Analysis
-
max time kernel
118s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
12/06/2024, 20:06
Static task
static1
Behavioral task
behavioral1
Sample
a220a5b231ff82a14b0113e45d1389f5_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
a220a5b231ff82a14b0113e45d1389f5_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
a220a5b231ff82a14b0113e45d1389f5_JaffaCakes118.html
-
Size
460KB
-
MD5
a220a5b231ff82a14b0113e45d1389f5
-
SHA1
aeee253d56e3f6e5f87acecfd131d2cc11e829ed
-
SHA256
f200a013c5c2259f3d7e1efa8ff760bc71dd9961fcaf098df7bd805f932bac4d
-
SHA512
6d132023234011c34f4fadfa7cbc3840a4cee38f76cc5c7e33c1ed3d9361f8cadb9d107bef05854f8c5607e745663a9b3e91d538019f9ef92c0ebd0c4faf9fa8
-
SSDEEP
6144:SBsMYod+X3oI+YmQbsMYod+X3oI+YqsMYod+X3oI+YLsMYod+X3oI+YQ:y5d+X3D5d+X3q5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 000b9d0f04bdda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000afa279c3e2e869cb65db75296304e45b6bc2cd80a115bf2a431ee60cb77e182c000000000e8000000002000020000000e6b22f2d869031a5cde38e0a960bc4e66a024f1b83bc20b4eac42dc55a4e563590000000bc7f9814547d0517d016d12332ac52f96ad4b99fde44dccdee38af88742e43da5741237a347e703d093d4cf8da2a952f2e65dd2f35886f621d4774baabad2a66b1827cfad21edceeaf85c8b6d43aacfa65e8e3d936b721b132d39846c4d302b8b3828ef50f1157ec085d9c486a6b7f74dc3e5cfb6b754ce0873d1da431b73c2480a7d3f84a966338f181558e379f3314400000007e4458d125ec1b12d49398560148e90d9931d5d018526ea62266a1b206ec3d3be45296ac6c2abeb3fd64ebed14adb339437861f713f63960f829f0ac64c2ab16 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000849bcf7758353d3e2ec3229c056d23898bc84cc3a63f928dab748c9700e2385f000000000e8000000002000020000000cbd9d00e66ed4bf944e1a6b0614bc0e2bf1ad15ceac653f169ef29923b7b01c620000000af0919b1358731e0175db1c910a6657fa613772bfe1de23a82b5fcf0a4391be340000000d5035f3de9d2a8dc5d6f0d5db971ab7c26f0c6469fffc5df01aa664f781c0d7b392af4299b795c292899a53acf67d5906d4a8f91afc2bc2b6066b851d337155c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{36D4A751-28F7-11EF-AC4C-424EC277AA72} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424384640" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2852 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2852 iexplore.exe 2852 iexplore.exe 3036 IEXPLORE.EXE 3036 IEXPLORE.EXE 3036 IEXPLORE.EXE 3036 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2852 wrote to memory of 3036 2852 iexplore.exe 28 PID 2852 wrote to memory of 3036 2852 iexplore.exe 28 PID 2852 wrote to memory of 3036 2852 iexplore.exe 28 PID 2852 wrote to memory of 3036 2852 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a220a5b231ff82a14b0113e45d1389f5_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2852 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3036
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dd8a3f8c81221b508e21ddc329fe9bf9
SHA16cda26899e93e03566a5884102a0e04524f5a21d
SHA256fceef4893bccdf952ccae9800b77343b191049c9c17c07e33258e267abce4eb6
SHA512e0ed90ec97c9f4882b7a7c5438648c855d10301cccd61f26758a8c3fa63e13dc63e906de9934012428ae5b9bc70066f9b067baa03a68ce8c5a17b53fd12aa729
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fe99af0064da309c3e97e749da93893b
SHA1d59aa82b7719bc7a9dcc6053f82b613b72c31f19
SHA256f1501c2575168d034ea0e157797de40252644a2c6e0b36762c076cdf220b8430
SHA512fb75924efe1b90223bde915d914694cdaf8d45f268ac022d4a086eb16d92b2f2f8fb14da7094eec6ac5fb99b41fe013a6602ddb43e7d78f6bd34dab5dce6dc45
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a03c33f136e23f0afca3a4bff350a707
SHA10f0e40ae79f16fb62e7b4652d6cc1f79317e657f
SHA2566c843ad8d03eb3ca1eb679b0da69a7b05f4d4076da1b1b656ebaec124873ecc9
SHA512fbeb9ed0000e43225eeb951ab58cf42c6130b455dac2ca95003aa9526428bcb1c64843ba6c6ec239614919cd6fcec4a70d213918318ccbd5ce645e832ec95aae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5adb54bf764f540880da5fd6be3b09a68
SHA13e328b54edef386382124d7bb785d89f1426c6ed
SHA256a5239a1b454144a57b337a1a9d13d1fb7782ae50607c525f28c6125245ec4a7c
SHA51285c99cb02aab2f80be005568ca79694bbd4250464c6da88dce80e88d4273ebc10281143044703a0e30764c2300161541a161be67f2a5f1cc4810bfa089a4617e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50bf589b2ac249ecc58618b24d2a1bdbf
SHA1682f3cf755cc53f03e982c999e76f18131400d13
SHA2560c4214b8efeb441d81fd3f118f41775d71a293825d1b5c122adba626c09213d8
SHA512850da2df2040357b9e22da11cb5bebf681d5bd118e48aac1547ab3f741d6133264d59ac9a455041d76dc0fef7744ea0ba0f6dde368d5a91c6eb77a332ceff5fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD553de734737e554493983520eefd32341
SHA14fe9dee4380ab145ceda72ea0433e35f1b3d4576
SHA256a133651ee5be5561de74e2cf4b9428a908dd20335097f989736341dc973c049b
SHA5120e1ca6173c3e733c2e9688cb58d0418f594779ddba29eba25486407d7dd4f944571356bfbb77cb289204f3d762de6186afe724107e3a31ff0ae1979d29d24984
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD544a27f63d27ee70d410707494e7f8b01
SHA125fb2bc8d8d5dcc5611467ec2ad98d3348167818
SHA25689e571c0a8c3d0d514d6715a8f3273eca7c165cc315b474e5c7e8c8720e0ffc4
SHA5127c1765dd81b3f4c5c00b076d168403019bc59709f16db6db21e20dc558b38f3d0ae49e920d62fe3d42406d7e2b730e2d41ab79828df5b176c0decd8fcc097753
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52f4143d34f5b8acd214c881aebf63ce1
SHA1f78fcaeca12a30e13ac068b14c6ea58868962c48
SHA256633b56af1cc30f56753ffc6c386eec16142013db82ed0b478ffc6bef9280cfbd
SHA5129f20fe9bee8118b90162ba69f543fdbd8b3c8b8f8d61d3941a844ca394141bbf5370c1e8d47393466c4c7311b52108df4357266006936400e42ece0dc640ac72
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5122bfb3b53bf428c5fa804a2aae9f03a
SHA184657924b5aa838cb406d3c9c92fc9a1f085b7fc
SHA2565e1244e68d5dbcc5bd872fc75f70b03390c7e4b07e2443f86fd7f52081f4c0cd
SHA512d2cec1cae33a09d4a8f5e72ca4eb11c0a4cd9eb54d24132b7add4f9a06a498c8bcdea1019f8b4226ec6fe72f419a7deaf01ba62ec1e9eb32ee08652a502b4732
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD506fea78b87704d99fcdf726744c40739
SHA19435c1c81d8e3bb698145ab545255573b855337b
SHA256d1f5515c122eea3480edfe684a87c11716ddbb4fb8a16feb08689520ac5f6fe9
SHA512610793e0e20d7cb882a70de036d6d980f42f85219398c9791a88a94e22e0e9ec263154cbcfa50d1e76c1b6db642f4b54fc1121aaa9dcbb2bc2209d07c7a016fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cacfb9588ffc50c215b2e386c1b7cdc7
SHA1288e4dcfc23dec30706fd814e4cf045572f2ee5a
SHA2560fb536d03c536b33d3dcab7d94419078f5bd3d2f2c49d2ebbeba622c23f93e0a
SHA512398a30fe1e61e3db1d7b98b30fc1de12866bf2b0ed41805d42247179a5c8f83a9c0d2bf6cfed5831aadb6402db6b66a44d2decea93796036297078a1bd8d76af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57197f54ee458ad6242da7aa179a7c0fd
SHA1e75fb12770772fefac08f82d2973a056f9d47539
SHA2562a8e23cfe690be88c27a5428e040f25b12bc1400771f14bd2f1c22a0ff0da0c3
SHA51200025ab7c31011d5eb162eeb367c8a9ef45a186988c169faeac2fc822b14a5fd58e689047e19eb1691e8157cd6a6c16b75d2f9133b3f65f04d0a56cda4e255c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD530259458d74fa492305853e611cc3881
SHA1697cb164237a514fcac9e96d0412178fe2508c09
SHA2564e752fcd02f35b8d75fe0d240fad3be62e8e6d1c988a6cd22068aecc0ef6f82b
SHA5122215a3a8c98538da9963f2a37826dd69d5f39947b785d73a4bec604e13b65c53ef671291e5a956029fb046c126c2f992c9296949c3a899df47edeff3bc1175b1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56efd0f6e11f8728ba9277474a14ae75a
SHA1f61828a90d78c0146689717a6adb373b4e63a9d3
SHA25695ddf5c7e03fc911c4198e13d011e8a3f79af452f2e49e03615b7d449be2649f
SHA512b0dd7f5b8eac28fc84356cf412f6835e35abe8f1e9af1b9b28bf9f0e648326edd75fc1975363dc8d240214970a1c59ec34dfa90fd01af2abbbf6fdc799f327b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD500c5fab1dbefa163140c0b0b4d30ea6f
SHA113d219b60635c6e98d10ac43afe5a9cc33ce54df
SHA256db3ba0731570e8cab9ee069cde3533c4800e1aa7969107e20899855292f94037
SHA512fa3402c8ef8fde62f73a74cca48930ebd3791e402b1c84cacec7d95a37a34a1e2c66e7ae75a555dfa0a1f615eb3cb6354f955eacd3fce4479bb0ce5f8a61e087
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54829443deaba1bf0f204549ee2a69560
SHA1100272a97ee749d265b2594359b51e4a375decc1
SHA256c7d7d5f314454ccd67cdf8030adc425be5becb933ed1047025b3641831dfb9d8
SHA512b7b9d8508fd075706c5234a59cf07edcd5960863495f65cf20e5cc521b3bd46b4a11538bff4df10b3fad77ee67aad0c1331ffa2f8f471839568d159bca0b0e56
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55c82b5a95584f59de0150e784e6ec34f
SHA12478ef3e3796c714ab41932ce189f58c8d57e9f6
SHA256cf0513c385045218e9eb27d3e1601d0e9e85a073655eb08896eb4590100c15e0
SHA512ef61b54b32a0ab0d4f64832d62357f8720099cc04303214931f6767fb19049e389143c521dd2b56c35009805371a5b9d000538d3449832e730d074cbd64fcc79
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f8ae74ad6a692c45a07ef20e80a7494d
SHA1cbd2534e9e0442e941235fe5855f6d77f12c3210
SHA2560c76eedb5fcfc2389e4c23602a18aa1e5b2adbb1956f55694b8423e6ff8a414d
SHA51275564d14db5043d02ca4d585ddd1712e7cee01b1d8a9df4884cfa24b22165e75dfa2b41d01424a42b224f41a92922c0841b4d229b360c4aafe82d85d35ebf031
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58740e3600493761e9d8ec027742f21c5
SHA1b200f9d11fdf6deb40d8b2ae2a824a579f43a3c8
SHA256dafbbb0f2de280101230bd648d0de09ebfc134b9496fec6b03f8d5bf98d759ed
SHA512f6aac28d4e67228f86f4f89743b0f70e4e48e3c604b62e41798d347024a1b9652bea62cad17053d25d8fd41df4a12d3dabb11e1913203cbb8ab5def923eab289
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b