Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10-05-2024 04:00
Static task
static1
Behavioral task
behavioral1
Sample
2d3a51db4187a8f73761bb3833739ae4_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2d3a51db4187a8f73761bb3833739ae4_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
2d3a51db4187a8f73761bb3833739ae4_JaffaCakes118.html
-
Size
461KB
-
MD5
2d3a51db4187a8f73761bb3833739ae4
-
SHA1
26f5a8bd7c60230ea36feec039df7faab3ba344c
-
SHA256
24b7f10d0667b2def91700860741b79b5aec4b1a19f3deddda2cfee0976b2cd6
-
SHA512
a58c24d4c10e8353520c4b8869db939bd5c598d5889bd4d5ff8c055611a6711507a64063ce6cdf24bc461457888625d4296b65d482f3dd9460731adb2733d3a1
-
SSDEEP
6144:SrsMYod+X3oI+Y+sMYod+X3oI+Y+sMYod+X3oI+YLsMYod+X3oI+YQ:25d+X3q5d+X3y5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000738d46ab3ce1a7f2689cd94f5bbaf0e45886932e8005eabcaf9ffa207b3d2213000000000e8000000002000020000000a492b5217e1591f86cc1e63d7f664ae6a5ffd46007f3c739bef4048cd8481d9820000000b6c9dffb094cedebe2ec77f39451303eb74bcc436e333bb071408cae60f0526d4000000029452b161f2b9d3d6a176fb66ffee1a1d7d3ef0074664ad752a47fe13c6fa70b07dbb08d3af423a97d45a6f329b94e5e833029607ecb39986dfd6d6207f039a8 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a960690000000002000000000010660000000100002000000020bc879e987e0f0eb225e727c3dc9dd9020aba9dff3cd86760669f898c8dbadc000000000e8000000002000020000000bd7aea8bb0b6e1cea5da1ef0d970340be82b681634df28d1280d535fcf1535b8900000002e57f7f64fc62400a6ddd08c011beb5f41e09ed0dc835b417ae72e54e024eb82869fb7378196bf5d618d0c96096a28eb809a97ce636b9302c015eb905d2144d1ef8692ec7f1cf07ae6ba39488578c5182104c24ee38c6e9f6ffcaca685eecd30179e2573b6e8eaf1b1206c7d2411d8b738ddfbf438ce5fa1d13c03b343265fe57b5e2df7a24c5481dc39c347ae7cdd04400000001301306905e821b886d7ef1240e379808b0787b7172d686140c2ef6b63e42bd9986dade46f14e687cadaa6fe43fddf39a19a14a66cf7aa22bc497685e8c55daa iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421475490" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c078f9ab8ea2da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D37021B1-0E81-11EF-9034-729E5AF85804} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 912 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 912 iexplore.exe 912 iexplore.exe 3060 IEXPLORE.EXE 3060 IEXPLORE.EXE 3060 IEXPLORE.EXE 3060 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 912 wrote to memory of 3060 912 iexplore.exe 28 PID 912 wrote to memory of 3060 912 iexplore.exe 28 PID 912 wrote to memory of 3060 912 iexplore.exe 28 PID 912 wrote to memory of 3060 912 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2d3a51db4187a8f73761bb3833739ae4_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:912 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3060
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ee7b1f100f1cddff904248ffeb53531b
SHA1a98df65727e77e1198a3912c051e3270b8a0d36d
SHA2568a05f9accb6398b3f6cd2af4980d9e1c7043a963395424d57aaf48130a416b6b
SHA5125e948cd68cecc0f0b5aa9e7e2cab94af3df6fb6d196ccfa352b7e3a7270f702c7fa42f9bd898f0e4e1f98d63c02c07b2224a24c2745a68e5135149f75d90c3ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dc43645a12c26c0e156703abbb81df69
SHA13fdb47a6bdc740e8d57d4e54dd82a584cbfeeaf7
SHA25603dc7fe2d16bcd2baf6880fff715349b1df41c074266db81a9d9f1d1c16212a2
SHA512dd5327aff0fdfd38d2b0d1749318728147f77cbb35f41713653ef55e229639525cab85835ac15e4cf7e3e605beeb673543da25f617f51a98f5140c92ab143dd9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52cdeb39061958b2eef05ef7bdbeac897
SHA137d304e1ffbd7c2b1daf2b1a5d7b5f4a92705d8b
SHA256339066556ca6fb4c4b405cf7da65f4aed0d615c2c9b222e26b03244167f0170a
SHA5129573e0552730157979fc1fe84b692e5ef85a9347acc5770b307d9757a46955810a2e21252d3323b0f6561ab675f78a39673b8b2d3938d8e669a97c882a24ec44
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5892d0621c3dc133398d5dfe0c615132c
SHA129f9a1bb897e0400328a42a42e82f804b8f662f7
SHA256afa039ea89d7401fe841c4ce6655f341a58bf434469c8779cfbe35e1dcf4ca27
SHA51251004e432c1cee067dfc296605b870b86a489b1a1e4d09c71c0a38c2447521f6e4db0c60213c42ae57c35c4f9f0c1200fadb253680bd28e66deec9444382b872
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57f6291d4f7903f6dd30323a5953fdf26
SHA1f1455b949d5681b318422da4bbda278154585298
SHA256607401eb38bb16fb210d7d6ba2c75c8d07d845bb4a19e294e5699e5d1da2d494
SHA512281ef9fa0ddd4390fd11955ebe785fb1d74a8d2e796cc21c2833b6472f59568f093a6cdddec0310838ab658a43deb21e78b218b5a6c534e89baa7e234ad21979
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fd67e225a67f867a6f1487b4f7c495cc
SHA18656769c81c1d73d15ad4f982a23c60c80b50526
SHA25661cc2e0876cffc2a77165378ace45c42d68f28b509b0b3b148515cf9f81fe85f
SHA512220048ed4488ee52f3440fd4588b787c5f4b8f271ec4ef0b4da06d79036482ca0031905d5fa5e5d9fa24ce2662854e256d349d7880fac1490c61b93a47a6793d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50f43ab5372361aaf0d2b9ae67405a569
SHA1868e480fb2f828d66561819e168c934c07011c29
SHA256e0f35b457780b6b7a321766a645b85d93f08be44340aff50979d9801bbc2a7c2
SHA5127765d8b51bd03a75ab817f35c8b896cfc9363119639146a0fbfa7b49e8eeca2af828b5923d87aa8df730e36a90212e611547ce41f38d7e3ac991ab25bc586802
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD562116619c00c74d4a2f21c38fe0467e3
SHA10a444d0f6aa9953d31ab8431a8d81cba20812249
SHA2568b5ff284c66122b0ab39405d0fd28b03a80b7c58e128c1acd93fd3f7c93b8e9a
SHA512ecded88eb67bdb0f5fb1ee3e0e59d870682320d68023996e27b5054c7bcc22567bff7f4a5f9db59a08f9d4bd740c99eae4f418c82c4b686869736681ecf95e85
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50b6247fd4cde4fd08204840a6329b9ef
SHA1b01ea6ec303c274b890acc348693964ae9359a2f
SHA2564d084aee87fc7024cd49066fff572eaaf20cfe53de209df86f55676f7e1c4e14
SHA5122d3fe1aa73cc2a345e7b8cc9350f5219e48893719127431fab7a8d19c41b31d8d3a983e1228eeb7f14f004fa81bc6827bf8411b3f0215e9d4c1276a4f43d78d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d388ae903300af0bb817c14ed8f82d42
SHA15a477bf7f1646f9630ecd16c412fa6090d951835
SHA256d08b2d03664f2feb8ba4e1d41f1e345387d32f823fec62aea4cf18dc00c60084
SHA512dbf8fe45f686dc85a953dca88ee23022e103c75cb50251903eda640df67aa9726ccd1dacec3c5d5e1b7a073d00c3b0062459a1f8ff543e6ad3cf9e811ce534fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5710eebcd84a168f487a905bfac180a1a
SHA194a9ed247a9f495c7858fc0e75d7bbbb9043a3d7
SHA25628253453e5c02b341f329cce17f4f48dfb5ab7e3d8af5bea645faa9c503a497b
SHA51262422d0fc03d6784fafa38b8aa05465b5a97e261b2836f0b79472d85c50dd40ccc70a47d4f6c6e5f65e681e48ceb3bb1948c9c70e5269834133463aad4886212
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58bc82fbe71cda995f064ad83c62f9c7f
SHA1a6a8e158dcf33f0a606091b15103a3600e94aadf
SHA256ead20f389087f6b03832bab0413f8395be91b34e0c80bce3beb825e83662369e
SHA512fa5f75e868707f6d105bad9d59fa2d1767bd1d7f4c8fc7017bc97aba1154c342e845925cd532022b6c0ca1a2d139b7e17970eaa6964a719ccf1d744bcec18d2a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD547effa97665cf737f8551d6d62040d84
SHA1167a97ed83cd02c398bf99714833fa6deeca3c7e
SHA25699ba81ce8362f1bc814d2300af51e724710436a144dfba8c52182da263299604
SHA512249b44fa59b5e8eb5f70beaac0f5bd0067c3285520890b9afbe2b1e898858cd4eb5a88137b770002be09e690bc5936f949bdc74f822aa7de21df72428f77bf0f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD596af3304c37b61460b65b70f662918cd
SHA1a63804a8d53555d6d694bd7a0b87d4a03820a93e
SHA25606eac30c3e3efde3f944934332ae08e6abd88eefef5dcaeb9ce4ee623dea0472
SHA512d4f40e5b051885b11a5fc4d146a79df653577e113b9ef93dbe4b2fa45ede24472bc8ed5ffb414ed7bdd19b3d413dfceebd86679256d913fb67daa09d7a08b786
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c06a0a537d70d49079617e8a2d9c0b07
SHA156d8ca6cf358c645963ae6e7cf854e8644d94db3
SHA25632b65d1c441d2f7d76203b27a35017663ac46710e4d9b2eef1f9b2e26878b8f8
SHA512c6c476bd734b08453729bea9bf9834e590a7fdfd1dce88295a27ed925d29f067f96cf5fb53fd65a681373fb052800caa4992fd4995a74e37fb9e65e6eaa7235a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c44050f70dabfa8de5b046b6652df9f6
SHA193999e10245be8563fcc5d8c50bce0409db0bdb2
SHA25654bd2a02126b9f4db11cc27197c42a04ab2ad744909be84cac7aaf4574937abf
SHA5124d700c8b93ada0c19edff7d94cc781a23df1383213226938e4e0448233bf9fd2884e530b5a3276ece3bb3394931bb193e121d1d05bfa4e7f402a47d58b67cb98
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c9c67b67543ed62f926b27a978caaed3
SHA127a710adf2fdf90999a2546783f8d16211ed22cf
SHA256bc63e632bd661cf3ff94d4c7e33a94825fb42a22e6013bd69ac8ecf70c00d777
SHA512776908a11f3508efabb97a4625827df9f3c16aa1157b6bf999b0fc6d0d7b78ee0060fb475ccb1765e09b381ff647b804990cbd733f11f19904ae506730379c06
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51712af99e8163efb922e486e62758772
SHA1b767b10a218c3ebe0bc6ba66335128535261334a
SHA256bf4b8c2e659c186cc3d32273071b2a4ea65f21ff1a315a37d70faacc0685ed4e
SHA512fc1df711bf2e84f3167662a2de3a74b5c27a0df342ded6e5e9cb74403fbf5080e89e7b5370a08774c003e322e60ff059b6b14a547c2258b9739f6a8a1a204229
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a