Analysis
-
max time kernel
118s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
26-05-2024 04:17
Static task
static1
Behavioral task
behavioral1
Sample
744cc1b4eacece62da57ba38e84d37ff_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
744cc1b4eacece62da57ba38e84d37ff_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
744cc1b4eacece62da57ba38e84d37ff_JaffaCakes118.html
-
Size
461KB
-
MD5
744cc1b4eacece62da57ba38e84d37ff
-
SHA1
a4c5adea6fb0c24b3458c0a2c7915e301737558c
-
SHA256
dc5402472a0460e403a01123cfe792d667262ac94e0960a0de7b1dc6f9286009
-
SHA512
df87ac199c4d0ee556c0ee773c7f105831d7c5d11da18108676513362ed992867ea01355df1363ac8230e9f81780e9ac25f95bf9082b96bf0c4bcb2a8690a1b3
-
SSDEEP
6144:S+sMYod+X3oI+Yd3sMYod+X3oI+Y+xsMYod+X3oI+YLsMYod+X3oI+YQ:j5d+X3L5d+X385d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000007eb579f0863849e6ebefe99e3a75d91076c1e007682d405fe7de07305a836abf000000000e8000000002000020000000ce89486ccb09091b5c8c668176131a26e2f07ff4f95a898aed87a50d931f4d0d90000000fa5576fdbcf6ca6b25ddf10a867c6db58ac733909105565a914b37e50ef535b9d08f60943038fa067d4a598c00cd36c729e72e90be40a41a1341208a85a5e651de27d0c6353143e4022755d2cb67e42255d021384a8edcc367c26febae7dd0914929c60bd20d1c1be73875e8e1dd0e3607d17de550ee5a1896a16ecac24f6b0bd6fc47ea897b4c1477517aeff361a0ba40000000e37e278861deba75e5bf6cbdf4cb1668159d010f4c66bb3a8dbd4387f79365b8ceddf13155683dd965f0c4d6dd39ca1d87a7ad1db47fe3f5edba6a539e022306 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E1C88CB1-1B16-11EF-B393-E64BF8A7A69F} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0224eba23afda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422858923" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000d88162a724122773d3092f384ec599ea1e2ac8a7c098c70c533caf1a00cb2213000000000e800000000200002000000082103bce7bbee05586f9ba20b49e014e68b536b4286c40b699c273800e1261f4200000009faa87e499da00b9302f27d3ffd510bc3f424721dee206ce5dc5ab6dcfe26b6b400000009d2f3125ae411df79bf5a8b614103bb3241d61cd18a37c891a27a265f717f543baac7dca10f107a37763ceec0173ef0877978055163714404960a71e0c18129f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2936 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2936 iexplore.exe 2936 iexplore.exe 2860 IEXPLORE.EXE 2860 IEXPLORE.EXE 2860 IEXPLORE.EXE 2860 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2936 wrote to memory of 2860 2936 iexplore.exe 28 PID 2936 wrote to memory of 2860 2936 iexplore.exe 28 PID 2936 wrote to memory of 2860 2936 iexplore.exe 28 PID 2936 wrote to memory of 2860 2936 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\744cc1b4eacece62da57ba38e84d37ff_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2936 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2860
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a03b5ad57b6f57ca80b1e880fa5d6049
SHA192b60579490a5d7db21dc13ca0ffcac03e8eba6e
SHA2564b193ea137910091ad816c2d0ac757d56773ccda6fbaa009f703cd22fa6dd9aa
SHA512693f590c1f834d92df1c24fecd3196b769df8866998705a1256494bdc281ac4f2f1a4b2bd58ed35702e723ce71c8d3810ab2c7874093b4108c8a37be317ece5a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51c022efabde2ec6d8cac4b69cc6de8f6
SHA1eaa90b0c015ed087233051acd75adf31d19b0092
SHA256e2cb289241b9ea76a1f866497fae14ce9447d129f7ff27e51d08b34e7d5f5506
SHA51233904fe364688c24c94184165f5bf4b198884f9bd59d6ac3366c2bb40daa7e302f4382ae05c2a28f8ada22e02347a1a5f66f2e13a2445a094450435ff4be3ecb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c12281645b963614938c51d973822292
SHA186d0cc34975922b93faa46ce5467abe80f5fafb2
SHA256060f63ac4b51d725663045f399df46ca664b6871e29bc022ef9f3c8067985144
SHA512761f1013e317133125be1439bf0ae2adbb0dea65b69cad688a8fc1c2e851a66760994c4a1bfb7730c0584421dbf7203d2530067120e33e3572c30834da683bcf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55f569c86b80dece058399412d45dd91d
SHA109b028a724d60eae8f2267f197f49d9996618506
SHA2566837aec864ca7dea4e0b345b6e7d0fd3caa565ad5259e03adb14ad28decb67b5
SHA512b74470aee99f429c74ff5a0632a6771927ed371ad041030ae58a5ef10d80f656144fbb454f1906083b688afae4942cab3a514d03fe861f2a2ef80b941b8309bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5319dfb6d14e166f2e65878f454570fb6
SHA159e1f04625a973bbe57b7f4791f560d7e8731e77
SHA2568664e2b1d7de90a9b7ce2056e8f1940e9c1d9552bf26e082c933bea90fed77b0
SHA5125096902944736d566a1a2ae34aa62745f440f0879cc3db2b8a13117bd1638fffb124312cf38d3ecb6f6b60252373d6e2867519f2f096a0b5628662eb6f92139e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ad5dd64c4859a4e1b67afb0e4e0f3a19
SHA17d382b9cab27e8ee146963dba98e1e7b8abe7944
SHA256ebb71d9a20ca4b05abcf42514c53519fa31c61500f6e8dee24e11514288cd891
SHA5125fb9c4c63a1679e0555a0eae32b894d0d6601f803366a797e8ba969be8a40505c1e74a12e9218abdfb24f96ae72e39d69e42fda696447d70294b5ae69b857837
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5952872d70dcf6157197d50367de94d0e
SHA1f5a0238d926d6c3bb3fae922495b187679055917
SHA2560d36658b89e2a38659dd5636c3429b2a0504c94d00fb37934dcba73b2cc6bfe9
SHA5121a982111289ef9fe564de38b15032a1ef25422fa58b493fe3c250ac50881d4d80a25f57ce220266c41d95af856c971c4c7e10dd2e01a8c7452e5bdc6bcc0bae5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD581542007fea080c6fddc63e0455ff075
SHA13ef7c15134d0f9dc809575f34ddabe3d49928c33
SHA256faedcea6c54cadd53bdd3a2b9c873d84a93d4d43f57a318f5f0e3c4d08326f11
SHA512a304ece6902a2403b03ba973fff09616bd4a13e79bd5e756c271db9ebaae52603f178a363f3ba3a9bb819ecfa67da53a9ddf6dc0ba5566f89efd09044d988008
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d697e9356af312375dc03f9e2d449039
SHA1ee962fb3d0846cc3de5160af486cf5e79d8f70ff
SHA256ff2a249751c3a6c03e807d864ada315eb9c85eda8a41f2de1ddb997341b23b31
SHA512edf39142be47f1ae0115bbe28a6848019dd5c335c5e09e58cbf20f113f6b384ac131eacb2ab257f8adf4f9919fa442bc3340b7c66eb527950a4c6b7c7c005c4e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bd6231c0803991b36643ba1e2da59035
SHA13848a4344cf74eab677a5f9b19a2dad37bccaa89
SHA256fdb54ba2c95718f8e851d2f80778ad30d27b7d0ad9052605d089d15e0887d59b
SHA5123f574643e58c41e889b1fe45c468a053b75d528293b1ea9d43b96fee8fbee0de9e514114dd37c4406cb0dee7224f061e40ca789df8c7159b46ac73adf6fd7a26
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c4f88e74118642f9e1768cd2c9305f12
SHA1fd15b3e351537256c7e241310c509630a8ddc456
SHA25689acd88a2e68cca0c9714fe4478b386a3a862e3111beb4bee9c8de13558f1b3e
SHA51223cc77ef31efc352f84ab5c0ac9ef97fe24e5529669adf0cca782bbbfe93dc83d422655231c9e4cb03da76e4009b756cdbe50e321bfd0a9cfaa610816188692f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5efc6f6f0422b76cee3d185065fc3a14e
SHA18d82061bd79db8aab92e98aab2c97ed38b166ab6
SHA256fcae7f6ae2c36c7e216f80b3b33f940e7f5e65715d5e424a1625d5ea83c37fd1
SHA5122763321f3724d9086094d334ed77c524ec296e676561e36a4dd2815394044edd3576ef679242f9bda50a9dea2254c9a8672a03608facfa50c789693b8594d4b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e79fb5e76c7058ad2b3f14289c6977e2
SHA18c598d199c4b7598e9c6acfad86669bed816e772
SHA256772a55666f840782a6eaeb5a973aa626ee033abfa6ac13265a40e103da08c1df
SHA512ed208e76aa1cdc8018556c4abffda1f193b18a36c736fdad297385a3eaf1e5ee8c1817df0b0600b1743bd630bfa89d0e92ba8de1cbc50cfb61dc7753c44d28b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57a72bd5b7afb1583088514547d45f880
SHA1572ed6da63c0dadfd1e04b78e6b135a6a6512961
SHA25685283ff7871abe2f000ed891c05c7995b38639724534e4e4d5b2610e03d77b33
SHA512815d8f06ac1c5aa0ec6fba35dbd1ae94d8a11f829351b586bb675c2484485bfbabe14af3a0770d731bf9d38ca9dc940393f90e7f085971048f0f0eb20496ef28
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e6559ed30367e13ce29e8258bc99e59b
SHA18534ca8aa52e60582834109acd4f4e8da2ae4338
SHA2562afc61afeee373836e8b486e8adc2c955f8a50c9f0504bf30e6bdb7304236d7a
SHA5129e8970911bde95ce3533a281dbcf8521782ecff668b86fea30ca8646f6e79b9a1d135b651d29ef8a7a340b5789118727124393e0148bf9ec5df9b41ae7372699
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5464cb660168bc4061aec4a3cdce7df3e
SHA1af317859a4c49b6844022c2d33d643b66d5dff02
SHA2569a64c7a20bb617491ad3912d39b2544bd840d1a605f714234b30fe7095013ada
SHA51223ee3484bc58d116416154ad3fbc9135cb4254e3b9476629e8a90d235392eaa27e4418d4848e55c2ba3357cace19320553e218fad3da1950024ef97490b0ad72
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51bbdc6f6e0ba1425a5a84f231f213342
SHA134245b5a873d742eaaaf9181f38bcb3b696951f2
SHA25648b697112895828477f1c6a28a4b88f52524815df6a8ca9a8b2a6db9503109fe
SHA51269911c1ada11d8925e3b8428c2edfae5820f32126af2923abd7bb4dcd5f6de9923bed69e97aee09e398040fe3df82ddb141be5c38d014b7ef8ad5b4a7df1bacc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ecca57ca535eed0647bc8488e7125da6
SHA156f615af9fbbe0237e0c4725e8cd1242d7b64033
SHA25638c6c97389d77e1a111cb0368cb039c41ac675b1600c0430397c31e45d6336a1
SHA51210d7ff4cbb5e6e66088c3dd17591d8b73d5c1655a6bdb12a454936c9b63aa9ba9d3322396d0ff721a4241cc4efd429bcd5920834cfe913c7dfa5e7e96c348eaf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c990af0cd076bd48d196eeaccc3dcc7a
SHA120855673b4f11a057f3151e98e77060082a47311
SHA256df6b3efa975a4cb81c35c41c7c75620045c6fed84f7528090388ca1253851653
SHA512f2e688a6a30d0248a0ba9aa4e040d6699f71c16253163c6bd13b4b7368d15652b630bd4d1e97cbc73dc23be64e1b17d0e2def07b87e1c7b79e42909b86086f1f
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a