Analysis
-
max time kernel
141s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
10-05-2024 13:12
Static task
static1
Behavioral task
behavioral1
Sample
2f46db3076284341321a7fbbdfb0652a_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2f46db3076284341321a7fbbdfb0652a_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
2f46db3076284341321a7fbbdfb0652a_JaffaCakes118.html
-
Size
21KB
-
MD5
2f46db3076284341321a7fbbdfb0652a
-
SHA1
7d70d5f563f5958c330ed8f38591448d2cf1699b
-
SHA256
7fe32244829a395f0ee1d2aa0bd9c8df00e2cc2918135c758e7bdd97e7de08bc
-
SHA512
46b1211c56f838b3e44dd07743be1ce88b6931da362b25c0ac391859c1783d0a8e7df62842fca3aae6888b9dd1c8540b251aeb029db8c443da4fe4db3a7c4811
-
SSDEEP
192:lbl7vFZ7vRIG9TsVi7NaNetfNVRswpqWfUL3WfPHkWffnM4YF+WfH+td8dAxcyGX:l1fJ9lP7/2sYNTuFM
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000009edcb435864684ada7ec66e8e967f1cab8bd696c575533978d9766b8e6105f61000000000e8000000002000020000000f214978f79f0599d6f62c14c91c0cd16fb1c76ae0bade9a4311925f06586fafd900000006d675dc8ed46ce6216f8b7661a7f015130d7ecd1feff4f825ac4869c6588a41d8ba9dbb82e0045d803f53b53ac54919f9bb3580bc0a75752a9c3e986c2c0cd530515090847bcd9699d2577f767d0d6135c814e89110cdd3a41ff9b306e685123b7d03abed09185015e11d200a0b1f07af74e9f44b04b1de8d54108f1f43fe7bedceb2b4ebdbea8976c9b21033ac37ca840000000b2445a62cc73c59e0392463ff8ce9967b8ba45ca4c57bcc8ca29833b4fe6d7e1933bf98ae001ea914b2e510af3795ad794bd6e4ce6e465ae70c6c6eed6a33748 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421508775" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000006f1a8135e2f06387e72ea75746ca05208f2689a86e3f41e725b712776c58a05c000000000e80000000020000200000006a477a4bb75f4bc346cf99bd0987c8d4a7397057e9645081a6098a26630f968220000000fa9ef83c6f49b88747dfb708b01e8463b20cd640d978f217e57e2d28da0faed9400000009e40340e87a142d2ccfad26bbf62b1731b771c1b43bcc97313ea4fb33ce633ae182d55d0d816aebd85fd699293e244de2d5b4601fcaafe4f2cd4192cf6a921f6 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{52E2D031-0ECF-11EF-8A04-E6AC171B5DA5} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0cc5e27dca2da01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2348 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2348 iexplore.exe 2348 iexplore.exe 2736 IEXPLORE.EXE 2736 IEXPLORE.EXE 2736 IEXPLORE.EXE 2736 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2348 wrote to memory of 2736 2348 iexplore.exe 28 PID 2348 wrote to memory of 2736 2348 iexplore.exe 28 PID 2348 wrote to memory of 2736 2348 iexplore.exe 28 PID 2348 wrote to memory of 2736 2348 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2f46db3076284341321a7fbbdfb0652a_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2348 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2736
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d8f44506f860d2c4066e1378e3985037
SHA10732a7efafaf695f74c26eda850c99999410608d
SHA256a83637ac9fabc87cf75a1a41b4e20c7528374dbfeb6accae8269cef03da3f24a
SHA512b090ac98cfd0addfa6e354890a76c3b03d60633ad81397a89d58c304898cbe4b1fdf53a1028bb75d149aa8a3dfcbae98d894dd892b36b5ed107d8ad45e89bab9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD568154ab94f8ddaba3c60ba11687c2db5
SHA145093baa0d3a250cbf3753c5872d4cb57d100b94
SHA25664f4c3c4e1a3238d19fee79626bb8ef17bf44852b2aa58deb46714acbade7a25
SHA512886c9000e310fb4a74a8b4bb361054fe50149e3e92f27838f27409412b4a81ea907de58d545eb1e07a509baf750abea27b344f2fa35dbda5108546c39f4e2339
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD512a50a40c6b6fc58880ed91de5a5ca46
SHA1adf2ec8e33c6c3b33efda6e620e0c682389f7873
SHA256071b34eaec8509022dd77064752972ff9eb61fe60af61f1d0df9879237e8ab6d
SHA512b3adbc86be18c725e8de646856740dce34f470c30bdbba30ad4d034cc9ef26959b1f0de1fcbed3ce2da882718fa6e71cdabe7071e613318caed320f00d284cbd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f121d9ceaece89162cb546af745fa2e3
SHA10515aac529e6aae8a853c302d9e410e72601b1d0
SHA2562007b57d72eb6da368296c1a6d184c378e3b374d4b9a7edd08e807c71c5935ce
SHA51272de6b227027920f5d4fb65c2baec032ee2260b9341c95e72d44255e91e6a3e363979cc72e6ed6c9486148021e659bcfb931fb0a1f82b3c27d1fe9162d07d2f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d60208bbfd7f5e674161e01098871445
SHA1cdc0f2ce47dad061ad690cbd4d6cf5acee8228c9
SHA2569c4bc745796d6e4768d7a1a5d39f1c692c6e5113dcfd8d799e95669bda85c2f1
SHA512b58bd36feda236db09b2fdd16392193d1bc8b854df90393bfb2330fe54bfd59c61890a509665122ce4016f7e8bebc2cabbf56e0ce7d810d0178ed2df0a277a8c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51207ac8e58914d451c97ef624db8c4ec
SHA1ed885e1edc2ec1b40a70953313810879be188487
SHA2569740cf20df91f3e60a1be6fdeb7b1528a42c2c6c2fe93d2698b141ac5f8c0363
SHA51266a96050ed022f75cfb582e9ce23a5e720eadf72f88c3e5ee7a006ced3389a77f7c57ec5ddb98d8a80434aa6dcaa9e9e12d0fc2fac4a998d762ceda567e6fe6b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53c2309faa88ebf4187138d4223448edb
SHA138b783603e1b0ab1470f97a280b8232a1d4035de
SHA256a2bbfaf3894304828dcbd92199eedcf5d0274402b3009c17aa9d060414234176
SHA5122219e7561e49845f1e3a31f9a20f37222d0928c33f5081932e85576575697e91023cfb47aafee35f0fa607dfaf76473b99fa91c98c4189d30dcac37ab7a640ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fd82d322215123743aef064885cbfa91
SHA14078f7dc299369951018638448c2e55cc7aae185
SHA256f133df2989f3647067df0b5c756d0f11f7dbe02836e1c0e145f167d475464f67
SHA512b68d9220102d034f22c5276db157e0a69166d96bd99cc72cb555443d396c584ff67da776cbd66897229ee36d720a1558e8ed45ed1a2d7e96fb26572fa4c569a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56d5adf7792a41a4833d01245674bd3c8
SHA1365c733ee3b3b2de5c9b2734f9098568910a27f9
SHA256d789a79d34b376c3f3d55ba955b8f690d847895a98f962a6ced65b4d3ee76c11
SHA512e8b1f8d93fb9f9be389c831652288292eb0cd0fd487c1cf9718c2f969234b922c4487d7009c6860d6b72d5033df3563bc8f6e5c49c98d6db4b2488f965cdfc67
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58c30bc96687c3d04e74f9a510221a445
SHA17f3625f4d938534572c3a0b4d13fe94edc6b5423
SHA2560a65944d0aab1ff304232771deb85c371e64bea063f8cebba633dde57597bd5b
SHA5125ccbd16f542c922c01f22848d9dba8aea38d17efdd17c09d736af2da474b8825a38f014044695985f81e205f91e48c8d9bc847e6ffb073763dd485ced47e3c08
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ffbd2cdb540aeb69cd49e5ea74310a37
SHA176e72d280fd56ce0ad5fd8505e887aa3206b66f7
SHA2562e48ea267ac607df66c563f4820f51523417ee72caafb57f5ee3b590cfda1d8a
SHA51290ee265d64ae1e3f714fe0a7a19cbd5295550939b5adfb4cddef1fa5ed199307d65194565e6e63ef0fdc8aa38e562ea6f6b2644b8c896d3c01016f8cecb9a916
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5444d865d8bf59c2851ffa99c0612b24d
SHA147664576f089f7db736bf97681207d02f5c96de1
SHA2569068d303383686c4e897f66857423abcaa615794afadcdb5b192a6ffc00eff25
SHA512b913cf017bc7612d1e22f60fe5c3a602bb2747e56369b571659465676fedbeb75859f7253b890d7db7de46f4cd35990d81ae9ec4c24e2b21b64757232d5813ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50cbf592e7c155341e3334c7877dd2b37
SHA19972f631a4153c81e744d813583752b85efd0405
SHA25660fb7e2a086190cdca6655ff129e66651274c15044f7f751a8dc4056f90f1a62
SHA51217ea01e7ee96ec62329bf4efc86acd617d4f775b78af0838f080e02036f0926a88a4e1eb3753c893bd1a73990385447421147170d5b98dea7493d7da5ec35bd4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55e89a4c6d3dbe2623a93ad258d1014e8
SHA115d3e6d87b8ae925cbb41c2a850150abb840e7cc
SHA256dbb6cfea515536ed1133a29d11e2430bcf7a63f1b1eb02d942ba64b4668c88f3
SHA512305b8ffc13c4f7d47ef8fc26bbffc2ed22a859ef8d7f7a12f14a632516171499d2e6601d2542147e632c1beab26359d0d80eb79635cbf6b35c5bbbf99e5b620a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aaf6d6186a76349cf09735744395dbcf
SHA1e5fabd3990ff43f92afc0176f42683c73754f804
SHA25665ed9ceded5267ff2089574002bf0a1c6e5a472489a9ff7347b43555d2e63345
SHA51238db4439fbbd32f86344a492ff1b272dcd32216b6b04a1fdb1847fdae18ad6fe11c37c474bfd322e154595b311cb6bcd559f2f8c67a331c754dd5986ed5ace37
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56527a47cd257b6bb98c783f3542ed61b
SHA1dc2e8e13fc498f41a82d25c2f2d8e74e98bf1cdf
SHA25639acc1d3e7949efb39c11a589f14394714c2af64f7fc8b78dd63a7ff09364966
SHA51284a21ac7b98a68a60a2809b3b2c48c6acfe4f1727396aa8aebf2fe4cf24bc2a1e75be6723701995d21beb76a671ce3fc38222be06f86efaee37869c77cdb4b9c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51d7b85140a62771b387452b4b39083da
SHA1a26582ff4791836b2bb7c776eb5e6db1a33d8c43
SHA256f9a11bfe041c4aba9c0bd5e43c4f7a9ffd19331820390f5cb5422ca3d8720183
SHA512ecdd458887d5a66c567d7e06056d5e477fdb9b659893ac1842fee580c933f4ad79c34c31c683dfae5be0246b7fa5b557fd95aded89a4b183cfa474b1a8c2caf6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD549f5e7630a65e82856693ef80edc8bdb
SHA1eff6d3254004545651c8c07b86d5ff5931260ca2
SHA256b502a487f90c4cc2b959dc94dd2dbad73edee6792f61c8e55b8bb828c26a45a2
SHA5127e0ef94b85647da2a38781c4adcca362083a2896e525dd76500cc8cc7b41726a460f1ad3f49388701ef3c572597e6f77da303e618489d79486bf64dc61167448
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a