Analysis
-
max time kernel
119s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10/05/2024, 17:45
Static task
static1
Behavioral task
behavioral1
Sample
30497db16ea44100910c3368a9216803_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
30497db16ea44100910c3368a9216803_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
30497db16ea44100910c3368a9216803_JaffaCakes118.html
-
Size
460KB
-
MD5
30497db16ea44100910c3368a9216803
-
SHA1
c7ca8045cf0a3760bdf7b42c3b6c0db931cceb48
-
SHA256
4c7e22be91d277ae85647d9f41d47448662d8cfc15244684600d44608fc39a1c
-
SHA512
9a7037539102883b9e80104e2d42674d6dc88135ca4172dfefee4cae0a5a75bbe861e38a97b2ed98be8434e6c4b35669189aace267e8517c3ac3239b808fb86d
-
SSDEEP
6144:SbsMYod+X3oI+YSsMYod+X3oI+YusMYod+X3oI+YLsMYod+X3oI+YQ:i5d+X3e5d+X365d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0098dfb01a3da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000005beafc6683445bbb0e7b1ae86a0691b13e948c4c4bedbe108265b5edcf30358c000000000e8000000002000020000000f6b6b531814561852ff4d9db7005a8e9d3d84754d214a128c457fe84bfd7ae7890000000bed15596eb019d829d17ef3e5441055e4c74d6d4330ca13072efa854413f17f2b3d2072d29f67a20e52743eb1d0d44afe741ed5b4e64acb5f7f867dd1bc15c9b2a79719e21b55d0de055c1534ec9d01c79acd64ba011bd1686a270ad3872c8fe942ffe02dbc1d5024e8cd2e8e8ff7b7f8e79028aa3fa5b5f710f94bbccb5ca8ea7795f0f7d3a1a295b5605c9be45f17d400000003f436e6653a79214b39ae265ade9e1d298a82b719a813c798487ab1b4139d9a6a04dad69586ab6d12bdfb5d57c7fea0904c7da740afbbc1b73eed6e72ab8d5fe iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000b331221280f8016aa9586152b86772065b4f036e16481b9bd3437bd9fbd928dd000000000e8000000002000020000000e3154f7015ef361f8de66b301c7d7d15334f11abc43c90cfd39b70c2c66590f2200000009d512c95090e5bb5e00b5280dc06310ad3b5d7f897c0cd0f9b3cf3e65642095e4000000037e647b375ace52eec8e15d711b3902e3ef3a4e4e1950de29d268b27d9e374c1137b17aa2dfbfc0c5cb893c035770f3f2dd9b17def6e729b444f413452aade35 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{22AFED51-0EF5-11EF-8698-5E73522EB9B5} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421525017" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2812 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2812 iexplore.exe 2812 iexplore.exe 2684 IEXPLORE.EXE 2684 IEXPLORE.EXE 2684 IEXPLORE.EXE 2684 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2812 wrote to memory of 2684 2812 iexplore.exe 28 PID 2812 wrote to memory of 2684 2812 iexplore.exe 28 PID 2812 wrote to memory of 2684 2812 iexplore.exe 28 PID 2812 wrote to memory of 2684 2812 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\30497db16ea44100910c3368a9216803_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2812 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2684
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59320256b7ce711dac78885f1f21dd400
SHA1d0a190a6342552e178a7ed3ae78e6971704fd136
SHA25694431b4772c4bcc77d06886fef41247a2d6123ec02881572042af0a41e62c7dd
SHA512a019011f024bc5de8ed950fc67357c356d6b1a9672d0e11b9353100af11f95c286818b568a4f58e107da756e570a0ae0fb9d1a4c51e55a14b54ebbfc1f73291d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dc366076310fb62b6c3fd111e5f745a0
SHA100f30b0cdc072cf1cfdde093af849fbfbffbac8a
SHA2568279456c6dfe6917cc22c0495b2826f0535853a163bc18af89992a1249bea2c8
SHA5120b5cdf63a087cfb5c9d7a43ecccbabacaea2abb45b61aaa239da54b9e79c7430039d63bae88ef02fc5cd63d0aa155660f537786709e59f02148779ebdd7a7057
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51fe1d8fc3485858af44043274fb289c9
SHA1407c88a21bab821939473c7cedfcbf17f1897b5e
SHA256a6bda5184b62f68d6259d2db46244de1de3539f4db33bc97fae956f5db7f49cd
SHA512f0321f9423a220f45ff1509b6ba8bef8834d84d3ae77d16eced86bbfdab7144007524c4b5ffd6aec51276d4f325253689568261943daa8e9c110063825e7dd38
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD537f545db8ecd9dd52639ac07098cf572
SHA1a04d38c208370780cc0d395aa307666c3d75553a
SHA256cccf77725e360bcc2935f6751dcc244f1366f87f546478710b8d01cc2b1bbcda
SHA512d04a385a823b1b600e242fdcca99eaf30e11506fbc10ef1a3c3951020e6ac5ac05617e042460c6ac89a4373ad08367605f262ff10855dd0cf94a4d5600a202dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56f62ed8d23f38c99c209c1a8062fd5fd
SHA10fbd36d482acce997c5180e0a63b1e4435322754
SHA256dd725f6faac94d94afae14d0177f7170e4a45473c0563d5c1f1fa9b5c313b436
SHA51263feb91bb13d7f42f047ff42bd01c6bcd76edda6ce904c61ad9decff0ebfae0cfbb71466e922ad5e093104ed65d057622bf19584bcfa46fd5c7dd068677b3fba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c2b1215aef64175f8f48422ec01adf81
SHA1cbb877b88a15c1a9694e4bc40060a6de56ad0213
SHA25615427af7f100672c75fc6d696220e978741a302a7e2df56b7dde1d55f8fcd988
SHA512f11701b0fb9e47281a25d4c403a27fe32896449f0b1d133659b7f4079cb31afc29bdccf77b6b33bab4b68122d039b3ef7472f9cde51b3014a2a41f32a0e4a309
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e923a23df7f899f2d5b0436d2727a17e
SHA12c3972ccfb110970a3ce997be970cbd415668afb
SHA256f5e0c79edced52406d3814fa59d02760ecee34fb5fc570395ee5176df675d0e7
SHA512fa3dbe82b151b3c94555d20138fd98a93af371259a34a70a74d0adb782e0fcd0f3b5d65a0787ee2f07c571e411ba970dbf9578da876ee0e7f99cbe216710688a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dc793bf7d6c8e839cace5c65cce3a7b7
SHA14352149eec856433ceb56578135a56dfc98b329c
SHA2562afa4135e51c5ed9fd27b4d2c374a806423506ea9481a57d96ead51e2dd1e729
SHA512d7a75f5d6406887c253f970bb898d27d239bd784b997db7681a599b28808906c26e7bbb15a501697ca8e25b6b7f07404ed6af317b73627cad9c24a0ff70eca84
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD517dd2e89e76e2b0f6115297ff74f75f0
SHA16730c628f8f1662144c05f0e8d00c3ff24842791
SHA2566c148f6ff7043943ca7c94ef4762d37705bfd958f7bcd133c1ae3627fa8ac1a9
SHA51240e3e56f2e80ed8ab92adb1a269c382065b54bf06ba6dd3e23e335deb9a4b262a087a7d16c7e0b6295097fcad9aa8d3d03e8b1c921ec2eb3f487509cac0e74a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c27ef8336c9fbb9c9bec99ca3839b60c
SHA1a7999a55e5e78829b39df5edfeb4987623a68f2e
SHA256dd1e81350fe793c578c115e78f151ff43f3703efcf4982f0d9f410e95d14ddd8
SHA512d7483eabda08836917db0a4fc3ee985ac6bb6f5da231c33ce54cfae89c247ef4d1e0d519dc6e66400acc0b99a025930f8eda74f67b90bb62dacb0db32834abf0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d756e5212afa0b2f0f9f4aeddc3b8750
SHA1a72092707d91f9731d9b2763ea665f74fd3296f3
SHA256167ff8cb8fdb8f9518784623fdaf6627de4322c883018768ca77d804689fba95
SHA512282e62136dfafe52dedba5379e661a9a54aecb5d6bd06d96003dfb9f791900330fa6666af681040e83161d297ae46ce76b1bc3161398c5680d07dbb647ba3cac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD555a6114fe32663fc957e86f3aed5bd7b
SHA1ad0a9bd8d0734685af973f463e67acbef515e2d5
SHA2568391b450747f4e462e7063b1120f2f9fc7f3e686aae3874b730dd6ab7d1ba1ac
SHA51256d7fa4616b09ec1f5f0c8c5b9a7498773ca81b44111cc92a5c61ce0af08d0df886c12ba65f220cfd96f288b1f2829e6330284de017705ebbfd885150e2d17a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54914de88a2871fa7af17fb84523679e0
SHA1aac927bb35bc2c6debb7ebefa1130f6f6a7f80b7
SHA256114f7723e16c948fd3d5c53f0597c26d482214a96a09da34d34df71c58b7d9a4
SHA512acb4d7422a0bdea503d1d08a068a3ad7cfd9a2451ce58625570a16346467ccbe427d28ef5e5d42000c1e0b374a77fc0bf1506bfa9a64b628f531929b52993f23
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f85961fe464101bfea02a094d1f678a2
SHA104a6be1c6df4f5442055d58688db528ed358d6e2
SHA25631893910931f3e72d6a846a357dcb00c5acf9458e1861964f0982780d4030caa
SHA512be30790b0c88275e28bd6815569c809ab3f506ad9550fb859120e2528a3ec3211a9ab554b6ecd66cef9278b2e46e0e2045b3cad931a5de19d1ad21b266616e1b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e54c40f0bc560275e2c36dd830ed319d
SHA133c6c514a54d94c3bbb7c16a9617372eeb4dbdc8
SHA256681733fcca3ae5f9968afc0cb057f1a10bf7db1226a0f36b824bd403a325eed6
SHA51238941dcbd3e43c2ec529780d5d96115a56945f3a1793d18587f2b19265f740ebc9433782c001edaedcdb90a565e0bf45c7b5a7b0c728fcf6db227a7ebeb18495
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD537a3c10a131aeb565829f7dd6de7aba7
SHA1f78f1e76533db5a4cd3cfae2908ac417ae288ed1
SHA2563318372c130fab17291702bff1648f9059a8704cc6b4cb721dbacd108db35154
SHA512c6b1a880d26e73513cdea8fbc478f1475ba39a9fb3c9f1e867a6f30ad37b18d264ca62fde44e08951a322b3faa86d6b8378dbe93e74bada27e2b3209f550b769
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5af8ac6525e5d25fe753b731ba201ec08
SHA1bde58d22b849492af24a82c48eb2a4e58604ce1f
SHA25664560e80b93b2b7fe8c958471f5a582abfbd7ea6531fa2b8533b4605a02672f3
SHA5122f61c1275cc3c3c89362c6d70e4cce7dcd4fd7e3f3a68c05764725cf1c0905af9c2254a72fc95d6dc4eee25b952d2d62dce1e6520ea5a5af83f08d9b36139f6f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52c78ef98f7d63de564c728fa8011730d
SHA13f9351b6cdaf7f3af2755f10ea9685380d10a9cb
SHA2568307b9fb56e385fc9066eee5be978c87c152788e204ebb79304651c10f0377ef
SHA5121a51791739d71a93e3363fafe842e300cf23dc6b9437cbe9222d8f1f2b27a321cde8843bf00d2d77708c9976073f5f8d1f05bf375c70040a2e815e541c56eb42
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a