Analysis
-
max time kernel
142s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
11/05/2024, 01:18
Static task
static1
Behavioral task
behavioral1
Sample
320026a93e6c6ee66bd4eab1e303e17d_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
320026a93e6c6ee66bd4eab1e303e17d_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
320026a93e6c6ee66bd4eab1e303e17d_JaffaCakes118.html
-
Size
12KB
-
MD5
320026a93e6c6ee66bd4eab1e303e17d
-
SHA1
de67f38f5504c04c03986bb101ff4469608b54be
-
SHA256
f638850b6feade9cc441f0b15bfb1a8c213b7c671e02bdd58f6175752f912990
-
SHA512
0d5a44cc55a33e8d4eb2fe7a4437cc53834f883137aa518d81ba29dc75108889e48f0692a7e0eee3764d0daf619de11861c1ff97ede501543b20b2bf70913faa
-
SSDEEP
384:HkiOTCkZnViVoYp9+olNbI3+mkDv/SGOA6:4mkZn4eYp9+cbI3+mkTuA6
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{65E262D1-0F34-11EF-917C-6A2211F10352} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 902aa43a41a3da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421552187" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e93610000000002000000000010660000000100002000000075f92abe0c0528699b1bac244efd0e4a9c95d3be9c1bf90ef3e33f3e258551da000000000e8000000002000020000000e52f8880792fbbfc79e56ac8c3738bbe199c7a16f62cdc3215d6db039c38078920000000786ca18d08ee68d9dda0c3cb6c7c5abde78414c35211e70b6701924feaa13368400000005fcc0098c4cf559682985e7d0a2e86f9ca8b8ad68fa1c8f7f4bd6fc242ee4e0e68ae396593d4be0c8f41b7d952ca88537483227ff50744276c11e6f40b6c9531 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000d1b3a918451dde31e6473ffbdd29ce4d1b89539c562f84c6f12fac15e24209ef000000000e8000000002000020000000748e97fc96d8d2ad9acc9ead98ad1cf6937382a816aa278a5d29b7e8f28ab55790000000c631e7c9fc25e0d02bf2d35d4803df362db1ec7b2830c629fb5f9eb21c66154a0152b52656055908c7e386be3e9769a10005d505661a504ea50ba830bb1c2646b962f7c1780b78b9e6900cf69cb6ba736a6c4dc914343b8f0d06701ca1b2163dbb156b1c903dd6a2bb1948ec11c29d419d9f534ac6e70c33395335da6458b0b48f3e84d45aaff61c294bbc273b45be1a400000008513441a53965593e90cd61068966ea3cdc5e1b0bbae2156470452c5813d606a05aa3400a6988f4dcbc5a35f854bc85b2829cf3e5c7860645943946fe53b93d9 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1260 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1260 iexplore.exe 1260 iexplore.exe 2360 IEXPLORE.EXE 2360 IEXPLORE.EXE 2360 IEXPLORE.EXE 2360 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1260 wrote to memory of 2360 1260 iexplore.exe 28 PID 1260 wrote to memory of 2360 1260 iexplore.exe 28 PID 1260 wrote to memory of 2360 1260 iexplore.exe 28 PID 1260 wrote to memory of 2360 1260 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\320026a93e6c6ee66bd4eab1e303e17d_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1260 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2360
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58f80e8616d79339e491390e1313ff005
SHA1a9f8cc3d88fe25b81cd2afbd9be125a16a9f0932
SHA25619ac5b1f8ed454a416164f6c8590dd79e713b2eb8686c7fd8d80f40cabc85d26
SHA5129ed8568d8306dbbea1a597a33924e80aead117c296fe72a3d48aa6dac354545883d1dbb3619b793bffa04dc45e4703ce1b0f5569b6504571af60c804515af521
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55a0e7a6d68d8811094e5cad967fd9fd5
SHA162ee7e33b708bd822b6bde33c76b54e5758e49e8
SHA256c05f16cfc218cbbfa6bdd5bfb9365f62064392852503c966dad65a20b0a61c3b
SHA51261269d7ebc1800bc5c994b109cb98e27f4f93d44471d092d67d6c3bfe4c89db364e3e40c20a7897f45078652e0c773e6cf2cb47e426a3291b0a5bb51f3a25c19
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54d557decc76d32c0eff383c9c0a56fd3
SHA13ffb9539902273a4bdc9d169d77eed9d2297ce51
SHA256e4d0391acb67df128b3142844c72a533cff4b57eb89e9138e4458be32c9dd515
SHA51258aa1f50f52c80ce03b3edde31997d18d1b2ce70f5cbaaf15162c8e6de857dc5e751535637166cc581bad32f4d7361b0f276d9a7e7862c36e096f1a33c443098
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD563abdb4dfac1f8a2ea0f9ed03c7aa065
SHA1e13344224c9c052a98a4223b89afcb37983f4735
SHA25600550cfe065741c9087df81130c57958f569b71c021a65b81b1ccadcc64e412e
SHA51218694c09e217749d3f31f8c9a9013e9688c0869b35d83f7a845ccd7c310e7f035369d554de3216ec40a30e2c19514f164474da618972e0cc26703cb702a5d121
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5360bde289445e4d6d82444185678d5bb
SHA11a4634b97b4c20a3053b4cb1099d2c5b64e8524d
SHA25661f713286965a2715348e044aef9ac5dfb6ef935e1c0115e854e561d41c3b923
SHA512769b6ace2ced5fc54ed11547e5b38e13785e4e1f9060e4b157453a571dbab1261ed2c6625afd5deb4224ba3613e5db93e3070bbae39859c4ecde2373fbcc43df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50553b6cb4e912a2b259bf26a23628714
SHA177062c34c4ecaf62b282ba0d1ca3aac782825fa4
SHA2566fd90743f11fc93e80410e70eea497c3c47a30cdfe0088b211165bb8d0489506
SHA5128ca93462278dcb44c5fbc85493618e47f30aebb0676903253462c2c3aa09b0497b2da8ba305844f447c3cbb4bf9e812de5efaa38f4e013ffbf64c46e400cfff8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59e965e0dfe7a5ca2e00c7196fa025993
SHA1bcd00dc9beeee93deb401ba55fbb142dfe15c5cb
SHA2566be3a03a308e11846439b6ae399a2408d5e3a945113952d3d90e38ed67ec9657
SHA512a0672ff5454814b48729d837e9db3936708dc8b8230525cd2ba55ff7f9513c93af832d304588eda65b404ecf7233221cebfffdcee29a8498c2b5ee01c35b3a30
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59007b4ab796c6f4d53a1fae0f3fd21d7
SHA1bd434f9d8c9c5c8fa9e48b17fd3f41b30e3cfe6d
SHA25601884cf93875c7be572068ff1c88e537493b489d0944630f448ac23273baf75c
SHA512afdcd5166a7baf4635d1b7c814758dec8a2dc537b97c0b8f5d3a60e026aae603a319d851bdaba3ece34dd279c2458f3a03fd243835e7be33d80ce050512ed871
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fc3d2603b9a4386bceae83e0c126145a
SHA10da61570782c85c467aaf0dc6a83eba10054d76c
SHA25674ad57436b00f51c6b523207d953ba8cae9b08488e4f9486bb8a50a1476a829d
SHA5125829be33f39d9c1506aa35759cfd735e18829422ea45151c5c64b30bc21f86a2612abdd11e2519f5d6409dae99972c72398b7579b81efc34116b983760a6bf8f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5808feff5b6218b2c0c9bb1d81911657f
SHA106ca162f643e8654519b3669a460a1a03a24d54a
SHA256ce25e7131bf27931d29bc6740c5fe3d198f3e597ba2484ced0a07b40926db042
SHA512fbca965d52791f06b168eef31daf3e364def038139fac9df62d1f92a2a0c59ecf743cb35429c7283d9eb3dbf93a9eb2efd970b045798c4933d8ae661239c4926
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5710f575327024ba3768d5d3eafa5f177
SHA1d4610a605dc7d8cae00066cd61e31aa09bc3e051
SHA256b403fe714ec26ee62bb09c480e5a392c95da0496ecd7d5c15eb278217a5a6f10
SHA512407170396d66bc87aa438dd6c5929863d4f0825e7702c8f7ce5ef47344e073563f2ff0d38cd89b26aa42b093bb2ab096dc29fb2e0630586629bcefed575bfdcf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5864767ea61bb0c1bd86bd42ecc87327a
SHA142a8fa2b08e8b4e819ba2f39732e2d9deee8a289
SHA25687961df22ea2a5eabc8d15a86c29a39621d4be39c5c09fc7c63d0b8cc3292484
SHA512cccbf2798117ca684a6a6cb67814af2e74267d593eccfc90f2393f2656ed980c1a83c9600a33e35ac6a287066d6c573dc44bdf3932064efd825600e5b32c2094
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5abc9bcee4347296d1ab690e3bde5f0a9
SHA1f42a1d2c6bd8a37490e6bd2457af50e2d1e7d085
SHA25686f37d49508f7a473b3cb57f1cc74bbbdef8f96c98793eafb30fbdde05234634
SHA51204132623f19dbce98be290247a41ba80865d7baf91733881bd1a2e046a85d62c86f1f6d709f6a86bd0c286808fbb5674ad60e41dbd161856fb97dbc849d2d617
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c354f24ea691848d42e55b2730486e07
SHA164e4804220b828ab49f17f4bf1673db17693ec9f
SHA256b255a0e3b61eaf12af1d9f52f2ea89fcef4b6c816e22a3dabbc71ad9fcdb4fc3
SHA512a0b35d8667af48c7bd1ec100ce89810a51edce0f8e1c078ff8249af7eeb7fb22798f109b55eace22617278f75d620a50dc58ea4c6961cde0ed99fa1e9d2ff194
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52fd375ab0a8472b217c8bb2a00b1b308
SHA15ae04f70c8f5d49faca02803cf4de7a57ba4537b
SHA256214164c0335e79412da9c75427244a4600d726c5c84947656e5a5919c6346334
SHA51205beb3768a01085403d1e516a9538df4ef4653e8ca680fecb682839599e2d21771c90e4864b3dfa9b60cc8813ff1b1f6372e7ce84b5659bef390f36d39b7feb4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54c246a02a862ff1b4a4533fa327c11cc
SHA1c701458a5fb72f660575483e3437b3ca6c22df16
SHA2566c510038d39e3a596151c2822ac94a7413de34d01e50375ccf07885faacc962d
SHA512afb2ec27be08a24b0ab265921ccb085f4a2a2c4156f33b1824e391599c7e397fa53b40f064c85332c8dd25b9adccaf53f016cbb94503d366da939d0c9a755f02
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD537e793cff1ebfa867ee4535020179d2e
SHA15ffcff6039299a530e2892e4ee7a8349e03c0a26
SHA25623bcc894bc9816a18e7a7ce3543b821f000fdc9892b5c09d34bc99e99f6fe4c8
SHA51287422bdddd618033f59c29ca5a5c1751ba24453622dd0006d0334a0ecba5bd9bdd6c6500686699539c73619850c1a76366bd6ba6889ea1b73663b0fd055acd81
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD569fb11e72b4f0744e0fa3993afdd87b3
SHA11b72a9d453e60befbbc5f6059aac9b0e2a174077
SHA256b68f2f4501446623e84b277d0fbec0e4fdcb0775d8a33996a75b44875f743849
SHA512fab490ddb1741dfb49c5a83f75d27ac60895d46e4a24fb7dac3fcb467fe757f30c4772811f03c578fa369ef9da48e41ea61bf2f8b3c207633315448caff1e1ba
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a