Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
08-05-2024 20:25
Static task
static1
Behavioral task
behavioral1
Sample
2695421c0b583a48665cbb0a0711408e_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2695421c0b583a48665cbb0a0711408e_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
2695421c0b583a48665cbb0a0711408e_JaffaCakes118.html
-
Size
16KB
-
MD5
2695421c0b583a48665cbb0a0711408e
-
SHA1
99857d5b8863bf4f981f7c5925d8f138a574b9f3
-
SHA256
cc030fad76fbfbf53bb7307b602ddec4f914afef31c786fb4154fffd75ce3f9d
-
SHA512
e85bc31d913024e6220c42140c446bb9cb0ad27ca01f74f36103ff792e6975a8e8819e59f6a5999201e756592326cbca66b05831435dd73d1b4b891b9562a9a5
-
SSDEEP
192:eOAl2z+FkIdfFXhlC2DOY4mgHueI+f5SIG3ajAUna4I:ht6zDqY4mwuB+79AUna4I
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{26195121-0D79-11EF-BADF-D62CE60191A1} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000668932f2db0f9ec9353fdb63c9fb8ada3e4b6ce2ce8d7d3f4be16e9c30f21644000000000e80000000020000200000009aa87cdb90c101e882c4137132923a281a7f34ee3b2c695b390f1c293ee9f97720000000d7c6fbbba365441cdf6e6b769726849b0d113153717f04b4cbfa297e5933366f4000000035a868b51dff9f17197b2dabb72583520dcf11cbae708543889e81cb9a4f78390ab7a63805af8f4027cc56dddd8cd7795b6600b47b5c8f69f67dc96adddd5c76 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1058d8fc85a1da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000000d289504bf0ba8cd469c13272afc0c686204dfc08dd16b17b092733a10d6d5f3000000000e8000000002000020000000dc4c8232b9aee95cb8f942937dd6d5c5cba635f69e95d1b22b24817a8c67551b9000000089981928dac514d10a7d3be82326c26278b6777e55cc5075e97f16917e99ba925d3a629ee87da370658381d516b75f4f4add9fd830e9da9ec39d56b07a11a2651ca198ef36704ed297618dd3af454305a18becf706f21521970cb4c070e444ef4e263249e4575e8baaff29bca6f91b341e3e03373a1204abf5bb6c42f17072413578bb2514d892cc697fb1408e51ed6740000000f51cee1b13cf9e356cc90f8c28b68a173da5e89c2b692e304b215c68855748ea29cc1164317efb2e7b546b79bfa03ddbe8a405230d6702e8a60896f272858139 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421361812" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1284 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1284 iexplore.exe 1284 iexplore.exe 1996 IEXPLORE.EXE 1996 IEXPLORE.EXE 1996 IEXPLORE.EXE 1996 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1284 wrote to memory of 1996 1284 iexplore.exe 28 PID 1284 wrote to memory of 1996 1284 iexplore.exe 28 PID 1284 wrote to memory of 1996 1284 iexplore.exe 28 PID 1284 wrote to memory of 1996 1284 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2695421c0b583a48665cbb0a0711408e_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1284 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1996
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD598afa116977c94fc42604cee8487455b
SHA1f7346ef870ce6b72b4949ff9c7316acaaa517fcc
SHA2567d070031d6f0d52ae80a655b78b83c0e756985efe000f588336549a725efc262
SHA512f9494e2d17217f7a4a12dfbe89b75f598b0f3d1bdef63a22e4ca22ea0836242fea35f2b79d30a7f7af80c16c07a6057cd81445a9f9ddd9f0c2ab824f0ac70f7a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD581a610c5496dae95abd205832fbe3222
SHA16c5897700c4201f041b999d54dc083979d17ea95
SHA256028050d6c1abbcd8bec76fcf0003a14d9ce4675f58c5c532145736db10d38078
SHA5123e24efe79e416b17c067a8696e0ce4878f1181fae388eda212b2d13d1ffd7470c44313a1327ee8f92984c510beb658abeda8ca226a406351d77c310e80e8f62d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c99bf4df7b5796982688b2b6e115bf4e
SHA12bc463b5c79750551b67f22d636801969ce8aafd
SHA256ebf714e046def2cdcbe1a938ac6093ab3152ef03ebdedba347fa549d93593fbd
SHA512609f0a6dc0085eddb28709b44d30dd71df810dfac20afeed66f423047f5f9edc0671202684c6e917068a3200a4c5a70ff3269b164cafb682fa4992a005988a9a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD530ff03efb17e2791f1585858329f840e
SHA1df7fedd6db329dd7c45ff0f64bed59f12b9e4168
SHA256cfdb9a3b9c01c3cdfd836b2e32e5a4fd8bdd2ee047304d9d8beae17ac7a23edd
SHA512cea12e44635f87722ec6f6527b594928b0bd7cd0414e063edc3145f2c3ef3c7d4e3f967fceec323b6dcd678fed0b9c37c0b86a7fad8ed3b7469db6c58c8e5e26
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f44a542da71745927f1fd2209e12cfb5
SHA1b62f59798dc383a295d0f55137e5f202afd41524
SHA25699be0959dd38c7d5e5855da62f96bef706cf2b5b96b923deb8ab4745b864dcbb
SHA5124ef79f400885845fcdba14d3913add2c02edd0d9960f08b606e1ac4ec3ea4e102d6ff2060e96af993777addfd8bc9219812d9efd7c59ed646e0dca65f90350c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5465da1a476cf39a83d67a17b1819de17
SHA16aa3aa6cf0cb610f680939cd7137c6c3ff71896f
SHA256316a300fc0578d3a03ed3b675945cdcb2e51e6419cec91ab2b32fd6b0b61a014
SHA5126c92b0eaa3bca236030f21e48474cae50ac4ddc7ba0ba68f21298d890146220090006339d2f9cc58333d66d5d2fd99b4dd3b701d7b56143733fa27af7bc070c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD558b9b79eda5ba95cb7067774372bef65
SHA1894802e268f970d16bb6b3e757b566a759bb83e7
SHA256837090ceb7dca7a337af19a7228d4ea252b6305372bdcc467919709368b928b5
SHA5121ea0f8d87f72a0baa0bb56e0f83e2ef88d00be18543f8076ab69441360c2e7b0396fd9f9321ad1deab683eec99b5f0b59c6249b3f623398db73d67d26c209efc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD545d5a6c7a9ae627bc44e0e6d5334c276
SHA164f9681e40d7bb69ed8b38319744a160c633c12a
SHA256ac06a90daeb4f26b9a4636d02d0756d8f606bcb06e0c677eb6692ab1f717dfb1
SHA512002661c4f219d233580717e06661d53c144e72da094ddab27f8a4116e927ab06ad7091e8ce7d8df5c399c1b36fcb2c96f2e068b968564abf6898a3e613b06d37
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51e003ec82060470b9a72285b1bbcf2d8
SHA1277c2bf2146b81a0ede861e8e04b7b889e7a7284
SHA256cce397025afb3d8b7b62d354b9d45a3c27a56ef4d39de0c1b7dd77fdfb566465
SHA512f8d40e0de43c432e49b3e2c473b32d65277b90ed7abdf65c050bdc8b573605acda565bd26c346e194d4807cf21dcbf910c12112d2fa2e8fa7578e85ddc0e119a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD567d8cfa93a1be934659b9b24c4b0e359
SHA1be22710430d88a2875617079dae01111a4fe4656
SHA256aaa70ff49aad616f1d52a94bfcb7a512fecbcc642128921866ff135bb23bc1d0
SHA512f7f07dd71dfd2e0356d2c2555992861313d21fc751c85c2f7a74c5518dced4ee2e22f814304d394205b17cad408a2f9bdba5bd9323bf0b4157e1384fb867a41f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5346535297c8d58bd21554518103603e3
SHA1ecf21b846816bdf20fa53f614e87507e57fc6eba
SHA2569d73e27fd9812ca25e4a0cf7f994501a12bcef7f254c5b4100ba070a1160899b
SHA51279400799f72261b72602063e810333ce29d5dbf1088f3eeef85af631abaa340cc14f896d3f1ea78228b3e455d959d48d90a6c6d93e486d21e08b372f9ab98e08
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55463575e1b4169e69118f2ec873a9805
SHA11e034a4d50294a09359906be2b2835eeb0b63f9d
SHA25667df6b34e3dbbe729e57e755aff40d195298991de2dd4a5de946d9c8bcbb309b
SHA512355dcbde05dfb7a768cb0ee361b4149e4b522291f76af72f2e198385b45e7693a20c52f6854d7e50b1655034672a53a31a79fee83c1f0229f4b965697e099e90
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5de643d4b60fc44c3aa8c0c5dffecd16a
SHA1418e700552c3b17907d0ac4a4cd36dbb5444482b
SHA256147a1f8cd6b58df3472710821b0a304d763d62d3f9af96f0b0f49941d4b56fa0
SHA5127c1cd80324df38930857025a08c1cf8a03070db71af2a3262307fdc2060fdafef75ec45a7dab5531573d9108fd5d5a1ec1a7f74a4f4c42b6be2d3d60732150de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b7f482f3694421d93769f504962363fb
SHA14288038f78533b5fb09ad6d47fdb4998fe2f6555
SHA256728778b796ff5ae5bfc75c2ee7401269cce9e17762cfac4fd177ab69506be083
SHA512ef99f621b3cbe4f8a087aa6bfe15e174afc4a8bc90d93c3d66448aca2c29105cd27c76d553ee4ce703c5dfb1aba9c0fd2e1c2e25a370b4b3044e4473a79da32b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD521c2e886d03f1e3ed6e727c7a0937feb
SHA15f587c7e7e8d6b6d7207454dc1e62546ae11ca52
SHA2564c63e89cb1b7ff7846b456db88ec3bf6bcb2d7cd1080f9f1ab7d14b57aab8060
SHA5120e5c902d62d609172ec2a141a29af9eb22cd9f136dcbea9366b7904652b8ebad7ec9a69414f6760ebcd82f810ab14a422b4499f19e295f6c253ac23558dccea7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5329a6e11c9c40aa938c09fc9481e6ee7
SHA13db7fba91efe1956bd37394b55d924f7c027ab98
SHA256f5aff905f5001c5adb4e0990bfa76468da942ffe59f0a0c09a7d6e5555d43eef
SHA51296a477bb0afc12f424f63e6fa02d81d9daf67f6fc1f0bf3501a3b3df2a6184192a87a0f01301882a419807bf43af9e8bcd67586f83a65e2c493f3e1d466ee586
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5532cd901f6253ca1ed98fc6247965f46
SHA1f8b78c491ddad26dab589ba8b320c87920f777a5
SHA256d0f20697bcdff27619e307076a19702a5b5fc6b3b69a92058536e09cdc978842
SHA512f1b5a7fdff048f5b9aac604c0ebd50983b12e6c733881d1bf8e5a8d7a6ea82e3345e5fd457fe652ddf094cd65f636182d01ddf60e7c4f726e6dd553bbb7e058a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ef8962cf16fe30e3babda609c611c720
SHA18ce5248569f0252d7778dd958f82b31840e24835
SHA25628a6d8fa65e86aef53df722993c2d0766aeb560f9a5d99ddc1ee50a1c80982f5
SHA51259193a12f1300a490df22d8418ff3518e00c61cee1106a0e7568fc84e88c378a91c43b3d91960c1f53866d39f4658525f80ac41c827afe32670bc48b46f94d02
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD561018467358737d4756c7070d6e91a23
SHA1fe34a28be7dc3e2156c469c660dad0472568e6fb
SHA256c9e9b5722a36b185b2e26132980d8b3e358afe639d9c397cc629f96d0cc55cd2
SHA5124259fa53db87e3566daf5fa7ec56dce54f77d1342d108f21a89404bf961eaa9857fb74f4cf46fc17ea6a2f9d5659c010b0676a553f954e45a64934bf43a3899f
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a