Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
12-06-2024 17:48
Static task
static1
Behavioral task
behavioral1
Sample
a1961acefa91ce9150bdf9d8d64cd023_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
a1961acefa91ce9150bdf9d8d64cd023_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
a1961acefa91ce9150bdf9d8d64cd023_JaffaCakes118.html
-
Size
143KB
-
MD5
a1961acefa91ce9150bdf9d8d64cd023
-
SHA1
aafd831a9bf98f1bb4f31ebc70c4733393e63355
-
SHA256
1b24f450b8ac02218ebc0887735cd5a7e2a1f600b6564df5fde952c075eb8de6
-
SHA512
d816599832fbba1c53295e624b571867b50f762097c513214dc9728534e09d71c17fe69f3bcc58d2931bb64f07333a01b47dae4607fbe7b6965b257613466928
-
SSDEEP
1536:SyXejazWCM3oqYHXX77Oy3bkklXlOSxaLemorgXmIupuOMjnWXaVjqf7xIIuJ9vN:SHR/gx7dyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424376354" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EC8D8E91-28E3-11EF-8721-FEBBC6272832} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2560 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2560 iexplore.exe 2560 iexplore.exe 2004 IEXPLORE.EXE 2004 IEXPLORE.EXE 2004 IEXPLORE.EXE 2004 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2560 wrote to memory of 2004 2560 iexplore.exe 28 PID 2560 wrote to memory of 2004 2560 iexplore.exe 28 PID 2560 wrote to memory of 2004 2560 iexplore.exe 28 PID 2560 wrote to memory of 2004 2560 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a1961acefa91ce9150bdf9d8d64cd023_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2560 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2004
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b893a0a55e58b7e28d4497990aae8743
SHA12bcfcbd1dea831acee8490e1cf04e1131f01a25c
SHA256ff80956b33704568b999d5161d8f2bafb333b5cdc4f39067c98f84f959b052b6
SHA5126258ca08ec7b8c7d22f70ba01ae653c5cc4a1d8847a1194c0bd103908b35b52b00cf022b4c624ffe392cc7767d9d0438e6d96a79e3739f6775422061ca968b31
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5884124d85d0a7c8047c0f7ba2ac89dcd
SHA1aad806b7d00179aebe75dea2740a7e03dbaac0df
SHA256b0c54963018a6f19c46cc3df5adc73b96cb5b5e029e906f8279a0a7cd0bcf827
SHA512f73e49fb719c061149c2f30cce194c409885530c7509b043009b5ea81a9446bdce1aa8aec159be4d40131a21fe9a064f50dd421eaa374afe71b5ff8707a7f5de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD583a5a47778c53421feb68ee4765e1245
SHA131cc9389e5646d8608ea7a6792731e918dc042d7
SHA2564323cc230164c94e264602a6567e994590dc864cd9e1d7f95ce24bcd7efccf51
SHA5125555b7b9878f44b43b1ddb79ebf7deae131a908f0b4209447146c1df3e47512de9a4e843d34e31157104eb4915fa7371ab83cbb051580e7e754061b6cdfbb2e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e19e2068e4721dafcc1044ad9e31fb97
SHA13240f914933988a29b94a921944167da34af38bd
SHA2562652a86466a2c3db9c88d54eb0bf1a182e30bcffbb7269e83340ac623179363e
SHA512bfc10193e59e4fa278e524de9dbd3658e96a3f126cbcfcbb0d5b7122497415204221bf054b05b5786617be42b942455d8a65cef956c76a391b340537aedb31a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56d87a0300afd0a3079d89ee7d22f4000
SHA1a8508e67d08136b0d9021045029e073f34b99cee
SHA25631674219e7c12c6e9f604821322f7d3b1d4b6e778399e1bc3b9849b61b75d7bc
SHA512c64b8d3affd45cbbc18aeed60b150ec0fc84fc4c1df95d657039837a93d423ace778a8409ad2d18a14d65b6070a6951f8191f9c3d03117f3bcce776e1b0d9d7c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52247c01d8dd46a551f598ca5f8866667
SHA1be13ffc25009193b63d6daeae318d313b77e0da7
SHA25660b45b9cb3f3a7dc801aae7cfa28b8b98be8aca41b4c782c3df723331a9144de
SHA5126ae5af815395f0a338c73d511bc062ff8a95458da39316ed023a21eb1856c1a01a1841454635bc107b6655d0eb28d98e89c2f9c07aff0fc605776e6e1a28f654
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ae453ae124c2b1b13a492c39da3f7a34
SHA159bc7fded15dbf116b3605d63ed40ad0747576bc
SHA256fcef2ebfbd62872accfcea5ea3fd68da467f58b0aa1db1ca30f2b38311e93bbf
SHA512b3086dd28c55c74dc7d5a4ef9863b960100437e8dc302661907f3c8413533db101bd9c3f01004c4403d3f26431463576df02d072fba574785b8eed674848a4c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD507252689cca8dcf69881c6bcbee16cda
SHA1e37b7b544487ca3fd94b55888a15c8a6f44a7bf3
SHA256fc412ccb205f53f089ea4b1459468aab256de31bc821ca1634b8e112c635c122
SHA512bb3826c50273372c8ab16026307b74f8018486a0efe0ae21b2d1b3ed643405ab1ae5b33fe3e811ae0a33655cddf7b765f8890cf27bad63c24449f43bbdeb10c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD545f1ef7fec70188ff667520a80605560
SHA1011185ac2f943150f093e525cf48231bae15c468
SHA256e45bbb1b0f09cd951181f04c26e8a8bf01f8133dae58f9ceefa0d4de3c8e51d4
SHA5128510b5209c0081eb2999ea5405e3a8122e5ab14bdc28732cf6b9a14feb9af98d2e9f91661f13eb151f04e19ea6285b299928390b1f42b76d815d38cd49fe2b19
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59d81a4500821e97872d1363ca971d8aa
SHA169873ad3fa55b2fa4bb8086e7104c59b653ae4f4
SHA2566d95b9c99c63011cd9cf39e20e13adc311e6b0f350feda00c6a26661b33b70e3
SHA51256ba668b396a42bd93d53c43ebc2793b64013c83b511eed315d5859de0cd2370ef1508392000d02a76c8e93e879af93287e91dc09a96e38e0bd34b3da3a1d635
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD549c11cb81fbaf0a7b5328d1220a1c92c
SHA10db8ba1a3ec613626059b9b5b860f79ef8398849
SHA25635f62ebc98366dc9b1cb976e965cee85f42f203466520fbb02d87a7cbfa863f1
SHA5125b491b78f79a7c8fc93bcd0a487894959d0ab471fef94daf300393330057b35000326b3db4a1b4e4710a748dc1315c37a8ac1ae8e245d70b8e4e333e3bed3e97
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5af488592cb602a6c02ff3542f4eeb6d9
SHA1f6a483a32a841a7b7894f6a96bcd5d94eb6538f4
SHA2561c12c9f655812eaac4feea1ed17d720e0a27d7cde5e7cf0711069e0e63729f29
SHA512598b27040890552de3ec6b7aeb83eefb2b9575932eb15f6f18491ba09c9e20754b755efcacddd9abf5e0f9d2f5000a086f7ed785fc6344991b3e218f8ce21afa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56644a8e57bdde27d8211a47aac6bb6f3
SHA1fc432045b8deee77a6ac82005be490e68ec9e5fd
SHA256a6b0ce403055ede4d5487fc6c60f6607bd862f26a9ddd3da62083100fc3b47aa
SHA512e9c91284d6203de1b78e40239ebc65e2cc528fcb3e727cf1f2113c89d4f81862c879d49e4fd2a5b6fe833d27a07636952eceafcfffea56fdbd870d09bd8d896e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aae90f426a20802a7b92060ec692c452
SHA1438aeac4e0fa076ad0dcfbb5d7a10bb922f840af
SHA2567eaa67e1959b7c57bebabc67ddb51792d6d20000620509afee5ad1684ff8b6b1
SHA512b324afb693130e601aa3bfc963b6b6dec782352f7e5a7150574ae4e161c55f750d0772a5a31bcc9da0de7d2c2b3221298093b0728622dbf6a34ec66a207a7fda
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c589db7ef4287b6997fe0a08aa758d2f
SHA14002a1a7b10de99989da89a559c0663621344cb7
SHA25698964b6156488d91b59fbcba1ecb5fa47c900a195e636d1158fafcae3ad884a7
SHA512f213e7b6b207899a270f46e1c549419182561ca98c7695422bdbc11fa43f08cd1576c025fe6a540d94acd8e4850aef51c87d008e10410d6dc1a6ed9943ff12ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51e5b1b66e6b43019cf4170af2d52dac7
SHA1eee8ff12dff33e03a97705c55882324cfa2681b5
SHA256d34f2cd4b2e87d62b34d87d7e3cc41078f255338452080ea1da5adcdf876a4d7
SHA5123445ac182192ebf381c4f690f2ec0b6f22f40ad4c19d345a4a91c98e5e1b9a96f22a7822e4d4eb5c10947039d06c3dd0f3624ac16b2b87b5bf70ab86575164ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b0319f08752503d848541fbb59bdccb7
SHA198a1840ee980ca8448b03149bdc037c77baf5a4b
SHA2569124bc05653fb8035f3d8ea47541fa678677812d46210dc48acbadc37efe7dd9
SHA512d8e747fe3487908378e3ae089c8335ca8f1ee22ab560f8321b136a9b9d22bece1d3534f3a790e4a2cb4bbe4552cc50656ddd1826efc2a441c4e539632eeb4e60
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5851be77b64f14bcb4a22df8fa0566ce6
SHA12b640b7ff3ad65f86a2a5ed31ba2af6365577897
SHA256413afd94a7e3c3c2b0d0528505ca261a26bca6c8f3836248670b0b43c95c74ea
SHA5123609c3116b9840c26924e49117850f3ce3c212eec28faaf6af1c20b800d22d5bdb02189c338a765599433b07a528459d939f7bad3b3af1f9245a785e51dd0026
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51f6b236bea97aaf1389b147f599a53a3
SHA1526f3e290b5e1e05bff86d09773f0ce4515c684d
SHA256644c32c5b6925971f4e6382ba84d8a6e18c5f01633b6f28f4991e012e6236c7e
SHA512259d9b3307b059e2e66866e933a2c8d5fe4a58db26398a21b063ca11d34a0f4882563168d252cc99b78cf7c2e5b6b0b6402192c986e822c6a191e6534495d850
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e4ce2ffc27b588f0e308a9715ab67fc6
SHA16d962cf47fcd52481ed996f33eb8c316925b273f
SHA25658005fd98f95fde8d15a3c13ff14e9a55528aa88914d24f14bb801fb35a6750f
SHA512cf18ddd26f2eb6c3da2939f9dfc29de4d94a030bad60dd89b0a3a5bcaf7a808f187f4c24f3cbac96768a84dc4be921c7432a3b42b3a18a8ce14dde2a687a2421
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b58714b992972b4adb6ecc763bf3e1a0
SHA141107ceac34979dabe2adc55eb5602f7a2a1f269
SHA2561c52ac297af15b9ed5136e667c33684cc1b540cdab4fd04d77a207d43dfd45e3
SHA512d895a7b7253642de6afb9fb361edc02a09d1c054d5af8083400a5e9000e60d87b564747a916ba27431eb5cd72372210b914fcd623355132564c21d2330835cec
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b