Analysis
-
max time kernel
135s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
12-06-2024 15:47
Static task
static1
Behavioral task
behavioral1
Sample
a136612452a4d263629bcf515003f78d_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
a136612452a4d263629bcf515003f78d_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
a136612452a4d263629bcf515003f78d_JaffaCakes118.html
-
Size
6KB
-
MD5
a136612452a4d263629bcf515003f78d
-
SHA1
a756a1f9e622cd56ea77fa92a98212be330c10c5
-
SHA256
002612fcfb8674fee15915e90ff48f36afeb127fda4faf5a1fddb2c37eb33cfa
-
SHA512
28d99d441a19316008973cbf92077fdeec34c6ad4f2acfaa3eb4e597b352c8ae929658cdf087c2858ec3848f77b549a5a2f8fd49807f2fa06f3bba816ce058ac
-
SSDEEP
192:m9iqZOrjjUL4ogsc1Vgrc0ddZdRdhdudIdvdAdId3adXdCdVdGdLdmd6dndwdldt:KcUUWNy2
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20cc39f7dfbcda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{22619E01-28D3-11EF-8144-CE80800B5EC6} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000007dc34c7d70ecd24395e99fe8bcdf89b2f64837911c3e42ca538a129ae90e008b000000000e80000000020000200000006aefcac3abcc4621046cb2d1f284f42390aa7cda3d98983590f252889c8c950f20000000566fc90e2a80ed306441090c4527fd171af8fe2246877de27e1d8f6e9008968d40000000f50293e14dbca4f0cd0dc4c311847d7ede4788e38ee29019637c1d4fc813f84d99791ce36654402de0ab4fc9584a445f1c13ef6553e3bdaba7993fd7ca64965b iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424369144" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000008505e45bce31aa18d8341eb75f3a48b93d1c330e2c1cc7e1ab0b5c4003b54ec2000000000e800000000200002000000088b8f40e05aa3e66fdd05e06300eaf5c715cfecc5de7c9988da38cd2734b2a43900000000025b52980aecdf5014811d3876247e8c0dad9a666b6a87c34a479ed123ae2ed2ba7b6e4bf9dde6ee34de13a42f6cdd5d1926fdc6159a57801b5fcb41cdcd5e62f208c2553859e204a5e9da1209a935cca9dd2fb6a61d35286d740b569a9cb7a9bfecf8e3a0d1ea29317157748645272cd75fd344f5dcdf57c2cf7fb076bf794c02df388fb2a7aec3f5b95d4192ec3434000000077900d12de96db30395f21a05f0ccd723e8b34ded5837254d6ca2845c7fc34de16d7384b334b2e4f0582f154c47d1722104cf44d26210d138671071f6a9fe18d iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1252 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1252 iexplore.exe 1252 iexplore.exe 1420 IEXPLORE.EXE 1420 IEXPLORE.EXE 1420 IEXPLORE.EXE 1420 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1252 wrote to memory of 1420 1252 iexplore.exe 28 PID 1252 wrote to memory of 1420 1252 iexplore.exe 28 PID 1252 wrote to memory of 1420 1252 iexplore.exe 28 PID 1252 wrote to memory of 1420 1252 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a136612452a4d263629bcf515003f78d_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1252 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1420
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58b97bc2895fa104550c1b592fe86f9e1
SHA1e44aff00bf72d81f0578e91a9e9d3244550030c4
SHA2563dd312bef50034e35d73247fb9ebf5027e32c26f15c302172975eed7a6de3f06
SHA5124247fd85d688bbe309b22a97e344c3b2a53767f5f0e1bc4c544e2e6c984ae44a74f8dbe79c599140a7f41f8c5cdcb7b584e362d9eb3b5867636b0d766259a7b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50e392eea1863a0dab6b0e326feb51893
SHA16c4ca82dba31389a94ae39c59a9d574a3fa7f58c
SHA2561fe09214d4526c8f1e456b8522a1a99381b6d9e06993fbe27a664cada3a2a3a6
SHA51218249361186f0f30f2fadd064be950e16f5edc2a1fb6e98bab2e054cdccf9afd9a171269daa14fbba0e190ef2a5e1b2b1b33046b8e0d45889d9260f8877efc06
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57d6dade33ffaab51e29621a821283ec6
SHA1dc1ebdb3bf1256d9f82c679206f8bddceb3f11a3
SHA25621eada8e568798fce79ab77fc303edc7d99dfed65a309e6571e344ba36e31f07
SHA51211a88cf4574f8c21e810212bfd5ffc1320ef0605098e057d679d348cd7e379c1a45cc63061bccffe45958ec005f479ebf5c3f2033d7a249f280fbf3dbc983f4c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a2033a964167a354e78547fa29c28f4f
SHA10e056b1698b7489dfde75c2d947c7fac25bf8037
SHA25637b84eb65ae66c46e5a1da582d0805c2f0e0842327bbe3f2ecebcaf70ea4928e
SHA5123517c8bcd09ddf604a1f25c3c309ab70eb992d5c86f8daa058d757628d76e402bd6bba83b1390a52779a22476e71e4c280110d4b8d0a80e2f9ebd93dc82b44e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b9319360326ee9f9227f860118f77c86
SHA122cce31d5957cf1d4b37a96bcf465ac5410c55e3
SHA2565e3b5280800acd88875d6c681ba4dafbd53dc8401211a5bdfa91b94680c33d97
SHA512d2c207c31de1b87e5eda1758e8d70638e6061d6ffa8c746461bd7d2f1efbd373e25e1be8c38bba92dfd277416aaa66ad54aea01ba3859c84b39ab41b9b280e03
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57872bec4bdfe745a21529abe8fb01eae
SHA114633f9d6672e20b9ac5202303e7a91caa8fbae2
SHA2567591725efc28d265d29265f1a7d4792cf2956f534f9decf65c2d92e1cb6b214a
SHA512699f6f6a3c9b61f4ec47203252411edcfb3cd207c6e99f9f05b58ff71bb9a11cdf6d5ddc3064badf44d76d56f3d8e1009bea50124ed5515720e69d60fc05dc77
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD557cf4ba40ba956d0e5865170e34599db
SHA1bbeaa55d48974c7ca5573cb3dd91ae2e8be70bc7
SHA25688c67b48c36b7f9f88139b8afe967d8a39d6319df810149fbec30435cffaacd0
SHA5125b6aab3b0f9f1c5567147198ee612ae9a312eb2a75601d9cb48ef789f062dd029b2ddc5f98d0bda7f7de5aaa0ac0ea216abd565bb4fde49bde4313ef0f47cbcb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5307651417deb8d3f23fc33c7f836f3d0
SHA15ed2b877a3f2ae73338574e62b2c10ecd1955536
SHA256e09190902810e99c4a511c5a2029536b5230dc9790ed638275c76a9f921a63e4
SHA5121aaf37356610d25ef04b0924cd293663993147f6d6e978d0721291a77433797e9ed6098ec1b2413b298d8b8647569189b54414230fdb3dbda569f2865a34b1d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e8792125ea82b9ac160d9c500c2d1a2b
SHA1e0346c7b498eb6d29a778994dd0937f1a6187f97
SHA256aba39fb7e2a8baaada8fe037a7e9fcfa3fef3f7bb8a8bfbb48963240249de38e
SHA5128aa3aa1d1574c0117e27170a06413319c32d80e3d1677090c16b23d63c7297764b9be90531ef964b6ad29587807f95ed9756fe64e63fbcfa200568821e3ed1ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52ff3b4898cc96b6366eb225d2db32b30
SHA1f936f251caeea818659670e098e151be81736d40
SHA25638fd33abfb83b83a96b5bf36d51859e5995ab15ff83e6a44dcc359af56fa8054
SHA51212beec4f488d951c6b80551b4ff3473e1d379c9af36870c1a977e08f209baafece30eb14b56e1b809ba573f0cc426cc4ab694e8b8aa0e2d276a308930bc9447a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5be394f84931195574d9a66d7060cadf8
SHA1fff25df7c3a0efc85f3f1842d8809bf17e2b0db7
SHA256851567ae9088f983bb343adff55f40771d9954bf16f60c11421273aef45fc622
SHA5121b528ce22296916031cc1ffb28efcfc3ec333acda2ecbdeb725338e207affa9bb5afd752588c11f11ff69c464d5c0b7033baa8f3fa60f3dab96d367f6cbc963a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD545611195bbc309fa6decd9ab809443a9
SHA17323ce08d901d902a63f952912fcb69a9cfbf491
SHA2569a5e95512b72d3fb7509314ed8b9f5cfed181212611fcbfe6a232cb7862fc250
SHA512cf3fff6f3f57f838a6865374cccfa7b516e2800647242afc510e4c8a0d0c9b1b49d306c12e2531d45b9ee848b3639838efa0db7d28125d9feadcae6dc51fe38f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c705c8c873d9d4154971fca33130e091
SHA10ecfa7e888cef75092d55d9326d00c3fb6f41cdc
SHA2561a7b165eade775a4593fb1a2ab8759861a7c1b8b39fc47af94bae952891a7cca
SHA51218fc2bda248b152dac5cfd13683bb8485c6e9acbea2827d56d6e648852644d2be38a67672f1352edc3d0ce7597907f28375dbf42b1272496d4a6dfb90e6c8f29
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50005ca94f964a2e24a0ae190a4e38a75
SHA1549c9527b6c43886676b415a7bcae440f4abce0f
SHA256faa441ca905b198fc3c5ea4b5ff52348b6b3e470de499df85d46d4c9018af384
SHA5122efb2155b06653abb4bd6925a9771327204358d35d8e052e3aa83614eb5b10aa8ec04ffe5939cd8fae3788bf05fa741a4206d1a8bebbdb27524ca2055a27f1bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d5baf7cf1516c6a1c568eb062af2c493
SHA198de3a5e1ebf13446867aff6c397e9ad17f470c7
SHA256f1ed832a86acfac1484846a6bd386faf91bcb9e1b11d7dc090a68df63efbb6e5
SHA512a1ac6dac46c76b911adb49704d8ca427b71efa423fe08ecb9561ae906d8b31c86fe03e8d02ccabfbb8585247f9b2dcced13f65fb6b9428ffe9c87b381e546aaf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d97ab01dbc8283b33aade9684e9d79ac
SHA1dd82e50541296fd182b40f31cbe316ef06591d2e
SHA25669d6887a569bcc8de476386bce23e50b6f4cf86a0c4a707deec2c7c461a256c3
SHA512e15ebad43ceeb38b060d0e4a9674c6dd27d66e69d6926e2a8b68ba6a849a6978c72c832314a3b0d0f26ab78d61e86fe2a7be652cce8f3c653b4d319fe35ae989
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cf23350604b51275fc1dd36434aa8a82
SHA12d47e249332dcb6d04d68278a6275b94867af721
SHA256308c3ad8da07754518d467b597cf70e3f900613eac59afec37729dcc644a720a
SHA51224d5a5145f804ea0bf40852ccc9f0a7acebc7bfc546c9a0c0e75373f7582900cf8b5598734161ae99146659dc12d40f28598c179aa46f9d3b53f3887dc28e472
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c3fd694f5776ff2d99ad56b5b54f052d
SHA1b4f470c3ff1c62d0e102f076c0074d7f02dbd21a
SHA2563ff52bda8e7c40a684b63129c68579861c270e5020c4e0ee3ed8c7d70970f70c
SHA512abd6f4626d56e5de464ce4eff805b3cc276b67b18a81fc6349bc9ba72dd650ebeb0f1f1e4ebed387f7607f29cb0972b78d0392d44e17f9e1027879f413423df2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b0ec223ea25e8b3525c6219de390f426
SHA1ca7ee0f9c1f14154a8c79b40681978dd8f99913f
SHA256d2aac554431b55729facb5baaed868e7177e62a6c1a87b13290ca0c7cad67c4a
SHA512fb8645b47ae580aeae4673c91342680089d6390905bc63055c1352476e511f068ba386ce10a909022ed547803e5abb068de917b9458abf709291a36c7b8b746d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b