Analysis
-
max time kernel
118s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
12/06/2024, 13:39
Static task
static1
Behavioral task
behavioral1
Sample
a0dadad654c86380b7734da4a363513f_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
a0dadad654c86380b7734da4a363513f_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
a0dadad654c86380b7734da4a363513f_JaffaCakes118.html
-
Size
43KB
-
MD5
a0dadad654c86380b7734da4a363513f
-
SHA1
a3520c0a20d0eaf9cfbd4c4cbea382e73d9c1f70
-
SHA256
95afc35ff069c2f5325cec19381a6168b9a762279fff94dab6d735a970138fa6
-
SHA512
a3ba7b5b77a3e4d9e019840f59b5c2572a9ce4930831fadfa887994fb0053c597c2acc60ee8015e83db07f35617a31cee5fb960cc9d70d1a77c32a90dce2fba5
-
SSDEEP
768:+lm5mtYcG1VI5bWaEEqzuxuHazGL5UcGnmhV7V7+hQRb01MdDTIHJc+GUNrDVnl1:+lXUVV4rLtczDCE/aL
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 207006f8cdbcda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb8100000000020000000000106600000001000020000000691087568d9a64474022f1289323e0dfc5eac277110105ed28e3b447c1c95450000000000e8000000002000020000000e39654c24843b6485c9f95e2a64cfd34544bacf0761f26cb1cecdd67abe4dc2690000000a575556916be9bd338a1f008e3b4f278fff7e2bbc5c7121af5e7e7afa241c30ebd971d6f56fefbd506a0bd30665544fce8fabd145925fcf8bb5dca2cf9b8107141c9fb3b9a7799c9af71fb9c378bbe667347a367245b9fb081fa2f7b0a8c2515af26cce42b51ac4b4842949fafddfaafbf806a549f69975f0e0f74fcf781312c3393435b8e2f7fea88dadcad400474c840000000720a6949dca2a119de87efe267de830ef0722f070ca3465f790dddbafccc2d5cf0c154ad6def6658331cc69d43f92f544042c6b67577ea9190f4b9dfc325ca06 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424361411" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{22737D81-28C1-11EF-9586-DE271FC37611} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb81000000000200000000001066000000010000200000003a9262053adebe86cd3747838fafe5bcba13419cbeee1ca2496f9278a500e4a6000000000e80000000020000200000002088415c5d87b9b6b77687642d8eb8758dfbe9fec833dcafbddb1f1db7ef925a200000000d758ff15b5b9cd1505853c1c7344e2de71ee45a35ce4e619c86874b3c3507ce400000008e9df31c0564fff9276a949f257ac8a8e19fea5095c86b2de9f7939471109cb4c6ec45df59aa2dd548fe146551be114d2b004a361e9cdcd51befc43b3925c730 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1756 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1756 iexplore.exe 1756 iexplore.exe 2432 IEXPLORE.EXE 2432 IEXPLORE.EXE 2432 IEXPLORE.EXE 2432 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1756 wrote to memory of 2432 1756 iexplore.exe 28 PID 1756 wrote to memory of 2432 1756 iexplore.exe 28 PID 1756 wrote to memory of 2432 1756 iexplore.exe 28 PID 1756 wrote to memory of 2432 1756 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a0dadad654c86380b7734da4a363513f_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1756 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2432
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5faccef032bd508f10bc0684cd60fc91f
SHA18ae9194e1b8d23f4d9fc136fcf02a94d51c34b22
SHA256109db7a2bef7ac76075b1969bcf121714f40c173fbd0815d079afa6bb2b6c433
SHA512a02f030ac3596acc92f664f6efad4cc7efa383ebbcc0ce030ecfd0f4c412625cf34df77565d96d3901288c3625660351fac6c42c463a64a11a955612469004ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b21cb8e5f74c034c7228f64fa40131f9
SHA1cb7d7fe1d08c14a3b7ca50f33d8bfa5c1e053346
SHA256fed3dc6d8a6b1bf543fc1e2da3b20c8c91089d4ec167c91d691ff15b26c8e7ed
SHA5120abc50ee7689081722036a501af85a8d1b594ebe3d2e2b5b0c80e454b2348da339840e13965b354932766099109646727dff7a34705b19758068b9d20e74e151
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c717371a55c96ab6db34550dd2b1d703
SHA138e8e5ab6305ab899c1b88aad850fd028bb96a33
SHA2565c7b24a5726e22b4bbd7055b41d4ef200a402e56777186dec21ccf7bd87e4472
SHA512ed5d6607123b4a78a40e75b435b2d9d599838db8d6d1755723e38fd75bdfae5b4be1672e500db727a2b4373b984dcce30a05ce77d436538367b5ab91d1e6521a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bb0358b7e4e88d11fab8b88db2ece4ad
SHA16aff4325c4146f6412b7b4b8470605acdec14157
SHA256a0e9052b7fe8fdc2c9e5f04e3ad69bdeda0c8d9c2601264f414a6f51ac7201d9
SHA512a8c2e0556df2df438ab00359a503fff6a875a0ed62c70d0120d3593cbcce13d960c36c278c395391b62a47cd2aee9da5fb6be56957c084cf8d561f0b63278b44
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e351dbcb1f55700dfbb28d170bc512e6
SHA18516e26b6046eb79d172fe89a18130065558f3f0
SHA256a7b8b9e2958746a93eea92776a5b8e514f7877381848b7e1daa339e4aa654c66
SHA51296c6170e9f7305f26724701083c481ce48a4f9bf5f6538b4d5621a330a5f94e1619c0f3650e7913f0195c6de1133ec142d32bbaa651d9c06eff0de15051f61ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5751c432bc84ed95d6013cf0151a2846d
SHA17405009ee73cd43f42ecd676e7f61390473aa499
SHA256eb5abc11b498f4a94c006d97469d87573ee3bac8535f7f9311d73bc94a3a8871
SHA51277b5f6b71b3f0ba4274ec8aac0a4269497f8b294d25cfdb213dce88cbc8d2624f8703995587340be0036d43fc4ab24f86bb154e0b88e00c1ebac8b464db5a26f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55aa95aa0a4d4ed9c73a108607fc489eb
SHA1b307741e3edace6d17422ae8f2a12cd99202888b
SHA2562f73d3fab212e15e92bc09634d38edefc20e300bd143724e891bc153e03284bc
SHA51225e916dec0d47d7a2e82da6c211bcb3a49aea5bd2442e1326e06240da07ae3036aa20345ea310cf60d95cc47b603b8179dd20c32776f86578001dc70d7915794
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51a0ef1fb6810280da9ecf11072f00915
SHA12214b6284ada9100dd060a79371eff5812d1e341
SHA2562f54ab7906dcf67059dd6137ffa459e068ae7a9dc0e085b6125b26a8dc61517f
SHA512e8f9690bb3e9e6af9127e0f84bd92aa1f527a1856aaeca3292df62e6f4778abb78a22ccf06ac5a67113d35cb4f99da55c37bca98f444a883c783dd7f40fab91d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55f4ae9fbd4b3fedfea0245503ddea7f2
SHA1110c99a21c8cbafca4b761e9154582e6ffc168c3
SHA256d93be9aa64856a86c33d115a14d450f7306f5ead2ff3cc7311ebd34f4c9921ba
SHA5120c86763cdf5a74d7abc3fb483e294c0b9c3f684324ff4f3f3e147b0ebfccd82c7806033872f131104c552f374af7aa2a44f57903a2492721677873897baa1064
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52da2604ef4c58dc0c4c0b8710fc4e5cd
SHA18712fd00746e9f0f9592f3806edebaea84bf40f1
SHA256b72d686390375d97cadff2888e39f56890c246aabefe718f1366687f09f54140
SHA512aea92dafd324b2f25c72468bca0100c972aa9c15065be8d8929fdd704d72e136a6c1ae6124a6c7df8397d59bfd3fcb7de7651021bb3e802138a147df4801d233
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57cf5a09869f76b973d00ff95882f1032
SHA1196b957bef90c3b84f0d315d5229427c573c9c93
SHA256bc8efb485e5cfd9edfed26c8d1e0872032757ab9b18c866815fe6ff19474958a
SHA51282fe7dd1bce8027141a52c17c86ec97279736c3aad49473efd1aa027394a8c5335ea33f8662339efa3c6a6fcdf5624013ba887db6a452207dc382c913b1e59ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51ce36ff944c87d35414eb3172abdcde3
SHA13365c0f23ad644d6a8b89fd57e3e8947feac0b98
SHA25619e62bfad85834c5df57e57c0023f8a95ae33168cf0ed177b8ad01587fae1e3c
SHA512b55dd42ebe5cd89476c994ab4f453ab2a99d4c341d4287f7fbfb577c48e9bfbef33aed491d94615808e1c791f372c40a02ac2b7bff84a5e9f78770986a5940f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50c01b53d6d52b2c549ddd8e9b27d22dd
SHA12c200bdb8514d91d77ea95928448fb8118976845
SHA256c94672982dec9fe9c0e1c144fa8a4cd70ad64e6ec2d59f994bc501363c66c1dc
SHA512878c070552140f27b7f7c1835d68c42e497e2ca4afe0efe77b1235366cb27a6cdf6035a070a7208d5add41545330e1179307dff2056ec9a383ac27f4149f14b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55746179e8ce27af2b64933a1ecbd0be7
SHA184dca4eb900a9c364f9975d8f3312374836209c0
SHA25636dc80cb0425df977166872742d3754af2c8046db8fb62c04d3a94cf84938a8b
SHA5128a4b9f6b265273f3c525edf10e1abddc6982d2770bf2cbcaa2d19d8923b1f54ce48a009c947abcbe0e50ef89049d98df444c29a2c7562fe3566ad39005fa8508
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c210681a95acac9631e4d24b103a6510
SHA1b302ed7f3bdcbcb807afcf50ab01e8e008c01826
SHA2569960b48bbe4f030abe8235e2afcda1cf2f3c5eefa87dfee8d875147db92f162e
SHA512975afa11a4caabc1b0a114de1a8be0038fab288ccf419af08e5295c1cc8e2efe5dd46664ca1ed7f142b64a96ad6ef1a7d041ceea01c26af6e609624cea17ab64
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51b70edf5d16d5385a155b53ba43315db
SHA1bc7df52f79e2f1add627cdc1ce39121c3fee63b9
SHA2563373eacffbd158dc30b9d7898a8d88fcf3aa52c382bc557e055e73bd5b796d0d
SHA512145850a4437adfae619dd9162e8ec9be6f81c00a1a75a4a6fbd3a6f8b07a803cfa91610191392508acb0be9a577d9cfe57205121cb6e126f28dee1dd6a53509c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD559ad5acecd01383b30fc0095edbe93cb
SHA1c5e6b2b53472dd4519dc74fe21b43db74f4db27a
SHA256e70666345759e6e6cb280d5903e29f6e5f0fa7eb2af43b0a326917308b64fee9
SHA512a2a50d3bc2adaf0b695290cfd5d66e604bd1c9b938d7d81c52c83d7ba59b56f64292fe8ec6567736e18cfa009db1aed77a98d374a328e4e59c6feb2bd19a116d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dc7ffa03f02e584cccd6e26a34906a3c
SHA13582824f2d30b26c0aae9724b109671c51a3a184
SHA25657feabeac2fe447040ee417ab7bd14db69f00c7fe88bec278f4cf06eae9e8ecc
SHA51248ac3e881e803c6e8c563ebf1c5cdcd2cfc3de11419e32dbe4b2ffffa208e3a677f1808a6ae23afb354e98ee58aaedd7a5ac05ac2655116645f2c2295683731e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6F0O117Z\jquery[2].htm
Filesize781B
MD58fc54924e9d8b3f433c135f491d77c40
SHA1940beea2c9cf839d486599759a908454489cba64
SHA256d1b2431c19cc455b0e44ded0f21c88cbdb91e8ee3eb26cb099f103b5d73e44cc
SHA5124828c0e6fd57c164b30e1cbd1d17284a3112c0d9616f9e8d90004594927f6057f8abd6c01e4bc4b84d3da9c08eacac23f29b6f2e4846491701eb6d250f1a38be
-
Filesize
67KB
MD52d3dcf90f6c99f47e7593ea250c9e749
SHA151be82be4a272669983313565b4940d4b1385237
SHA2568714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4
SHA5129c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5
-
Filesize
160KB
MD57186ad693b8ad9444401bd9bcd2217c2
SHA15c28ca10a650f6026b0df4737078fa4197f3bac1
SHA2569a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed
SHA512135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b