Analysis
-
max time kernel
120s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
12-06-2024 22:10
Static task
static1
Behavioral task
behavioral1
Sample
a2a14e4f97d790b4c7361406226e721e_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
a2a14e4f97d790b4c7361406226e721e_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
a2a14e4f97d790b4c7361406226e721e_JaffaCakes118.html
-
Size
17KB
-
MD5
a2a14e4f97d790b4c7361406226e721e
-
SHA1
e4fbf8537d077cdd4ea71b798d6e7c2abf3a23b0
-
SHA256
25037fa503294beb631f3563d05f87d44d05a6082791872a2b6c086c7ef367b0
-
SHA512
5fc947e69886ff50e2e66829fe7be78381b7fda8f65d0a0c97f4b1b3390a9eb3557ea2a62631b83cfe97c8d1c61cb5ade41e1a98a15cac00a937969ba1b0662c
-
SSDEEP
384:wcMu1qPBMKBM3BM0BMXBMGcBMTFHl8/yOJOThxpJOWn3tOytOwk6q:wC0PCKC3C0CXCzCFz7nE6q
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dcef878aa199e64e9e871b6fd9b0b9370000000002000000000010660000000100002000000084b2cbe8ce60b16c4ba6cc22517570f3be99a858abd5ce1c220abf4416c500dc000000000e80000000020000200000006d01163e402db5d6d327d8b44d5a67085930b8af7dcc322560210f4a21e0e636900000001f16296a254ff3ea4a00cc6ec5cd125c2e428c7e22d8691ec3fb0d0709ba96ba59caef740401ba31394267fc76acd11c43da2eb750118d40647840eed68a21f126939931498f9b2847f9f7155a8c8c2b23069fc2aa662b1b519d56ef4c786bef97b9ad9ddeb3e5cddb105b2a3d371f253ddc43e01fad07f01ff694e25b32ece1818f50c2785adc1bf872fe0a4440b6ba40000000c888b625ca46621698dc2b1a8c42fc983058db46fb2a90d9614ca0d3efe7aa24cc2d4e7eae50ea685ad27ef3d2b87cd983e907b6cbb1a08820654038a4c6bce5 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d023ab7a15bdda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dcef878aa199e64e9e871b6fd9b0b9370000000002000000000010660000000100002000000003bc277ea2ef686ffe6b2afab51d35caacae96a79be492572d8dec63aa2c698b000000000e8000000002000020000000466c99f914eef0ebbd1612be21933b7ab92e03df689f0121eb6efe9e5d47153620000000b86a8c0e11be08b8a273a8320bbf5b390ee8e0fc38fc6d1bb7a30e1544bf07274000000037587ef5a6c06242bc163ecfe2c9ed614ae3492a125e2bbc8e5ceaf8faae649d4ae3e3ebcfd475151f6fc891d9ff1056735e2538ddff1a3f352d22df4aa222ff iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424392126" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A5FB8C51-2908-11EF-A3F8-62949D229D16} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2740 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2740 iexplore.exe 2740 iexplore.exe 2524 IEXPLORE.EXE 2524 IEXPLORE.EXE 2524 IEXPLORE.EXE 2524 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2740 wrote to memory of 2524 2740 iexplore.exe 28 PID 2740 wrote to memory of 2524 2740 iexplore.exe 28 PID 2740 wrote to memory of 2524 2740 iexplore.exe 28 PID 2740 wrote to memory of 2524 2740 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a2a14e4f97d790b4c7361406226e721e_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2740 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2524
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5356e8d734d20a4bfec475ad0d504b6bb
SHA176c5f463ea32cf9e113afd719344da58fe00dfcb
SHA25665e8914ffafd9db42eeece3b59e9bf307e9e43092b508e3ae8936f24d2edd69b
SHA512d311d678102680c3ac70c55327898915d16777ff36f2aa6c6b9a55f15b7e555c8c8ba6b3b89944e8bbd74adfb3ca9a2905eeb34edd5925667469c494b9af45eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5018285d51fcf3acf6b306e9ac6a54136
SHA1334b5a2d85b097978c70ccd74811b5691ec1a4f1
SHA256f7848adfc795eb5557f6bf4a9643a1089e88122fe1a5ef3d650d84e21703d089
SHA512ca401fdca7acb0c4ed7f9ebdeba0915c289d5a09028d1707f2c26229bca957cbb29a3260d346f361a3371e57b5219ce57654c8071e5c3030a9711c751505f8a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5732d460c2949f089f65abe6d8bd3c70f
SHA15e9fa0926e6b1105391264e3f42433cfde5f6dfb
SHA25628b29d6286ff6d253209ceeac62286b2b6e5e8240950eba94e31131c96d7f0d9
SHA512feac33e78ace12353267733b286941b810b609c239adced59df40fb152c018e9e7e1a191140a781c0a10bfcc84818450d80bd00eaa0cfd8a97c8e82bc80bf6e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5344c3fdb980d39b5a6fccbd824aa190b
SHA1f39824f145a147631960611e49f7402d9df9d642
SHA25608a34f8ad3cd8755421863d5b3f3fc65c823234c537e110677fbc524582df27e
SHA512cc19bf91f954abe0c6041df99653981188f315f5a76671fecd4e0489dbbc2d58c3edab33b655575ccc8f2c739d11293b1ffff78dea7038a4885d5fa9cd614faa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dff9cd8c1c7605cc1403aa609d72ae68
SHA111f6fba6ce6984a9d001f39665879819baccd81e
SHA25679a5f7b882bb8f48bde427028b34346c125f784e2855184fa29af3b33e0e5c56
SHA512123f77581a0bb0f1f71539d2d559250d9133fdb2860241072b6e2eb9a990e8c5d88cb20a7cb5b944971656e2bab241707e31bc1d7ce540f62be97b0ad5eec3d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a83aeb964b401177f50f92aa0af9862a
SHA1dcb69e9c50730f7c79a6149056c4951f4df778cb
SHA25651b7abe3ee5c2245d68b5f92be1897a97d95fa810bbec4667cdcc1701fdf7c72
SHA5125503d2ffca275549ed420f94cd8726cb8ad57be5b1a804740ceeda3ff598643f7c1d6c379774afbc847ae08c902e44609773eb53e2f3a15322d35891cc35cc8c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50ee6391efb73578a87c4b6e46a1f50db
SHA141cd5ad00230d0a6c44a510588a575d4cf7718d2
SHA25611fc09826401e9e9841c97b38dff642ffd81a972d31d8a8b60ad5379b586f7f2
SHA5121f060ff3a855f14c94da4d9db7d7e6ae8eadb4c8c5710a1aa0af5305b7e417ded8a0f4e62bf2d4a143ebe275553718455befe0d23d23689699134e47ea96021f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53103db7f42ba5d3e5456f52a001af695
SHA1eabb4b6c27cc393ccde3e787e377469825e18627
SHA2569b26d597337c6629bc82a8ad348c9f2bd1a7d8d56a25ce39426eac2d21b08247
SHA51238b462ae7c5ba2e65f195eb69724a8725f06d7a5f0baa4fbee0f3a5b6bb56e6e71d2b91e7779a5bfab64ae500bcdfd40ef145664c7656c6c9ad71d1e2c4351cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bf3b803064bbde00188c0fc1f31e8c5d
SHA10e0b926ad9fe6d82e0d239377d7231ac9045cf5d
SHA25626142b4a5a288b881eac660b3402331e28adbb24ee5ff4b9ff5abfa1481bc328
SHA5122d4a8e59a8537be9cdfd4af4599f77d70d263236f410e6ca349953a592a61f17200b27726775f941698248b96c67ee5af7c7fa064f2034f0e67f816e3e45c4df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f2d567e59be93f90fb884de38c2c400f
SHA183e037c30bc161888cfb14185b64a34ccf061a88
SHA256ad3c60c08e9f2714f146b066525c77cb171bb89e255ba5eaa12e896abcd3a8b3
SHA5124397ce016204d06928d8f17052a65064c2c6a3ec2e1666e75c73a796cf76523423bc67c0cc16f9f8a09cdd9929b8a42d9d2e02a04d1586cee969f147c833a10e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD506bf2be3f40f658a0ba2343b18526a8f
SHA1baf582ad01debdca6c1d818be064e3211820337c
SHA2569ea1a54d5486bab13c7800db89484f12d79dd85c3b21ad9889134c454f1cc072
SHA512b237008c0ab3a2ae5f84bb5b4ee91d5c03281fe97ceae08014078c8935a734f4f56dc9079e7f8703846fb7b27923665015b56cb0458a1dc85dffc5599f85b526
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54a22888ee9a9fbdb084d46bf82b3051a
SHA185c7db917908eb798ace02fe3fdbf0bb43105789
SHA256e2bbdce96e24180658eca06b561365f0b6107f1a7b0a387811171545eb600c82
SHA512ef91b59d0652c61f96504b78f29f1d018485d7bf3f2996b4756482622d48fc77cad3a3496e4bbc3fa3ac84b4c95c139b10f1f0f4877d199e8ddd076b9e76367b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5feed1344a778b7c3dda8b16aade0360e
SHA15bb7e1eff5931772cc86db1843b2db120dde43ce
SHA2561181614fd9662e959d5fb4b51d7ce7a7a83b9c4d5fec8973d436621a5361449d
SHA51272d344642b9e8620901fe9c196dbbbeff807f6df66e9478bca48ce58a728b87ed7d01aad633a244a968650bd88b371f9f75bb3c0241e652b7222a38c1ececdb2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD563d0491264ee668773a2bde4eb29a6a4
SHA1edcef1d16303c905efc6a73dc728075afff45939
SHA256805b132890e87af3382882dbc3e5863d99138d8cc4c61df82e610cf9db4c986b
SHA512425bd5d2d933efaae37cb0fe363cbf1d17d8046155538b12c59d2b0e2eaecb7b3f0c92928ed872e668a5c188e3ddb018730e1b9079671961fe9baeb6e06fe1ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5206a492bdd3e727765249d3d9a27bea8
SHA1b74e7c69c91ef87cd2ead4da3e48227f682b0c57
SHA256b6e4258128b33e1223edc1cadd34035a778ce3dcf631384c5db2c808d08c552c
SHA512a79baee105954fd5c22a185d0c9cc8127c6611ab8cac55e1a44598cb972788d6fd3ee6a33ead94e5870e655495d002d4e7857a478a2d736cc3a2b610525c83a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53a801f6d6bb14b2334b0ae368d42920e
SHA1475e7c617aa71b9a83eaf4e620f2f954e4dd4cb8
SHA256d47f299715adbdea9b5fca6a3092a60c72045e97e7ae516d4ec4addd64b082c5
SHA512609f8533eca37c2640637455d8992d15e044299be4f83e8f273efddcdd34494e0faac2acbeea6018048e344f2e10bc8b7efcfe48d630c4c176cd803ca1039a55
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD584b7b3c12f39b09fa76a2ea2fa9456c3
SHA13b7aa381da873183b046cdd532ade029101b12d6
SHA256e8ca51a94240e014d6af809a9758ef54917126c054c3f02f13820c49efa3dd6d
SHA512227fea25e1df45b141024fd724e5f7d99db8970baccf7020b1d93800170e114714d9c7ce677ae1a2e8bf1370bbe09259893c0a13412a21bc3929a9f3d66095c0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f0f36a650d9a1422048b70f9d8ddced6
SHA1d9ffb59da5442ebe11986c6f410ebc5b52b1e1d8
SHA2567aff0d9bb3cf2bc557419131356a7852398137675bc5b45a9a078a578d1991dd
SHA512d317fba2135707cac8cbf4a58bcc711d088a59522b89b71b6acbe4a8116f98a188c1597f8ae8367cd34b216364e39a8d20fe433064a4518ba937e89f13bfef1a
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b