Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
13-06-2024 21:31
Static task
static1
Behavioral task
behavioral1
Sample
a6a8c7c33689e7f01337821f722748ba_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
a6a8c7c33689e7f01337821f722748ba_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
a6a8c7c33689e7f01337821f722748ba_JaffaCakes118.html
-
Size
3KB
-
MD5
a6a8c7c33689e7f01337821f722748ba
-
SHA1
6801f54c730f1d3bac2f3ff2b131558abba444e8
-
SHA256
9c04656c5c6a89e7d49e912fd54b88999111260cee1b744e722f6d51c40956cf
-
SHA512
0876635fda0228c11a82199228da4505e2ffba9450847e822c7eed7e61a9cf43e039e88cccbc62a309780606f8cb5d020ce7772cb1a10adc6f4d28f5bd6127c9
Malware Config
Signatures
-
Processes:
IEXPLORE.EXEiexplore.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7081c92bd9bdda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a0390500000000020000000000106600000001000020000000f0058762ecc25e3a27882422be0d8e75d52ac84ee42f967daea08d088faa5645000000000e80000000020000200000009b0a8892462fb824b74504e8d73d99dc8852dc749336dee17257356e596fbd189000000050398a33c2d192724dc760a639d8a4ab579c9d1b6d842a8c8e8e753cc5a80be89998dfec59da08be854632023f657f0ebee6554371f87e1c9bfc962e7b53629bf56ae7fbbbdc8d64f631ae6c4f10989e230f27a1d9d104294905beb6114b73533d168e0fc632733b1abb9a6a80695d57782211eef7c636c6621b603c045ef040bf8071be7b9e57f76dd979c338d381b240000000cfc890de34fc7444d19a25438691f45e2e944684374c5b18bd2484ccfaa4babc2e833846da5147ff7d67146d50f6216c34a84b332cfa8419b92904b3c6a3ad94 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a0390500000000020000000000106600000001000020000000feb47befa8c25f3892cdd050b5f4d934c92466ae34cd0829592a9a584655b229000000000e8000000002000020000000fa5e83d3f4756e72f2e5c4f61f0f846ead9f7535b0a5e82bcf498d23f40cdefa20000000a32b0bcd56c63d5d9c425bbc82b278c11d4a21c8a7f2802c4c1ed4478274bc3b4000000003968237194e06f5e34dadf74a249a4c0cb9d2390f2156473a77ffa6715fe64a8431aa1a809263f2fa060b7c02751b83e64e934d5832924f61ae64b7f0a8c505 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424476176" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{57157551-29CC-11EF-A5CD-D671A15513D2} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2032 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2032 iexplore.exe 2032 iexplore.exe 2464 IEXPLORE.EXE 2464 IEXPLORE.EXE 2464 IEXPLORE.EXE 2464 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 2032 wrote to memory of 2464 2032 iexplore.exe IEXPLORE.EXE PID 2032 wrote to memory of 2464 2032 iexplore.exe IEXPLORE.EXE PID 2032 wrote to memory of 2464 2032 iexplore.exe IEXPLORE.EXE PID 2032 wrote to memory of 2464 2032 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a6a8c7c33689e7f01337821f722748ba_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2032 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2464
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cc3cd9f47d3f3ab1d14b3483fb277c96
SHA1fdd656da430d3a0781642186b3a71255c0e35953
SHA2561f3e85fccde12175aaeca430091175ef5a24f86f29c9da37f6e4189dfe9f2813
SHA512b420912a2cdc0972062f4fc7275cae2bcdf37e05e1440c9340bef2d7018b2b9baecdab452786f6ff6f9132aa75da4f780b63250c4c1dcd4b3fad29609d4389a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50a979b83569812c10a44f9b6bed8e2ef
SHA1c6b48366f8f47b07d9bd2362c5663d30bc820235
SHA256d6faead9c0277331663327eace788e172b9f23b56d8fa1cecdb3d6149604b4e8
SHA512e775215b0e35ae660852e68d1c618fefc340930af696b96daac7002b7af06aa3faad7b11d26458fa99ffb5d30f2c10727fa35b24e8fd36c55925807f35841aff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e4d5fbefdcab25be4c82fca8db4ec126
SHA1fdd99992b956cfda184db38983f2bb45a2d78553
SHA2565c05bacd81c157b520f8c6916f0d48c98c0133f9f6028c1894b51538ad719bad
SHA5128682547dca2b4c3d2c97094ecb4e4220eed8a5a4441930a63a4b973ebe780f5937e4c536669628e23def3ebef2b71ea9f9405628870efe03eedaebe1cc6d5735
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c36dc41b7181eba2292daa73c2cd7ce7
SHA16275f0216388610143ba3841804822375dda26bc
SHA25663b08ae18949edb270b301f073d00a6cc64747f40ef6c8ca858aa1754ff5c63f
SHA512d115eb8dc174493595eb81574ee8c29c72cbd355922db3357bdd2055711118c3cb1da83d41bfa7d93a22f9661a2ae84f767de048b4d13fd02bf2e0020ab8703c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5393635018c376ddefd392c2b4b7fca80
SHA11c03aad061ffa7f20b81ed8a59e5929d5d235179
SHA2560d2aa18b6786ebbc514028f1d824e4f2c5fac2aff9884355bad7ab160251b091
SHA512b2d123541189c0bb1baddaad17a2c46f8d2dfd3a4da7eacb54a9176d9a4b86a62103817500ec9b55350ef398c556137d565de9e747a5ecbcf6646262bd45c921
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5df8b2d144d0f7e27e2d04382475a8694
SHA1ec1cdc63e1c08ded4af2f05a993020f3869180b9
SHA2561c25273119f47f2cfd789f00210ae5c1120437fe47816c5f48ff942e9e385f13
SHA512f34e1eb9dbc430928b3272a9f5e2518f9840372dff776a65da57d2ee9ae63493662da2bd3fbc6f6d6ec9791c959c22f9bb565276024739ba44a59fb23d11114f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5083a5cb84e3e64d27071972cbdcd978c
SHA1935e3af8610e55149c5b57019556c315dd671c7b
SHA256dc5624e0e99218ecf6d6759a021eab8b9ef4350de74eb08d8633edf9da1aaf7b
SHA51297431988042fa0965f57f54aff091e1732fea2448e4229ff644c3b1f7293653a806ca7800a7193cd6ba925f43b75531638b139975a3e30551a61336b7f2752b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52db5de8bb16d9f4b0607b7cfc89d9695
SHA12b852338d438fdfa2f5f195a18934fc6da43bb7a
SHA25656f976be00c8b37389a8f9c8a42a5e29dce9d382f5b79b2f149b9460308ea26a
SHA5128dd6b59fcaf5f7701998833bb013274c7aeea4063beb0e16a26d885d842997dfe6450daa9a004226d1e5f7c982454714d38ffdf1d6aef014875bc0e87c1c0646
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58d5c8cc0ee44b7517761977a59c0c56b
SHA18d6e33fd1cfcd2795d6c292029eeb30997b64376
SHA256b2ce23c5c536398734b5bd962f1db75ead10626f922f5809bf43ccc4d51e5ed2
SHA512e475a6c8a6116cd8799fa049707b9df1dd3eb0ed8ed5ff30c680173ab51df0bcec354342d63f147940a1e66603ab0cc155834dd43642d53de0b698842cde982b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fdd88932945c0732be80f27c620d5e60
SHA1cf7bcc4c2908cce1cf9d87b20c93cfe25a4609de
SHA2566dc6d7916d4925a82506941785d8565cb632baf84e920b5c95f2e27d5db16b40
SHA51289fc2a8279e1c8eae6de217e0a3aff9675cac1cbfa88cbae420626d85007cbafc82d31b1b24b1508a635d862333ad6217baf2a9a427dd02926b8fd4ad50c2284
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59f8db21d935807d306a6648dbd96fc61
SHA1d4ea22fb64ce67234a80e888c9d3f643bd75dee4
SHA256539c3f6cdd5cbe760f658775689f72d4b1e79061ff19394c4af21ae97d5294b5
SHA5121ca20924660833bd99ebdcc07abdb47c8a25ba988304bddfe360fd2fe3af2501c56fb77b5ce86336f2996c03552c18abb77ef33945046ba61e72ad91094b9645
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD518be862f869cb3be272da8febb64e975
SHA13876033736201f007cec65022482e131fa1fa1e8
SHA256f9e89d81a0e2f3c5fd78a50ce9cd56a395477975cb40259d6a6b90de5813045b
SHA512bf4e29bca3dab55795ba98129113529c433b202a8ec05180d30fc38b6dfd28857cdefb6be5a663996f5a4c69cb7878fe68bbb35ec93682a074835bbc7cb8c7b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57cb5e1a69206336d49830cd27d6f5fc4
SHA1833e280330aa21ebeaba11e262d91dc9d64e5393
SHA2562cc549b33415d9077a44f699427a8a593880d82e80b2d4c3186503e6cf1d5546
SHA512d2467c21c2a53e5aac61b187a674d88e043813d774fa2d198392d319246ea1d8b574f99a97e730b6b56f51ccc9f1797207e0fdd58fda4ac28c83a3e9fb4fe527
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD542c0fd330d6066f7466d1e73db2d26a2
SHA12ec4f7e15e74d0aefa0d331942d7aa783c470e0a
SHA256611d29c28804643151456d2a681a12fd01b254244db9bd87acf78b203bb69227
SHA51211603a52c3876f1f33174a4c792de9a84b7efe43f769fcd165586d1885db973d37a02fb20f5602dc93caeecfbaab23ecae2df44c0dbb9b44b86694b370a0502c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5624fdaed007ae54db93d6b5e56ad0724
SHA118618e68d5b89794466fb3c696b45fc6323b90e6
SHA2569fde958e4eaeaa98a39c3ec40b71424ca5c4ed3925f85c1b5e0e8e3defbe2463
SHA51226a03b2c82c70f34ffaff3069abf0ebb8f56eff32ccb5093002f883464ffc5d98293269ebb0d3084220e7f072446f028de9582881de9557e50161bb19a2c397f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e1249937f8f1df5d4db092c6e19bd5a6
SHA1ae34d02928b4a30d057d5e78031a309786809f7b
SHA25695bcb9c13b38bbc5d945374b8dd03a168b37467a4d4260fa28367bee95115c7e
SHA5126fc3368d913a6b24669437adcf84d48dbad6504c9af6638353b417d02baf4f37536437f944bd2375d40d2ccecdb683743478fd3e2ad192d44fdb275b6926ac77
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e967648b051cc117b1789ff7b68f1e75
SHA185941cb824a9f815c2b7be40a9ff74f490533ac5
SHA256ec3f048b69e6db17dedab0d87638eb209950077e21e773566f1369a771c0d9d7
SHA512fbfe39902da42e6567b13b33626ccb232abd49d8d52bbe55df3d142c1df019544bafefc3a2a7cbe64c4f7f38c9ccf04360ff3597ce7a86cebd791e4b706809c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50f3189ef3e6b1703b183d84e2e17fa16
SHA10b818f30acddf45b326b5fb708f4a645dbaa9079
SHA256d3b5ceb9cd0fe0940a3a7641dbe93ed6540d83c9a320eb0c54f32e6cf10dcda1
SHA512bbc25d607f5dfe43de4ab091f3f360e870015371798e8b314ab781818c3eb4cda77edfc47aa857f88e4e0aa2e7314eeedecb1a19bed81f68be19cb828f4061be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53f81a3a94ede436e5160c191d0e69a65
SHA1b8c57b556ba51c33717a86cf4359d53a2df8fc78
SHA2564c7a289b23192102d479ec3a4e189c49749b9c4efeb4a92f7d4f68efce2648a7
SHA5125163cd958085bb94b0049f90fb9e30b34bc08013b027d5719eb48209ecabaa0a0be81543b28c236862d55faf5ae381a060bfde654a0a30c07c4e48443f0e28fe
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b