Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
11-05-2024 08:02
Static task
static1
Behavioral task
behavioral1
Sample
339258d025921174401c01fcb26fcac9_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
339258d025921174401c01fcb26fcac9_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
339258d025921174401c01fcb26fcac9_JaffaCakes118.html
-
Size
70KB
-
MD5
339258d025921174401c01fcb26fcac9
-
SHA1
8dfffb72523d9cac3a370a4d73007e685d3d8f8f
-
SHA256
1bec81a76d35da86473d3754fa2c744a378e23eebca05f9717f6492991815493
-
SHA512
e02532819a56cf8e9330fa03dc1d92ed2f3c7e1fe401c1f4cfa2fd44a5e1615a8c5a75e16378e2f71f3ce5180481d7c2073f0ffc4ca2cd3d16e61417e4340b63
-
SSDEEP
1536:6Qy256jIvq+MiM0QIbMnM1TyijiZx+xwsaM:P6D+MiM/XWTyWiLDsaM
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000e25f455ef8ece5515173d24ac1ec1c23c4d56af2f6f959f894b05c39a3878a3e000000000e800000000200002000000034fa6e4f186c83cc6e63c2189fe3ebbdfa70c86c5a28750c0353903bffa6165920000000166d87bb6ac5db6178f10c3e7fe1cfe81a890dd9469a02029a90ade47af6fa1540000000f8d57af591f43cbf66ea49ca5d5e152a26bef48543e2283941f2b4263c7e6adefc5a755accc60f75a26a4cfef29681c532980bbf38dfbf80b9f8e0def3a3f396 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EE2EB8D1-0F6D-11EF-A233-7678A7DAE141} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a06bfac27aa3da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000fa3d470721b28f38ec114e5fba8f81e26025dda7bce0a4f6640a3360ff408964000000000e80000000020000200000006fbce49fe0129f3c41f673a2c6e856e22bc6ba6cbdb119699d9a3eeb0d4ebcbc90000000d84ed841fef7067e80dd523edc5a18cbb0799ed971057c0a6746c2437bf6512a1cba203522892623152a7a1105169681d106f1130233b265ec61073683dee52e2c53d702a376774de4251c0e971179f05e070a05a1023ef9573ea40280fb69d76077a8200f52f561651ddabccf47ee7e47f4f3d7b060e571750f9a2aeee9d686cd0455954162ba93783b00b7be0e77f640000000abacd319c836ba0c9b477aff004e44c6f7be22a4c9816627481ed336973727f22d641df365e616123903b8cf21cd9cd51ac054596c844cefe61677f6f4dfde47 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421576896" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1300 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1300 iexplore.exe 1300 iexplore.exe 1708 IEXPLORE.EXE 1708 IEXPLORE.EXE 1708 IEXPLORE.EXE 1708 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1300 wrote to memory of 1708 1300 iexplore.exe 28 PID 1300 wrote to memory of 1708 1300 iexplore.exe 28 PID 1300 wrote to memory of 1708 1300 iexplore.exe 28 PID 1300 wrote to memory of 1708 1300 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\339258d025921174401c01fcb26fcac9_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1300 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1708
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56653692fc2717e55f2c1fdcad98ac1d6
SHA1d979dfed8b041bd30c5e5812c3a2d793324af3fc
SHA2564f889fd80a49be45a5a2f3a3333e6c0ef6eb02194018bb8767adb0a303217800
SHA512bd235017482ad592f21dbc47fffabc121363cfe3098e2929f5b8a34fbb41b98dee58fac191ecf2e22bf784c1ec775e6250a2ee88e1293c989518706a08c347d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fdeac261a400a9a5c2a745eec416b0cb
SHA160fc054355e5efd25198bd72ec80681492170455
SHA2561af6ae560982b3e381615955bf7b208a2c289003c36a16e0a9ff54694b8031d4
SHA5125f9347726e592f12ce650651e5bc86ced7921d63876be03cffbf0e580131fa9d5290233c395b7f180aa3964e07c4c2265d65e7e8178d9c9f472d57b03061b6f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD542abfb5474416ae1a2e81dc6167507ab
SHA1308cf44396492831b539dcc40102fcedee62246a
SHA2560df87725d37cb6e2e9922ecdb0f2f9865e459b3600a53d776dc40fea039e87a7
SHA5122b35bf2d20a073ff3fc51e2bbdd051fdf4646d8dab0157ead562272879450a326538eaed29caccf066cee55e64ae0665413108b10d4e7ccac8e78cf46b728852
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD561e8e3865f4ab88c8a9c4b1e2891d4bc
SHA1203d5fb93d9a03412c539d32d35b2ac29d9b2aaf
SHA256de8428be6d16c72ab6d94f56cf6ece53b47b826d560e7e720e0f6a288ab5a1b1
SHA51262bea7b7dc78b6b28c6aa29f95c621e4c255b01780c7030f2b4f6d11a16c5a5bc3775f7ef654df6de0cb8b5d8ad9ddf2efe2221de192eb7f190760238902bb3f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57885f6c6a40032b97350b2c3691611f3
SHA160bb2ad827397dfa41435a6c158695e569b4d279
SHA25646363c1aa9062602b11ab80e33c63a68f2ed2706511047508f7ca2989f776986
SHA5125ba031467d7e94d2cfbe766554d75dc3de678b8cb87e92e8d8f37bddda698a953462b96f4f6548fdda6fa3b2f578bf5cd58c8ca251570202aff7f1a78ac4c1e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5010252f61f776c1667711e0f57926639
SHA1dbf4a19a1365479fc409561d19d6274f3e70f9a7
SHA256a877b37d62484555025ea0e03da03c6f49d40376ec68e7c8938b631662b150dc
SHA5124adcc3e848f80f8fef9779e5fb08d1c571451b1312e177c560d866349c3285f09691f2f663777cca1794949147b8a1a51b9145323662d6d5e7ba167c40860f15
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD578fc84650aab45295dffa13826876f5f
SHA15cf6b1323af1e9f595bbb935a146907df36f0f07
SHA256b73664cfa15eac2a5e8371f645413ebb4287594a12cf437754cc97422357dad8
SHA51221f430c07e24922c0e2dd8cd2c96cb9645837218cfc840692c4eaf76414859d0fba9cc8bbb0a55237486409c803dd2598efad236fce0c0c91aa510b78b1935dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5625d31c3e5de50fb33637dbdde51b972
SHA18bd42c647d4b9c2152a659f1f57d0548f9630237
SHA256847d849f2d935a21882b898eda9ca913c8b4bdf36933e4c13e598bc98be9e6d8
SHA512e39f54ce4f4d19babcfdd292e158a746e6cb2a588f20c5ba5041ab7e494e14db28805812a532f1877cc460abbb0133b1560bef8f3259443949b965efb4b7d30b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a7be1fdb4e08decd1042d1737d71f5e2
SHA1d2da738e3f83805dcb8aef948fcb0c72e5129c5a
SHA256b07af481a5b70fdf92bb1ab2e55bdf0930b5e5023c401eadb7915ebfe0cd0358
SHA51254ae4c195b9f3a741606dcd3aed5bac0453bd36e8b325279d4f06d760ce6b175c05047e486a176012eccdce1a429a54be2f5f5fb48a9174b1e00f8400e3b3904
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD596477c8451825c2d7e6f588c3af92e1c
SHA1145daf4e85138b29877b542a958f5a852c7ced4b
SHA25646ef385990831c21af9bf1ab0b201fe5bf6116fff81964718a9cd626ff2f88fa
SHA51261b1ef7d7316514583ae34931728ad2cb7ed42ad8e58068ef8e4248071415431126c8f08f2a6603b2320d1dd2c2ef1950d2a58a6d1e9f51d655c74463201fc2e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5899920736019b75cb89a562c9790e3a8
SHA10b3bbd2617f4e76f8d0cc05045eeb6cd13640b1a
SHA25647f0a478325864cc34bebefa382ac97c78b0357501355ca39f871cb671a3638e
SHA512d9e737f5fb50507b4c035ec376d6d0dfe21bb4f77ce94b8651c28d4ad9f11dc0f7261d2f6ecc7def40604557706810c576851760b8dbc4b02046fed66318e45e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD535c24ad15a2b70837e5720e640e6c5a4
SHA1818275b7e6e733264525a3a1b6fe347ecd9930e1
SHA2568b5776c08aa743e68b4ccbf84ded8853ab09b5d23e83ff5f7723f6f0d6671b91
SHA512ab3e68928a1cd710b7d44a7b72b54c7777199a4d7c94548f62b61fce89c315b3fa55ad750c20ea5430f66a2cdd5152363a7e82efc68d2a4bed7f555036f940fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57406b1d8541dd913b10a82443d8ddc44
SHA10f233bd16b0786d338594f3bdb9718b531fc901f
SHA2568862b1e89144a9d9fdf0eb7bea51cb6ba48078e0ba3cb5085c6d99ce7a6e5548
SHA512514b7dc43ac507e3ec1c188e195815515f0b1558a8b15ba65ea5029189720de4c188dfe9e9235f3556d4fdd5ad609f190ef1b15c42ba68127a9fbc410a3238c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD540fd95804a05468f40c2721aaf478f5b
SHA1be77b4df1c13038fe3b9a6afa20b97a6b7e209bd
SHA256d70781784f853bd067c513e445c5b31ff0f19ae3ad6ea88645e3425d42d89e94
SHA5121ef9e81ba0e71e13a111ac99075020fbdd82a24ac167d84dcfed102b53ac8cfba4de5b64fdbd8c978c59599b751909dbba2c9be164b0ea19a5e24a3c09a2a8aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aca10161075dbca0c93bd3faaedbc393
SHA10c0b674819dd5433dfcfc4b5b36c795dc470806b
SHA256ac37eb7d53b9268d4abd1525d6a2ead922227fb1bc1c9a98495208a7f5fda323
SHA512ec4cd0353ba510811d27736c51ce54837e0f04b604ea23388866645e7fc397e029cf77cb3bd12f58640567f1d495d1a7967213506ca23741afa59f81796f232c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fe1f36faad371931ad5e49745ec1a882
SHA153fc9ba1e85b14f09cec3af93ef07aa8e349dfb7
SHA2569742563342388d564b80d972b3da8b1bba4356dfee1ff0f5eff89a5974fb89e5
SHA51258cb1deeb19320be4b6c63fa967ca22b7cce3ae479f23bd56743ab605c8b68bf6f70adbe63fdca08d5a5478ab682e6e54da62e19450d632d6e327f370c21eef4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD538d8e6af0e8b115b1c869ce54b4de050
SHA1bfaf91899ba83b1ecd47392ea5ceda24c7d78254
SHA256e2b52a5f2f803bfc85f520862c85cc98f606f5bb0cd02777c4b779ce5e5f0467
SHA5125d9c2feec1c32ccae650283679553dbf8d6b9192cb627caaca4337923ba53288a10e27c41e5d0a6be584707d6f603c7fb2795e0568c221dfdfb633abe4baf11f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5618c4397542a61d216230c0a226b6e88
SHA1444187cae0da25fe473da4b269377fd257f843d2
SHA2567f4de18bd5c355b750b9d421faea3bc45e818ec86e995cba1ceb0b9c3f220145
SHA51228f345097dc60acd9e811ea1c1cbb4526a4e993f299e25cea35efb7dd6f263ba288a5d436ea10cdb52ce387a03fd49ab341b12e68cfc0d9f44b00dd13f40a395
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD589378afe5040aa6407300403f7816397
SHA13165f7749653af93536870bb64f8821d19ec995d
SHA256a2cb28a8d82f6a8022e01615eff53223cc4d69f2e966b77776d7dd1f6ab383b0
SHA512cfbfba14d7a8801e2097d6313a383d24496c04b9920d0caef5b67ed3ecf0e904775da959df9e38b183cf1c5c733ed5cde8ff2a03f3055eacfa69776a3b0d4fd5
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a