Analysis
-
max time kernel
140s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09/05/2024, 22:28
Static task
static1
Behavioral task
behavioral1
Sample
2c05a34e5a5040811e85b7ddd4fac60f_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2c05a34e5a5040811e85b7ddd4fac60f_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
2c05a34e5a5040811e85b7ddd4fac60f_JaffaCakes118.html
-
Size
138KB
-
MD5
2c05a34e5a5040811e85b7ddd4fac60f
-
SHA1
361d06d43c1fe74388ff7760efd0e70fdf7509ce
-
SHA256
537295840751a63955deb0770ffd8bf905e0dff04721cd416bebd855fb391c9c
-
SHA512
512236882fd18231345db50aa55bd635beaa879e4a07984cfa177d6e6d2fb27b352085ebe45176d3b6b3bdf4a55068064a2c5f467c221ae9dfe2df12432539da
-
SSDEEP
1536:SD79lcy+mlNdyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusG:SD7xyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000d1e463e6d5babc2460d946a3b59f42d1957f19acabc9cd6981f2f223b9f4db29000000000e8000000002000020000000c2febb923660e995498c676c767f6fbc16c27df018ff8312df9a3015de718f1320000000f08a2350efdd94e2329986fc7aaaf8a41c051361d22869ffab90fb07c3e5a41240000000ebbe04354ef8c2a27c439a3b13fb50836d5b9f92b6b3387b201dfd5a1ebd69a3d2aa3a938078aa0101ac319a767567d963f95684b9b07ef6f01d33a35e166786 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a020817f60a2da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{694E0551-0E53-11EF-9E38-E60682B688C9} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421455556" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000006c1b2c54d72edcda4d0a648a71ca69c3120b4c6277470da22dd199d6bb313f4d000000000e8000000002000020000000bb8e3e4ccb4e734cf10f7dcc7fa614805a1a68d5988da4d2a77eae3a0d75cf3b900000009c261297204fb1baeacf0cdb6beb3b01156dca0d6e11428abfbd99bcf89e524298e47cb1b483c4490528bf5344c1fda95db5b1ff8a29822b3cc35b3e18893f90677b33bcdba1d1ec2962964a3f4d4999f2b0752180b885a360a5bc442b4a6653c00cef4402bcd961615e06d008c18ac25b1814cd5fa8be4c358e22f5c38462855faae9292d391ae7e0d2956908ab750140000000a35e3d0a316d40210b12c49e31bead54af0ce6500cdf4bfdf15047c488e6cba31a1ec024843c5af8b9387bcbc6ab05396f6a53268f492045547295480efe3a25 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2876 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2876 iexplore.exe 2876 iexplore.exe 2540 IEXPLORE.EXE 2540 IEXPLORE.EXE 2540 IEXPLORE.EXE 2540 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2876 wrote to memory of 2540 2876 iexplore.exe 28 PID 2876 wrote to memory of 2540 2876 iexplore.exe 28 PID 2876 wrote to memory of 2540 2876 iexplore.exe 28 PID 2876 wrote to memory of 2540 2876 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2c05a34e5a5040811e85b7ddd4fac60f_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2876 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2540
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD549570cd739da47857952d1e1d2fee998
SHA16009a481611ac54ac0d28eb3597e3dee867fe879
SHA256ce2386bf0462413ab449edcb5014f0c691cbb79d229c162430cca5b83bd38101
SHA51257ef950d64ab97b7b189648f8a05b2342ecf3d45ed22a692918662566bbe517c3991f0b3f8cb0a295bc470ad8c17ab5ead596aac1bec259efe0c3b3d4ed4314d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50f7288ccec77270d89bca3e553c773af
SHA1055b1138e5092e7886b920840d5267796bea3e07
SHA256fc9907f9b2078aebeecdf886e60f18477e8dbd3553b37944dcf029bc9db1ada4
SHA512e6bffcc62cba6296892276b2876500cac68924a3a268cc6dbb4dddc2deca595c74ab595ac2f0c918cf5faefd4ee9844f80bef8453a78106d959e8caa537c6169
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD551b91b56aa16d9541ecedda2c65687bc
SHA10a42712dd4a847e7f76b9fb356bf5eab14f51978
SHA256765efc1570625de3da05d80539886f6c6c43105f359167ec97d26ab52e30fcad
SHA512f7ac5ce6bc884f92b00cd812f216b94654de0257561e7f22ef739a86ddd3d9cc68b3e481f7036052ab3da0ef6627af2a5c4d08ef8bcec7b165672edd26a9d829
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD594532f767a17c69ca1dafefc9845fbf1
SHA1ff550f6d20169fd64702d1dc43f66aa9b8847a3f
SHA25612865fead07c80fc4db622d2c9a5bf6be0a35a70ebfdbebaed446bf840b0c079
SHA512191e02ba6da4e6caffe54f87f387a9ba0e633d807db7a41123a2c6d26baa60650e711640cd7196834fdf2d5415c774407e821aee5243626d13852de1087a24f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD552154f325601fa6b052dc7586ab362a1
SHA1b46434a048b0483644bafb8b0b90641f852a3833
SHA2562ac751573b70f013c3d758b5139be8edf6335d76a5be6f397580818f44c3aa73
SHA512191ca6c92e6010ef9d7217b2bc004a5d448ef7d636dabe204ce6b003a5a367c48cc3b65e219bfdf7ce03885d2eb8f901f9417418861983b4c214f2b894fe9807
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD581a40f504764ec73db5d5ebeee93adc1
SHA1ef97ecdad65e9e8bd5ad0225cb5024f6f7d81279
SHA256efeb47149cc8f02a3dd1931b46e7169b65c983d37225b86999bdf02b961c7f6e
SHA512fa0404ab93ac9513e075e74c76190088341c7db816aee09a23d7ba3379fba7bb0e5378426f2673e6719237b8b9c8211fc0d3b2627bc728fad197f3a07ec04630
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dad43e0cdc12c39c2615c101a0fe6b62
SHA1b45827167e0a504ea444efa77d32da2de8f771c9
SHA2560a53618bdcc9d9de7474c69b5390a0350313ae22aff567437c02da73263db9df
SHA5122721be3a0f213bd8b8f17cd145a76190f0a5d45712970cee658f8fd04dd0f8a703ee60c10220befdc34ad7f0e269e06711c02aa7bdb3cb80360e4c1e1dbec56c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51b3d5770cdc6a4aca506a86aa276b5b3
SHA11c94d99512dfdb84acddabd08ed5498b5dc31d5a
SHA2563f8046d89490b32ac276b1329ea9e861f9cb44e4e7f28d1c1e7b76add338a0f2
SHA512f86d09bf0a2874a0aecae6aee02527d3246e4b46a23592141e73547d10ef520ca40ae5bdf5b05ee76e07ebd44af3d658394a2905703004392c29068f5ceb96fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fd7e8c5415aecc6a562d4aa08e7b3528
SHA175553fd3b76ca05d0bb7e7ea4068c7bdf8dd190b
SHA256569ede38ddf5be617bf98b47e966e0bab22ac56550d592b5eb2cc7af7014314a
SHA51217157f45da72da6b230333ea95f6f528e2eab99b23b14b538737fa31500329e70c1b201c5cfbff8b3db467194454715bea267da38e3ea40d260f2ff54d3f732e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD519d56601c8ddf1050d51ef49adcf2435
SHA1edde82cd1429aa51c61cfe9dba8f1e04218dea57
SHA25668cf0faed7e299b0651dd26ae4bf158675cb9f425325618cc77377a49a4dddef
SHA512ef5d20a24484b6ea6b94bc71bccf5008bcae5d9f2b843836ccb03900a8cce999e07c4c1b55fd5567a39e1955c25e367c9a5f0d785f86aad09d2ca44c3513f62f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD551055081d084b2bf7e4e57dfcbbcdb02
SHA1cfc3d4a85d20596f07f54c71ccbbe2df0ae4f630
SHA25676615e2f02a03c7c166f3f23ace22c9fae6a9b1f1346f2aaa5ea8f8dc6093cea
SHA5122dc88d1874f418fca952f5f715f74874b8e46f20875c11a78d04afa438be0603be538cea68d08fe8bc6e0f1a7b4796242c8f81d2382ce5a7a7e530835e6ae3e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d31f5ef76abc7b916ee6bdffa5591e5e
SHA19c7aa56887e16e3c9a48c12e4f08c1f01c4e46b5
SHA256fcc165151fbb56dad36693b37163a46026a80e73263a257b3ff1a194161d1bf9
SHA512e2e8592abc1eb9d4923f49f29f361149b220a6181f2ce909b693e175180833b0d2748a6b9d769ec5aff6b7fa680a3aeb6e6b548589c88e55d7e839bc7909c266
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57fe6c79b1eee7a974bc16e12355de34f
SHA17036060f6cb2521000add0d30936ea1533fa53b3
SHA25671a561165c1111c583e33f8abbec51677703a0d45ff319619af6c143707192ae
SHA51277f94a9521a433923cf8c2332fd11678f3439beedc3672b4e5df4235d628da71cfc8fc4c29eff9f0b4ca53fbbd08f3132f044ade42aea125d7358ecf11ef5b5a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ba4becd6ecbdf5730156e0e2f24d7e48
SHA1059cc7cf6d5c799d870b233b6b4d74e34200540a
SHA256e074ae96e3fb65f7812086110232192ca4cfc042d52c17f96627b2efe44a47f4
SHA51208e2936ae17f29c3f483c78b6346bea19cea058aa7192830de17928ba656d88220914c4d6963b0ad0116b61a87af7203c845e25e4c31067572709b453eb2afba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5750b3adea4724c51335bed87d73e6c7d
SHA1f8a242bb4381e8c4fde4936bd4b4fd700ea84f20
SHA256f92b3e27072ab3d2ae05352d2a6fef9a54bfd5c0d3a768198acc8c2d2fdbb90e
SHA512206d9c69a97f7c62ef1fd7ba0d2fcaeec2bf843013ae0c4ade3759256a6970c6b4f46d3917cd6e5b7a99a101f090564ddfa26791d22bd2cfae75d8971bf2ae1e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d1077ae02a9c238e419d6a5ae589cdb2
SHA1f70e70929762dc914fe4b2ed6d861b201a88531d
SHA256ec240492d5da3273239b6a8274e0d369242232fcf7f7592a7fb99919ce203c4d
SHA512985192a0b55d8a0ab57668f6c9a10d055678fc55e779b4818c6656d6aca82de1fa37cb96886b06bec96b81103d1a518edbf6787a7da0bfe88d65e190022ba89e
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a