Analysis
-
max time kernel
120s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
10/05/2024, 03:04
Static task
static1
Behavioral task
behavioral1
Sample
2d082d80d8fb656cc934e186bb593e3b_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2d082d80d8fb656cc934e186bb593e3b_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
2d082d80d8fb656cc934e186bb593e3b_JaffaCakes118.html
-
Size
460KB
-
MD5
2d082d80d8fb656cc934e186bb593e3b
-
SHA1
74ef2e9f58889c35c35a6b8fdfd8daa71b9c0507
-
SHA256
c9029c68b4203e9cccf36599ad7c722cfd772da44407298771c8ce72681bca2b
-
SHA512
bcec6471fc44cfb1503532b0c787ce83dc5512ccf254c61c7a5a742e0b53d6e1c1247a8ef68e7255c0dcc9327acf4dfaa78c5c4e7c659ba5c111c2127109e7c7
-
SSDEEP
6144:SrsMYod+X3oI+Y8sMYod+X3oI+Y0sMYod+X3oI+YLsMYod+X3oI+YQ:25d+X305d+X3c5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{15A3A5A1-0E7A-11EF-A04B-4EB079F7C2BA} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000199361e53a4b7c6a69fc914434dd5566d316591bf452be1d47ad0b6dd0b9d4c4000000000e8000000002000020000000177a3bffdd861fe491c59c84f5a8052aec75fe4c10bf6da04aa59ee541fc3dbb20000000d3d1893adeb46538a08817b0f225ca0d3c6546dcb0a522ad300868cbd9a571e2400000000e07057a31ef1130502e5b60535080e2d9ff5ee5133ea91ed361e40033af47782fb5a6d172fe5aa9c7cc5af944d885589600231012c7e5c586fbcd28b975c237 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000226c519a96512577bc9788e1d4f5be6f5c767c348ffd72273fc6f909c24abcbe000000000e800000000200002000000009ecf381e8515cd0b7010f74a9ab3b0182f3eb67832d99e27573a74d36d66de5900000008721ccfeefeb59d3088be3d76a3a03364ca39edcf2ce3597841874cbf6fa80f9c28ed68c7d4ef39fcf9060b2036f5687f56ceddbc681b23980987327884aab71e8ca6d32bd11cff701655ab6535d4ac921cfad2b6ef3b8b6c8806127b977c94be1958d62ea46a28523ae50a5e88e51d4ff45082cfd934654fb168058b7215be4c262e8c075e9fc1764b76ecdb948bbe8400000001026a3445eeea192726f992a7b12b444ee862428f380455d0935f2299e858c7b9b988e92f81a85b0519f8b8ded3a482cd640dfee450419b6f601f20ceb542cc7 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00fb38ee86a2da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421472165" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1640 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1640 iexplore.exe 1640 iexplore.exe 2600 IEXPLORE.EXE 2600 IEXPLORE.EXE 2600 IEXPLORE.EXE 2600 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1640 wrote to memory of 2600 1640 iexplore.exe 28 PID 1640 wrote to memory of 2600 1640 iexplore.exe 28 PID 1640 wrote to memory of 2600 1640 iexplore.exe 28 PID 1640 wrote to memory of 2600 1640 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2d082d80d8fb656cc934e186bb593e3b_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1640 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2600
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c3f4d263da8454865e67f25a4d5cb856
SHA155e3e0b819de91d73d65b6baba11285264280dae
SHA2565b8f6e894d990e05c43cece0fa7ecb8fe08a814f3ff00c9b0007637552803ffc
SHA512cde770df40f797240334e587eefd041a483c7479a62695ab7169edcb6e229d5d217404592931ad4213e506fd089250cbdc7155ebb95fdfc69c18bd2c0d56d643
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53289bc770257efc0066b35184884a5d4
SHA12576e13d9dae79b80db044fddb7eceb7d6fec5a5
SHA25620754fa0a309597ec1fc6e53770d614adb5f443d8f483c79da87b819c8396ba4
SHA512f6e55fb9ff7eeae0bb9be3fc3769dd03569c34b152dc4d927c17cd47d68786b271388e9eb044840d9c0e2611d107743ad7930ca1963078a04b1fd4bbe55f5455
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a9c4363c79b30ad047aa0159e8ca3b19
SHA1b30043063303cc295b8b57bdfb80140cb7726f46
SHA256b14588e5ebab16013331083fbbed1a11fc359d647eb2927d1f03956564260736
SHA512f89103e063c310540c2ccf541c056f36ed3c4c010602314ff51526574f24e1c60204b8c8778f591ed0c8bab9d01bf33af36fb679d429d85d196b853c5c5c634a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55a8a89fa18ea2cd7e07d298db729f193
SHA1287644f32edab8bf75bc5e9f4c44d24fbe55bf03
SHA2561c6b0cb438f2ed43653b96ac97fde95b6d9d7c90f9745b1f75c7258e809105a8
SHA512d69103744196794d0ec32bba50a4a180694d0eb21202eb9187ae2433b9bbe6efa297a18d2125fe64efce92b516a65abf9213c606e43bc8f778ea5732bdb0d1a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD592d170ae175016a51da9a371bf7ffa6b
SHA13085b39b3b8b52f6663af092867f1d818564cd60
SHA25654b477b4a55b6c1298272d51a763b708bc711d62ed9997ec67344a426f59240b
SHA512ac134f03b017dde24679655d9a9ac01ad981c2b37581fddcb085c5400d5bc5275091a27870d3304b8a9c7918f164f746bd53a57e5895d1983ae2244eb0945e9c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54d8d2bf65a45a7eee80aee991c5f4e45
SHA10c20a9f066c2259d08f8471ab970a9d60f8e83db
SHA256aa0a8b289dbd62b527ef31335fa4fd99107f4dfa1a0707fb07570871c2ec6bad
SHA5120bcba7125d5e0c77deee2e7774a5916857a66dffbe63d8e676a9db47927826e819cc59f4bc5c87f9641564031c147e37be1d706f3d031277d38a7f7626d62210
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55408c5419b69673ffc23b050e3fda058
SHA1f6d211f5b1af69644a7114a6eda53b9739ace08c
SHA256f09ad0068392355bd69ed1ca354b26d5ffa9c78267f5493fb00372b1aab8e93c
SHA5125dc7c096c42b824600b8c621e0d039827eb08d6817c5284cc1dabae64870636229b47f6f42aa3a0160db2f9b9d39c85e992e9d6a2a90ed379050de1f75931fe3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58458754814bae214e7ed88cbd3726c22
SHA188ef1c4d2e41e08fea732a6d28c2c62b18edf5c3
SHA25659ed393e65fb94f3cdcdeef86cd968c2b936172f2e88fc1e9ab568f83a72de98
SHA5124ceb833b1100001453923415d641e142356e79a12116b1de08df7ab81d3d9127547a704555275450ae3a84cd47cc864d11bb727d83f5be958566bfbdf84518f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f9bd2f2062639cdeb3d73cd20e2ddefe
SHA1dac35396152930dec4aa01435830ff63ac43558c
SHA2569c42ca173d5f7ef427e1eb45202dd7617840051ca67fa95b71a55e4ecd54bb2f
SHA5128b0bfb8acb4f252cfb9d61fe0184a6bd7977f494c2becd9613ab7b4eed032b07129364159adbd26460131edaf21abb88237b98fcf59538d1c3bb46ab15fdc27f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53c58fc349d03018833b0421acd052156
SHA1e024d850b07815eb8242e2de3fbe0760a2c3b172
SHA25615d167408e726d91436967de610f22c3b207e44460b083fbe4b6c23953b6d6ac
SHA512a1b38a43ddf2114e46332ea3b3680f90eb33470702f77d576586ec6f52c5f42adcb0d1ee36c120a9a153cf18cd849c491de48a9a228dd7a8e5f1c4b969ef57cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50b41026a8c1b72dc55e88294891e7968
SHA175e4fd6e93e6a67144d98dd5ba8314042a0cefc3
SHA256c8240d3357e912c9d3f4ac7ab9b9259ffc26f32f962c55898ac1a815fa7b3048
SHA512fb5c9bd8cdd3a6edf33aa974be6a28a2102c98a0c1475aff1d0d33c31edda208971ddd4fc0529f607ebacc1f056163dfb89f4841cce880e5b69ce737375d5825
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a789d96c15d9efda41e87eb6630c21d8
SHA1f56543d690574ac1147df2899cc3c09f7e3c8fd3
SHA25602a5eff84c2111e09a76b82876881ec55760e73d3f927a7f35c19a346aa647f0
SHA51260a25c49311e316070cd58051a1ff5b02e7217b5e6a7aa52c3bbd41a6d1db05ea96055112d034b9985dd41dc5e2ee28d72b0b46ba7b103e979b1e1f627686b31
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d7af6823f3a946b4f5b56c40dea3d03b
SHA12af3f0b9feaa6b532d2c16121bc65cff21474cf2
SHA2563995b2dc22181d1a82e60fb7b2a9f88cefd487f0219c79e5eef5a3fe56032faf
SHA51260289c32bed87ba73c0693e4854405b331f89454f7fc85e0cc2d16642a6d52dac28a57fda65c90ff457fb9030fddf3f2b184b37713eb64e61f4c12dca0ec4205
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c6222b95143afe6a5c5c75bc4c41f077
SHA129da832e0023e7a72c56387d963c923d8537dd7e
SHA256d62fbdd09e22bb870666c88243b7323384088b393f275fc68b53c9df09d08467
SHA51293876d7e70939fe67b4e330be6cd731d71b925b39677e68607960263b68fd3078b4fb68c0485283b3feee12d6c63504e52807fb05d044da634c3e81a9f21bd35
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57f84b794baa10f78628c1edf19f43c27
SHA1a44ac81d56d06ffc368b3797e9b4754b0bb0d1cf
SHA256cfdc60963e6d9c58d191e8640e3882de1f658cb854953d996cd37e0d9f6a11db
SHA5123ceb73100a691b8a51f87447b1ab7a041156a66aef214aae76511fc2989f6d7749e1be8171bd1a38d6491f9d69bff617a29454e19110878e1a89b1b5eb996a1f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50727468578a8280009b6597f0e1c407a
SHA1b3137b13260d2b58aee53c7967c379639d42a658
SHA256ed36225c8d8405fc14bada452a7eb48dd2d3efe274e6a4cb15dfc94aa40fca2b
SHA512ed79cbc9e43b7fb3096f686843d05d477fb968670b3b852373bc11a5bc1bceefe872facb1f4084ffe6df502b2f02a86d54da665417e8c5168554da070766a6b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5db005d86e8e2f5f984338414f75bce6c
SHA15d8853e252ed7bdedb842a40b2fa522873e1be8c
SHA2561f67fecd38dabd77a10884f8dde3bf16f8a3d84eb4c0e4af1fdb923f18ba4f95
SHA512242df4efb4e6253e2ef6347cc5af8dc558a82bf5cb07985e410aab8c89aaa7664e2ac6f85325e5e973137bfc2a898bcb532fc25a742482f6f19a8c7940b596dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e780c4a1fe36e5a7cadc2d14e8d1337f
SHA1da44d6f8ff4822221308fc2a8bbb0a71f3a7e0c6
SHA256f5874b54e4c70dc14613c61f01ef2610535c2f827fa15c424514de49bb5e93d0
SHA5124c59cb4dbc76f2adb55e542a8a176fbeb64558d437f938688b966760da6654d57ef7991cedff0dc722a615344654c069e7831baf81f88d1a8a62f35e7966d1b7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50efca8c10ec4b5b707ce7cf562340fb2
SHA16a3ce5dd00158d7c4e0dd22e6f61152a2cbbd7b0
SHA256535897ab1cec41e8e8cc099dfdd0451d00c36c7931c72de32987fa333c74142c
SHA512468286dda5d726d87959c5e123ab04686785069660a46ea9cb1c8233c2f481286f6f81a548711882f7ff6cab8c338a15c3723c3591329f6389741cf1ef42e0c2
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a