Analysis
-
max time kernel
132s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09-05-2024 09:00
Static task
static1
Behavioral task
behavioral1
Sample
293994bec3390184456fe6de114a15ad_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
293994bec3390184456fe6de114a15ad_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
293994bec3390184456fe6de114a15ad_JaffaCakes118.html
-
Size
20KB
-
MD5
293994bec3390184456fe6de114a15ad
-
SHA1
ed423a16c3a54cf2ab0a9a18a2bbfc46ed9fe212
-
SHA256
12dae66910e34d8208b8e01fcaddcd7cd7f0bf02c047d8352c49f08913e2fced
-
SHA512
7a063cbf979982491c74ed754c8220a894d88f6e12903912ef70f97014098facc99574055b670cd4eb000dff6f4dddcd04e9a8b3cf64963169e62e7c8b802c2e
-
SSDEEP
384:tpU4N1G06Os074RaTc7DkM/ZUheVe5du7D6:tpUNhOh031OYVud+D6
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421407121" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A459B841-0DE2-11EF-A7F1-FA5112F1BCBF} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000870f28936841026c71858479e75cfaa8647bc150b374fe8cddbe25f19eaad19d000000000e8000000002000020000000fdf63d2dea257963ae12fdd5300afd24507ecdc17192bedf96b09e4c61014310200000006d763c4a636c2dafc1a46808156f01ac5d2842539f03b446b14c7e6171ee1c1240000000a435c68c7ad0e99d6f90fc40501ec5abce6a2c898e04faa6f4eceb66b90be3f11bd6b6a2e3692af1e9d7bb70b8c233c2b518a55077b29d0ca73a9640780c955e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000009c41f9659af98070dbdf10a6a106922b9ff873a311b24a1bdb821f5f4f662bb9000000000e80000000020000200000008fb7611419e199a49de344bc80d01dffe5f328faa9f59528f3ddf07b4bc837dd900000002904fb6fa1c7dd01ae010b0106d35a2a001d1b11290e9c8a91ec452c9fa89e1f2ab8474ee556c074b55c6fc532645a1e4f085985410570a2ee3e410d6e22995acc66293551b8d8e87223cc986ee31535eb8da00da188bc5680d5ad04a836c637f6c5b44ea1ff1c88b25837508ef8de39f58e82c841e07855a9a36f1ae23acb1cf2de1acf95017584f16687ea6043fbd740000000cbbcbbb7bc5ef902ee1ceb69d066a0bb543d0728ed9b47b7444449daf3f4f22a942fab3cebb10713d9d1a903daf7e1e674418de1bd21b7366bf33198ec706c31 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 306fde78efa1da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2352 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2352 iexplore.exe 2352 iexplore.exe 2340 IEXPLORE.EXE 2340 IEXPLORE.EXE 2340 IEXPLORE.EXE 2340 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2352 wrote to memory of 2340 2352 iexplore.exe 28 PID 2352 wrote to memory of 2340 2352 iexplore.exe 28 PID 2352 wrote to memory of 2340 2352 iexplore.exe 28 PID 2352 wrote to memory of 2340 2352 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\293994bec3390184456fe6de114a15ad_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2352 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2340
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55ce14fef1f6427fe38d837bd30a02416
SHA131c35efbb35ab9ec80d8e98dde80211bcbbeeb5d
SHA25687f18da147c4ff7521dd1e4ca188d0a4690ef20eaa5cc49797b1c215c9bdfac8
SHA51223ae3e99d31e48750168377e9aa718d89468c6aabb5ab2d10f7cf0a6b6bbdfc0f2e5efa18b4229d088505e232e86e6fcde178bd36ba5914fd6c72674e36259d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5369d8ca1f6512d08d57e77d952d0b8be
SHA1e2435115209982d2924ffe9195068d99512f576b
SHA2563a7a6962c9dc4b8737288d83cbddcefb1e684506c959e3a5398f56a133491d60
SHA51223b502c17ecd9d8fbb8a7c4fd267962e10880d35e0b6a579e0fb39ed48f0e82d105f9e716fa2aa272293c10b4759d6cda041dab8faf470c31b1995e3ec573471
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD569086f2d6c4768ff227ae11bc0d9f699
SHA1ef9d46acaa26e16e3e87aa249cc5f9ed78b911e9
SHA256a5b5d47a3483cb8a67fe3c7e857cbaf8a5348519ef23f0ce281eaab36c74533f
SHA512944402ff844fa0a67aec5d036a7b2275f3140641133df0decba335bf431566173e53c2213f25b074115b1aa90bed2afa9d85189e86e04ae317ed207e9d1aca14
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD530397e9d9345bb8940e8b183c72f34d6
SHA1e3ff20162c54c2449299439b0e8f23f7e9ceacd6
SHA2568106464c156436f82b1e3bbcea79e3ea5881817112b49587448b8f989e21864f
SHA512461d3e17cae87f72d03d9baad16753fc3811a00098cd2a0a618570843dc583e29e9fc222c4cf8a5f1d2289d1837db849d6994a3986b3e1c471cf153fd8edec65
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD569ec5e0b38cc123d9572ff9d017dd95b
SHA179a334daa37b92b99af67136c02d8dbdf552e275
SHA256b61c12cd1992e4b05e75cb6c5bb872e40fef5272232b9920c0b92896138a90c9
SHA51253090df7e3bd16dbac9d10606221c22780ac5ed9929780ff108c41c2782603da6f5399497bdea3f66dd105cc974e0ce4d33069aa00886deb602241c44022c910
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c4a0746ebf51c04c4139130eb8ae3a46
SHA13a59eae9cd635f48d53cd01d22fbd23343c19af7
SHA256911a73d76a444240d693096d2c2182579390abb08f0dbc6a320280bdc58ea741
SHA512982861bbb586a19c25bdd0b2b03ab07596675e858720fa6ca54785b55bdeebe5f92c0c0a1423de9ed4f34b0cfd76434fe86272e1cafa87ccecf48e711d58b1cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54d3b85a5744a27ed52a6c6a0081f76bf
SHA1bb442db6be109ff9438520afcd0c2d0444907fc5
SHA256b8022454581527343ef5f11dc2c49afa7c2e8b8de1aaeb71085d61bfc19527c2
SHA512fb8eebcda97b70f7c993aca43420bf6aa5f6c3dfb817b1270b16b55c974e956980da24bddf0c7c2c0d9273790f2f553c86cab3afc682cf32b78df314b80a7431
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5874ec6def43e3897972b79bfd4a49095
SHA1c1b7528288419ac2bdb8cc696f44dd64c0086c44
SHA256b037f64ed2e450c9838d58c6ebc9b9f5b2c281c60a804c0ed9962209f45ea889
SHA51224e5f9ceac7fd95537268ba77d143815ba7772d8b6083fdd203db14e47ff446d9967d20796c315189b0b8702f464135fead480845cd7ed18d5141836450e84be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51fa41aeddf1542f8150204d8e5c6ad25
SHA1f4e3c4cc287c03d8e0d1c496fc264a6b30b1724c
SHA2562670eef81cb47f2f2dc4ac9716d17e8719ceb72e378be8016f2662f24d712c53
SHA512c972a79419dfff843318111bcea45a87b412cf64121c068525ce2aab125be7df2ebfc977991f20bad6da4a37f2a6fe003595496af2da3ca31c0e66e948ca55df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c071826dba3ef601913d5498e562da60
SHA1997f5220bcdfc85fff2bbf6a33e7f81cac1b7221
SHA256d956de5e4a9ac9e9de9108d51909fbcf9942c8cef0b32cdd515be19651f21bdb
SHA5123d1d35245722e48e5873e25a85e3b957e52ce378cb427718f64d42423785a2ce63b965b1d75367874c722ca94a1628d1a00638d38bdc801dc23ee0a9a07e7e4e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e12303c461d31c6e6367962929dbac49
SHA1d18276421688908bd829f76fb2db299e3d90aae1
SHA2565333d4469cfb360c45236fed4a2b8c0363b8e86b9f6592583c566d814dc207a0
SHA5122015bfd159e7dae7c6b4b298948547ad5e8a83ca2d0f5bdca5b62aa91b64b56f55effbcd20ef4b4d9405f88ddc8d55f410e7f2049a09879c03addc4ec55b826f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b114f76e8d8c303ff0b35d1a0f780b49
SHA1c60fdf48dce0fed79ec095a42b77533a0bcb4881
SHA256d23210701aae0bf0dc1e2b2bf55ad2863140ba6f0a1160084992599eac815372
SHA512340a0fecf53bdf92441c039a78b7bcf54a8dbd8533638cab9f126d9873f2401f7a1f67a27a6384b6dd0683a732797b6be1ca765783c24ab680a9360075c26209
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55451cef69ef2b07dc8afcd335d79d063
SHA17b19d1539946f0b274d799814f3a15df75647d97
SHA25684bd0a2620141cc4f4c79a187e56ac37c8e7a8aa11dac6bde097f41eb301a626
SHA512996ffae9617cb837f0f0603dd4c25207d2adddc37b816882e968bfd2a46f6723d0659c015777dbb84223e6a44ff95d7de74ca8cf2368e411ebcf2015fbc7af82
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58a8726a50d514c6cdfc0e31ed782eb08
SHA1760d136861269075652e297a503a18420f0a42a2
SHA256ddfef74e73688e299068021fb72d70eeff65ba986d3a946c650e994261badecc
SHA51239e373123e091def001ce8bbc6927e2ecc7b699f8ea970f6b07c0e4e3e376710c614e779c99ab50491254c7d77012ba2489f48bf5d0b72d30d9a72b203c8a55d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a04b0edc6374ca8fe589a207776a5199
SHA17e88fe61aafef3bcd2e4a484d711ae87161a1332
SHA256d8031a0262fa2b01c3f1e0443aa9380e57e4fdedc37512f13970c562986f2533
SHA512adaeaf7863a4f7dd8ffbf0f9ef2cd8cf9e4ad402f8a9f7c7e623b821d855c2fe9ebf7230330b21560f1a91625c0a7ecfb29fe7b43d963ddfae95e9ba1afe35e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD500c660a05a37b0652d978b621c17fd9e
SHA186c7ab55cf17d05b39017d4a6fa3bca12897633c
SHA25681b5e1a5a18255a20d64857ae42aca9ae65b7adadbd47f849ed34ff99149b296
SHA51241faf108f89837ec433097dd5e88772ea305c0457cc94499a52e82ad4688c126ca312381b727293ff8547a07d32be06683c602013a8c0c0d1804f8c01ba0b37b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56dede075a8d252cd06af06b559787993
SHA1dcea12710598692f70ad97dc65fc5b2967500465
SHA2561a33bab99da9c2aa6d01d2cff505260bacd8ca96025cfb19155d3f0afd28d783
SHA512b12a950fe86eb787f336a95bc8f0047455c0410c51d4defe678f499c7cdc845314543a9a524f04c97db1d534726138a3fa266004682ebf75fc4e610533deb3ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD529ff8e35ea3ddeaee225725790c11a2e
SHA1ecdd2de45861c7d7ae24fa33e2fded8c05bd4aa3
SHA2561b5558c796084308a0a27cd22dece89cb08a08e6fb867452842bb06c18ebb51d
SHA5124ca0b30c87a319f15f975566145fedc81d844bb21a5ff77d9aebfcd0593a35b65a74253ea27b5af139b53d0917c129e0596a214ae9092c60940f9aed7bfdf076
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50b8a0d69204916c9c5c6b805cf5bb3c4
SHA178d99ad1138b6b55375b9e3ff950f67175ffd0d3
SHA25684f5bf4799e87f2f69360fe786911b3598acf727530e3f2455c52a80a29e7031
SHA512576a59d43b50dae26e29785d9013d6427b19d73937c17068da4ba071e0b3f2ba9dda577ec76b32cfcee50f788ff98149211e44210a19fa3dbd8eddc9137aa89c
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a