eace308d64ca3915c05a7fa30f1596516bf7a87162b0a9dc iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421342495" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2C45E361-0D4C-11EF-BDA8-6EB0E89E4FD1} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000bc1ec90e598ba24f1aaafedea6f26e1055999e8f9a331db2e8b5bbd93390576a000000000e8000000002000020000000909e0499d48ad43b0c9904112a3540db7998f3078d4200b55ad847756387a4b8900000008bf2226148c19e3050a9f7d86eeb9fa20306d473b8374092f08e44f96b355025925b49e08950a6ce531d7aec03d69ebdf571cef5d6b3226bbd7cb199b8f4cef2f2d948b03c2c5373919860b7469955d2483dbad72cebd6b1298a6fb218ad128116d496ae5a2caacad3cccf71da415c109004b114deba612c795d73a642bcf972712a376cab1230f99a3b8a93a30834484000000036de829dc9be245cb220e39d2ed87642baa8cd1307abcdbef6e34d70efb652fbed2f24e3164d1fdb087a48e86564204c6a1a44a4b07a26794aca6879ff420f3a iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2940 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2940 iexplore.exe 2940 iexplore.exe 2968 IEXPLORE.EXE 2968 IEXPLORE.EXE 2968 IEXPLORE.EXE 2968 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2940 wrote to memory of 2968 2940 iexplore.exe 28 PID 2940 wrote to memory of 2968 2940 iexplore.exe 28 PID 2940 wrote to memory of 2968 2940 iexplore.exe 28 PID 2940 wrote to memory of 2968 2940 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2566463f1ec13c5238007f7074185283_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2940 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2968
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57279e654162c8c3c392a3c48549bd1f5
SHA1e51b815d1c46b946b30a882e49e342689c4d9f32
SHA2560325332561954519fa90a1ddd664295fa25405dfcce41534dabca414287711a3
SHA512217730b062a0c7ab2e34e6b34db04978bd5b37391034e741836163f80e72826ccb8f9394ab050fbf3c99b6f4b0b40143f1918bb2476127902c0ca4ca35c13d5d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54ceeb131027041bdc5317359abbcfe97
SHA1a9e861dc7a3569b1a2eee56293be7a5256c52cd4
SHA25604cb0dbb083f48da0bbf98e0fd6ac4e2005309367abc81cf3d65ac0833d27b2d
SHA5129c7c7f67d4c71d9e130c02a4d41ef4cb034b26bd405c7d1e4f0faf190744d5b8c6609ca5392b22538c6de195c27878224a0ad9e768fac308977337d6b69ff3c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57a9037fc2f3383e5a5fb3d4970c5ef22
SHA10a10bb9725ea2d32754d1930c4c5fc5e048dc284
SHA2560ce41a305d54a9c33bc2bf8d87f87e58847075ffb5c13656cc34e4f13c12af0e
SHA5126e28969afc30efcfa18f6a2d21e97a5811add6e08d5256a6a6b787827857e334797d4e608b602321a29b170013ce44e010772e2f8d973b6f527cfdf9a660499a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD594e9763affb3ca83e91e218c58c10ff7
SHA1016289e11f31e285d9c5929afbf9086a3df65bc9
SHA256ea377def13db24d1413cb84077fde999484ab0b3add586e7b14c229d9a47d02b
SHA512d147bc0d300377fb63f7506020c796a9efe2217ea2a5b89b2d8fa59889cee299e1a09b2083e2aa412fad6191c18cf8adf4ed8288985468559e9cb078a74616e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54b8f5cffd088430069d038480f46f029
SHA140bcb2fce8bfa4da98bc6371a3f98801076922d5
SHA25613d95352e9871b42d1887ebe18a7952ff44a52a69baf92ffc826945cebf39ee6
SHA512ee1025d6de92fabbfeaee1babb7ac4e14d61d47e3f0a182b48f25a20d803565523dfc1da46002ef9324aa80f890f099e466ead10601600fa67b6bb716592c8e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ca5acd9b064725949e00658f5aeca845
SHA1eb9988171abc33bb26eb08298e538fa1f25322c7
SHA256481796db645fc82f8f3ad6bb3b8fef4a742fb1e2ed4b553fb685e6633f228fff
SHA512c874c20dd30229c1136a52805452b8568f20d5947560d3823baf72eb6e43e960acfe914836e5d1e62f9ca5df16a62daaef95e07abce0a6ea2203f4f08f0b0bf1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58ac5138adb73cc1268e582f648bd5bc1
SHA1c88098ff6cbea616b70efec8d13c83458d5503bf
SHA2560c80131f506cbbb2506d7a786f1ee9104bc6d13a19f4db2e4ed143f01951dcd4
SHA5126a62ebc74b0c0272f114e19daf1e4325b9b63ff4b0b823d9a2f85419571132ac643a8dee098377983a56dfcee68d92a607606225c9018c6d8d2ff43ec1820662
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c4693ba193f29857f05a63300125feab
SHA1ca0d15347285b8885bb71ccc09f523bebf41c6b3
SHA25610c7ca978ff8b7abfad69da58d57e7eba82d31268e015e4130b54734999a76e3
SHA5121e3d24be49d4df2f1292a16d964e38f0f866ec4c2007eb639e31e9cd216aee606b86ba6836b824453edb4661cb8ba1984b267c189e00abca0fb241703e466582
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5043ccbbaf9e99d04add22317bc4e1add
SHA1b4d94232ba6a75311cb9b928a0b2ee866e51d250
SHA25615e094e42ec199b2bed912de735d24b0541b24c0dfc405c317e68d071ca577db
SHA5120cea249bd59661467393c73b922b2b4083e5ae96a28d760bee17d3077b0e7494ff61de62b799de82d4caaf2b2c4413252371da2eac51da5eaa0f3cce498543d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a73a8e74a59c062e4f6cd9ca413e4d3f
SHA10b2d61225a7dbae92ab17f6b5cb7cd2d9007986c
SHA25662953fc64d825159851c4082ed1f6d757160de9ff351e75d5b9ef9b1b74764f6
SHA512979aade77e1aad69a03df94dc5626820511d418218a8dd66944e632b064bf9b88c318cbd84694b8c9d00a2d2b704c023a7f41443ebba11ca7af8ef7af750dcc0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5615351470708d4536846f169110283f2
SHA116a1d9fa2ec4af11c32d2b471fc1aebe1b6201c6
SHA256132c4af35fd6925e5c117fcab76998973863b87358da6011d1c6b5780655029c
SHA512fda4122332f063435eb575605566160ca2d953a80ebe0951ac315c6ae1c8d08c6e6bfa0b7ed08d180380657a7e2c3100affe24226dea4b6dc08289d461df9c1d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58de948d7953941647c7cc4102aa3477b
SHA1a9242e86945753e68e435cb09bc12d6020ffec00
SHA256c622ca2acc46000c781d74a3c8f4588967473616879ae67778dce2062ba80517
SHA5120ee4dd55ab937af28919e07e3067d3d978a3b311bd6177f5660bc68a139f35f8d0ff685e8de5127c4cec438356d1742c3a17074142d01d47f2623eebc32b6346
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5201d93e399e68515cbb51aeeeb162096
SHA1f04131fd4052568408897d4a45c97f89f39fc9c9
SHA256260a04ee04b448ca8a2151da226fc7f036df28d598aabea03e596e93985338ba
SHA5125e6bd37704ca929e6e7e6822819178ec812dd9b7a11572dcdc20c77fb115f5282a55b062a3a62a4fb739607400ad4b9222311a800f20d5e27941670fa0573970
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD549867154c49b9074aed66249b9c4d14b
SHA1492a63970dd9598ecb5bb0d3ec6fb2dcf1789d2b
SHA256ef78ca2d0fc4866c27004d39a1d46f10046e3bbb3d6606c4d829c68fd0d0c654
SHA512b82dc8fbc3a654202516d055a29d78e718398131c38ceb5570037b4ee8a8324a9ca2c28154aa2eefe48b89ceacec7478853d4f3fac721a1a909a49bc2147f565
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5edf81ed8024ee4ca0a3006babe893fde
SHA162bd101e5eddc453be21290eed649b8f1d26c719
SHA2568b5a96c48e829da030eb8df66d88c92b229f52419cf33adc374331b0afee2ca2
SHA512e7afc1e60ac23d373d8f1e15ddd4758bcdd91aeba511b6222e93ce55c0407c6043e266bbe5bc858eef8aaabb518f06786d8b443a2726272ecb939d5caf153241
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c7e8794334bc75288c9bab87a0811f04
SHA1bc22b67d5021c97f58028d220b3665c00e233650
SHA2567dc9a0c49c8d1cbfdf94f9db144b65f1a560217c440a5632ee423dd7399ea9a3
SHA5123b31214e5ad680efe6f85f15db9b8f7e1e0306230030a60249b24c28d0f48808c9dc3c82c6ad2de4fe06806690bb964da2e7a57bdaaa785ab1a1bbc388d9656d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD561839688757a93b5b5947d0979b8c067
SHA1d18b6a5cafa3822e1d37a7bd5d5b2176e772d663
SHA2560b2581c70c6d7d056af727454b6e56084f319a0c6e22c320e7418a7a1ca465ed
SHA51240eea87a4f84a96fadbd70fc3286f28142ccc8dff59396663de41a49616749fc5a63aa800623d79271996935e1138335bf828bfe7e82f0f6fc5df9f9f28c3499
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a