Analysis
-
max time kernel
142s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
10/05/2024, 11:10
Static task
static1
Behavioral task
behavioral1
Sample
2ed186bbeeea5fcfb01b2da8c262d645_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
2ed186bbeeea5fcfb01b2da8c262d645_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
2ed186bbeeea5fcfb01b2da8c262d645_JaffaCakes118.html
-
Size
77KB
-
MD5
2ed186bbeeea5fcfb01b2da8c262d645
-
SHA1
96062fe069c1c3b13b09732e04ce4ca24a2fb97a
-
SHA256
658228bf03ac67e7c1edddae75a2bb0d5378436f69e92ac50ad35a3ae5c593ba
-
SHA512
3ad68cf83ed8cc65e14b1cf0dea2b1fbdc2a11a48616b41b2416355e240ae8e695810867db0be3f22be38ccf76575c3e3a606b991491026e428e376f317e9b11
-
SSDEEP
1536:alAtgnaR9sBziIHeehmQvcd9YkVUpFDRC8PRmSMeTDMtZC:alAtgnaR9sBziIHphmQvc4ayjRmSX
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000b9534b2eaaaa784ee7be73d23c069cb2fc5440d1fae4ee4648c1e46f1457619a000000000e800000000200002000000096d7d30d093e5a32842e0eb3e1835527b60a7b3563d06cca809a2d4d4b068d3c90000000a1668fa14b6ade62e29c1f4dfe2339c95472b7b6125368f359ccebf8b1342482e463353ce53fe8540e5cd033b9a9bcb2d1444b338f13a35167b681712800158966e3fcc131605646b60ba076d4cbcc97716beeb2de54265d428c2a11b8ca3fdbd710ebb761346e3bddd5897738e29bb95c3fa6463016770e32b6e05d5f66be0c47a4a23eff043ec4b97c89c4753044ad400000008913d3d0117d809ce9c550f6d2d9c3dd128442ce0fa225971ba241f24e624d4fc84680baf1e35ac9ecc8b3ecc830a077e56b3cafc94bd3eaa022399eb499d29d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F6273861-0EBD-11EF-AB95-422D877631E1} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421501318" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000061b9f659af64a64ec526f6baae38572833db3fd4d79264846ed5be1035e1c068000000000e800000000200002000000056f92f0729557ec212f41e861685fb55b3906eb19dd7d7bc82b357b264e237132000000042e362fb2a4e30df0ca143cca3dd5ea7e0da957a5d1f7dc706d862d8c1c874cf400000006290deaf04f9a487ef118125b3275a38ef285cdf3300d0e8a8a8f5dbb3d885d0ccf099727682c1f0c0635e4c129b7d8190dc6a1f710ff41410f5448edebfab91 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 303ea402cba2da01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1600 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1600 iexplore.exe 1600 iexplore.exe 3024 IEXPLORE.EXE 3024 IEXPLORE.EXE 3024 IEXPLORE.EXE 3024 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1600 wrote to memory of 3024 1600 iexplore.exe 28 PID 1600 wrote to memory of 3024 1600 iexplore.exe 28 PID 1600 wrote to memory of 3024 1600 iexplore.exe 28 PID 1600 wrote to memory of 3024 1600 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2ed186bbeeea5fcfb01b2da8c262d645_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1600 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3024
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57555384068f9187bcee777d7293f7350
SHA1639a7354d74e349d4c98e27c5dc2caab54f434a5
SHA256e0cc9285704657db826ce5ab33aaeee47c3f3948a5e1d401f70374627da0c15b
SHA512c267b3919b05a8d2604a51ebd499eba04d3a1e9f4eba0257c56cddfec3b416f6a8db91a1a8ee4d447788425d61fbf11e519d325a85eb8b948afb69791a84d3f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c84e20b775ee175dfc975e9dcfa1476f
SHA1e50503ba4e72f6f76b195ae728f45b6411d472ce
SHA256681921e644e6ea71a6cea6aaffb9ce87e7047198b261c98d75549c6c3b9f39d7
SHA51213b3108db2b3203ea503833fed60b8351253274c801792ec6035cda27f01f185bc951c26a13b0ef1301a7a9e87638faa78af888987638b3009c4d5c2be838627
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bed422b5d558261a134579d61e3c2327
SHA1104950f7b7738ddcad00a0a980f5ef1928de5ab4
SHA2566612c2c0d212886141936d4e724be60a3bfbf7f28c6bf8d9ca9e22fd0a27f6f9
SHA51223fe776fb5e0441953ce26d45d75c166208b9e8c8a54e23024d8ff5235fd2300423c7a592131a5fffc10218d6345744b7c249f6d025f2eda12c209e7a59a2c6d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e50fe75cb72b91dcc67c3c04fc835db8
SHA15d866701b1d3e4ad1d00e86cf1540fae2fb54fc8
SHA2561694deeefce3de32a939b0e3d65d2beaef1d60bfb72289f8a4d047bae74491ee
SHA51295fe03500d76d39aa1739e6fb09189052c790f9da1fcd3b7b0b840c3c970de829e3daab721fe6d6f885ad103aba3bce295ed83e8c453489784fa98fc65933cad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5496f353547259be6ccc4c0fff25d2800
SHA1736caf25c2145bb8bb8fbfb38acfaa4ba86a69a8
SHA256a7290bc1a479fc66f0b2e578d1d8c54f3790ed645d16b01ffbb000ea8c086d32
SHA5127ab04703ee077f57842f9b00494533055165db9e0a847c80c300e9582f6392add072945fe3a2842f5e60bff5dd355e6e48d3d2d41d08d8fbc4c30b736ec1fad4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a44adc0309663dcbbf3610a9dc7bbe28
SHA1723793a8194887a1c5b5379c8891831dc9303f66
SHA256ef12a2a555e1ab51fb8499600a00ad33c9f507741b07bed2ff456120d3276a7e
SHA512bab3d2fffeec1775b03ff949870e87763ad1ef89bdfef2ea03b2efecfd09aab09ea5689666b0c7c8d535a1daa77df8c29b59ac7771d3974d4bc4a2f6c184d375
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d00480eb977387d2b5f3b58d0b2c8f91
SHA1410d9706424d6a68e3407f22fd730be0ae69ca5a
SHA256035effdbe54101f197695e6869e1d936371dbb62de7a58888dad4b7dadf61244
SHA512911b2820245740403b23d9813898bcac858217ec82b80a59ecdbd2145c77806a0be63e61e219f3287314f1534c9b1f11e05f58752c17036f7202f810f36e5f19
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58710e7008dd83c20465894efb3916af6
SHA18328cc60c1a4394c92ac077f537cf32f81e9e8df
SHA25679da2686f1387abbfc2e22696b361165dd058cccc7b7d956c66ff14da582d1be
SHA51296d284c5714a8ef85a907c369176fdb71308d915c8705aeac8fa2c50f72f9af70cc876822fc96c035788e9f80c9de6e6e18f8afb65f95116f07b29c693762a59
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c0ed735a126674f55d39f517bf45ae28
SHA1bcd99a93a14268b335642898428ea1c55d57a8ae
SHA2560bdec4b89bc7a1d1d9da9befc2533fc63cdc4b248fba14dfd27fd9488b6d005f
SHA512a64dd20b19705012cdf5f55f9dfef6b6e80194959ed762ebf68b7495f3ae063c8705af09afdf22f8e4c660cabdee96b90976c219eb4301d58ad8e5e5783d42b1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59400211ed5906f15f1c936181e4dc3f4
SHA1faaf9bde519339d23045cc71b94913268b0505e2
SHA256ffa345b43b06b3a4ba9fb45c884d5d94005da11dcdf71e025eafd2521e71ff75
SHA512cec2fb0f3961c606ac9b3aa3b466df1dd2754190da8012b7f04ca46d2dc1d04043fbab157c6bd3bcc51dddf46ad14e2877c089cc175deed9d74bee646e369b5d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eefa2a23578bd7edbd3739afdabed248
SHA10c5d33a8494e114372c7681db2f667c36c52541b
SHA256084dc72a86f180079f262abad9c9d1c682a50c47c245c0a25c7e4a60d1052e1a
SHA51236286e444701a04e8973e890be46f4fe69383b3e4b6618e3eeaa382285c0ddd52f65919cde8e0b0a73d5635417cbbda04f7ca43b89c8a31f728140030d1fbc0a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a428adcdaa9396152f2f70c12c150cd0
SHA1e03820874d6765cdaa467886ea03cd0430750c65
SHA256732a0a4453f55a297e2986bf124e3a271c238f7dd81a45a9da3020b9cda7ff2d
SHA512323a7e78380e6dec3e52c03d35a56650be1efcf382b776be3eb0deeacb6c411dc6c7be491d6c81538aa7d4d0d2356b41408591fde653b3d07734c010fbfd1469
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD519549fc942ee471f628413fab66d0406
SHA1dcb67ad84de8bea6bcfd2c402f25a12301ca252e
SHA25645a2a76fac6aefcf3a60fb5d78f4ce8620967497ef0c82b96111576d4fbecccc
SHA512dc0e0f4714d2926bc982c9502fbbc76bf217285c648b85770bf99d230fc92176f1aaa5474a35abc1bebfdea59b2ae9957a274ab96b48be134ea909c7734ff9b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56b94104dd6fcdb1bebf9bf2dfe06d778
SHA1d8ebb9e664fdb2a59ab6b6c739d6b58ac45f8738
SHA256c851368698c14fe8414da2d321dc2afbf897789210be653be26b8e77c6d6b06e
SHA512cf5f19758a9d555890a652726174fb921b0d52a9f6cbb0406289f5f53777b249ea0f35a0e16c147f9ac800b4f92ed1079d9205f65b755b92bdd0616abc944e62
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54be8708d74b2179aad1ab2fff3b2913b
SHA1b2f48c6ec606cd9a5c2003c20cd68ca430153ec2
SHA256fc43935232f0d1ecf4922855012fc9a2e3ca9f7477f99c90aa9d4b07a0cbed2d
SHA512f462d2fc4d6a054276cdd490b61abdcfbeb82b9f8b611d4299d442b1f033c026c5234bb01f604b3ed4ca479da754a8c833f875760787e9ec6e8d8b28de037244
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51ba6f04151e08bc733f0e077480a4b88
SHA1c9e3ed39b12fe6ab8f505d37fdf56712601dca17
SHA256ccb21d31aed2298177b11150edd756f4f1be022e73f3c06b2fb514644cdaf676
SHA5125ac98c4466e00e5c4fb267e1759b3d40b270dd31a436124dba6824c4cd19bab2390a13bce7a1bd42f776d79b19683f515af58a0643dc11c82e841a62eee2a613
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53cb51a797065ac7f226bd1a0346c2bab
SHA11bfae3d28f9f19ac21d66aa0add092cd64296e15
SHA256d307e00ec398b7ace5e0b830fbef3c19009ffde66bb46130e9ca656b868da1bd
SHA5121722dd087ca416412e15348682da444ae96abbbb2fcd6c185f0923bc6fa1a37e99c9fcef7007b5f4a11b453a95f8c08c3fab8d90b97f2712811b2dfc4992855b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c0114e885cffa8121224c74b05ff7771
SHA11ab70623dba93bc05581d7fe10b367c4ab325894
SHA2562940249fde12cc6b4bdf2cf9a905ac5999e921d93285b81f3bc06b9e3965be07
SHA5127a03c536cde98ef2d4bd979dc49478cb58ee80916ef8c81d252d323bc68b8712ad4ff64911fd9e819b0c3277bbd75334fb2530a3566f5201e549b1ade2a95226
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53c1b44ee22025bac4d73e6609eadc206
SHA1e661b74daf1825e342454353ed060dd42525a7a0
SHA2561b274a2409ad80d8f8d2710ff44751471f2e073946273e0f4145b1b2d9da2a30
SHA51289d2c8c22643db90c7b249c18dbc2826cfd041f90be45e69211fc7d3cb0b473840a06e4b047ca5ef34822a457d48c22a027cd7d17da0ccdf0afee1d4b6e3b9c0
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a