Analysis
-
max time kernel
118s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
13-06-2024 01:01
Static task
static1
Behavioral task
behavioral1
Sample
a346a0cc5a977c2e4dbce61829da11e5_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
a346a0cc5a977c2e4dbce61829da11e5_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
a346a0cc5a977c2e4dbce61829da11e5_JaffaCakes118.html
-
Size
3KB
-
MD5
a346a0cc5a977c2e4dbce61829da11e5
-
SHA1
16b56c9f5c26ecae877342c67ae0119e3090539e
-
SHA256
c3c49a80de972d1d3c6b8ffa51042c2e22294e317de73a0549978149bfcdd5ba
-
SHA512
91f5bcca27a62fde19e86af73c768c37105d0db2c0d8fc978ea9015d03c6911ba4f73f6611be91f42c20ad477e0acdf4f13d632087d61dbecdf1bc0d39e0624b
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a80760000000002000000000010660000000100002000000018e73bced3dce2131b88f0a823e0cefbae6798752cdfe721083657d96445ffe3000000000e8000000002000020000000ebce372c96a00a7b23c147ddf0a90c71230db8c2982d062c05bbcd1707e4a042200000000b91f5c7b7b4f081e17341c51d120b0c787b0f2803bf07f429d453454d76c6ee40000000cd300cb9ee07eff779e953c4889c58ea853ff1f81a02bbfbf899e884c27ece2489d379d5787530a626ca499c10b45b5de0d21b439e4347d374809c90268351e1 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a80760000000002000000000010660000000100002000000024da4d96fe93ed296d79aa4b284063f11fc003942425dda8e8b17e22f6c36c4e000000000e80000000020000200000005e81efe11479db93e053c9b9e911443d49eef08d3dda538e12850914c6dd53e5900000006d88bf099ea3bae5231a660b71a945166aa9182bc9ced2c51aefc9126e1df5d77422caadfd092bbcd056ef7a73b64917b107f09c470fc7d9eb363ad44ccba99bcb20c3a073487c30e03ea15247201cc176867482aff96d7506fce57ffa4b3d0373dd7017b30062fd66b726a3125226f6923b12c2ab432ccb6bb7a0923f00f624222c92d72d967e24f48f867a57f5d9cf40000000cd90094d5896210c3c60e17579a773c4e75f8e83695d9d56406a5cb0f5ef9d40c544acca1df9d1aedd155be78db25798fb55f218127c2c416ddf8e66d4e9f19a iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20d8a6492dbdda01 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424402355" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{74160861-2920-11EF-AB87-5E4DB530A215} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2996 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2996 iexplore.exe 2996 iexplore.exe 3068 IEXPLORE.EXE 3068 IEXPLORE.EXE 3068 IEXPLORE.EXE 3068 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2996 wrote to memory of 3068 2996 iexplore.exe 28 PID 2996 wrote to memory of 3068 2996 iexplore.exe 28 PID 2996 wrote to memory of 3068 2996 iexplore.exe 28 PID 2996 wrote to memory of 3068 2996 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a346a0cc5a977c2e4dbce61829da11e5_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2996 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3068
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e27d20ce2d5b51b8d2aed19f8523984d
SHA10a239edbf3d075a9ba121d8681585dfb35b07def
SHA256271dbf328dbb64a990514ef1215c3d4e3d7fae0ba26c743eb097dd50d5ed1007
SHA512cb09028176ec80739cd96b60e8a053b21c83cde191f80e710988d51b10b0aa1624764d0c191d515f2623f34a147288825f7113273f55bb64ded0efaff23eea73
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5edb19873986b547e2ee15ee844d37f16
SHA109a814a85bb1418be800319ba3baa9cdbae60fc2
SHA256ec648289e22d432d66a741e8e99de44e9313506e953cdecbdd6d0d0472fcc82d
SHA51232885ea7bc0f6b934d4a298d72626bc60801afe03fac5cbf1d1350bfcc6fc3be8389d06ff98845d6f7654a4e467ae8327b811831ed41e3eb4b3818e7aaf84a08
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59fd3ed14074b9b5ea2c3c3a4c4826cf2
SHA1d243fcf873d705e85f496aaba71720852a5fd9a5
SHA2562a0d4ca6b8e4eb8c6a928e8082445106d202f4b28d9b4dcbbf8658e3be42fe5d
SHA512a3a293ebf4e51186608ceac7e28aa27febc567ca6aa267cd85362e69b0f30bd56c588a632a7a74c178cfec684862ab510f541ec2f9a29be2aadda2dc8f2125ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c601e7ae2c02e9c7a446ca4102989d77
SHA1313da487dcb991355ec8723c9d790d44f67f1cb5
SHA25695e63246bd2409bbff88dee192b153026e0947a8f2c69f94bcc0cdeeaa852fc9
SHA51218da8816f7ff4410b5fc3b531298576c1a0ed4fb08eeb393d02a8844515c156568bbeaf120894c4cb158ad9e53443f0d7dda6887133bde40d37fc9846219655b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD564db3d01b237de10d3470ae8be843d00
SHA1bd3c6877baed60c35f7d1d6ccc8241b80dde6bad
SHA256de807862c967b300e59730aa22db44dd9fa4a955dc2aae1b775f0ce0756355db
SHA51225c40e68bbd50d564c264f011eafb553f3fa74812402eae5c8c292479c5e09d6227bbddec551c5021c32227382a21d38680bc3f78fc07775dad863c93b171f54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5185666c8b52205cd8138b206f3a28131
SHA126ce9eeb7086367299f1292b2959617066b3024d
SHA256cc0a0b1ed5e5fc2847bbc401276f70030e6732305b15e9279b4cb2e13602e0c3
SHA5120369f47fd79071c72a7082efe21426ad677302b481355d0b3149a6018701c40c40663b7b9250ad44ecbe7ff2d8c9176161ecfdbd7a5d93270ba6aa26644f3235
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD526600df33f7be836afbb3d3903fdf2d5
SHA15f4adadb8cd5c838189c4117e52e48c8bc5ab07a
SHA25603fc2c2ba051ac67d94d972f45063dd8f1721ecd0819db96164312cf63400c4c
SHA512a1cd51ed1bcab822a703c11098f458dcbfdd2db692c73888ec84f580b9461a7fecfe428726f0b1546bd75c59f71be59c77383967f0671c2ad3fa4bbdb0dce468
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ec3baf2bb49fdfeecd75f967b1ba9a58
SHA10bd19598e725a08d6ce9de3174456c43b66c5f57
SHA2568aa2f665f08c0209e2ac569a9f19c647c9e3af0d24936fbff66e42d81a45befe
SHA51249e4bcf88f421490cfa7eee1906f2193fe50b969ef71d13d48594a6cf570172c337d37699fc1477f73a7e8a5caa5613c09ad81288390f4dcc5ec9db76befa74c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5503d8efd168e6365b319d5380869e308
SHA17b3cc8b4edf60d23809d4513b2d1eb31b9a2c526
SHA256c2c58b83c68f60f1a4968e5dc82bcd2f385de97d55120b532e9794b7d600ee40
SHA51214c88e6c271cdb80159b86e8e0802031440a45e0f7aa83678bf8dda47a3b25f4668650eedac8fa302a2a61d7027cd9b5e3a75cbabc2bb2e9bdd614d62c009b99
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fda55ddf41b6fe4e87bb94ed5012847c
SHA1aa7ee9b492eab5b39f685468b87bbe5938691a43
SHA256b19a836dc867dabfe330003ec07f39121dc42345d9529862884d851ca562a034
SHA51205f2f0fc9f12cab029d442b91e30126f8e302217a5c46e087d4e461fbe778c7662ca17885b8ea2cbc96086f82ac57b8907871804f06a97d2617d1e7547701cd2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fa6d5eeb2f41550af0b2d961e3d91292
SHA1169209f23e9eeedf3d11f21e18178eb113aca75a
SHA25686a657ab63edeab301fbd0185b919c26bb3c3c04bffff07f95cd0e24734c414f
SHA512e839d06da8d856c1c830f6a64b28b8c79136b0fe993ccaf9551e809151cc39ff7646a183c4b4a9f2f989071a2ba19dfdd5b4cc7a137d6883863fcdeb84d5ccae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD550bb9d11dfeebf6be780ebb2730f6072
SHA131e5d3a8e404c694fb0714e38c09f824105e1456
SHA256a9424a45eb32119dcb5e650f809b873702043d3fe9bb4f3d0cb4d0eb0b1c037c
SHA51299525582fda3436dcf64b884ddf725eab510aeafc3a498724bb9533da7acc145ede9aff610ff112a3c80a50e20c185f89e9751af9c5e2987d04aeb04fa3fb3f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fe1409988a37606df6781920c336c587
SHA1d12b79448e66e5a350bda4898bd14dc495a1f3a7
SHA2562b5da9530ba35a70833cca8d8759b4772ae3ce785f41da35bd0674452cf83ec7
SHA512a12fc8d2447a5590a35db09292b45e73f76823e94d80239c01e40985b687a73316b2f60e0a03e3101bac221c8621484a27b5ad19a3eaa48cde6b31d34317e764
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bd58faf81c86b6bafb68c553e7892add
SHA116e6748ce8f056b695162cdc75b00707d8f90fcb
SHA25600294a9b5d87b9ac8e5c2939b90427603188fbf6e441a1e6bfe87caa8af96a14
SHA512fdd629aae69fa12e5c6ea2c6ad558bea38304e98268383832d5a72fd77d184efe4c50af2ae67349709f86b3f12140ba6a37477d2eb3d3b59572f0d534afbabb9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55afef95183210b0bf43f81acb3562e09
SHA1f04941cb64a824d9e2b2efa0f0b755058aca0d46
SHA256398160f6a4a09828ad27c915463e5a2a3554da9f13bc55473e5b582e86c844c2
SHA5128f395e28f73a03987793a0d7a33b926914f5ee90f7b76c7032e58553a9fdc1298c292c884b821cc985d8ff28e62517acf1b31db74413431506661074cb7c8a20
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD523f34f1a46852fad20552a095ecc4ea5
SHA161ab96a86543a7d15acb817e17998d98400f3738
SHA256f72987ae8a33149394b2d02377e62df138670f329e3118be50ffa24fedf57495
SHA512b5e615a8e0b4991757bd9d72c894c3a2994d1ed3f26c533d9c1addbf623429d08b46533f403b64d5378fb5ce16969e31c882945a22ef9a86f2aeab148d76c933
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58d73b8a72bb51e755f76efe61381958d
SHA139e0544afcff68280640d1d9c12344735af88666
SHA25660323bea099b79c4dd67500717821fcb212692c09ace2da7d80e13241bbdf9c9
SHA51207affa09be6a5d6b5857ac581bc0e6eaebcb507447a7b1f1422f1868df3cc75ab343ed054dbaca71fad130d706a5db246115f51c0dc23240d19abad0174c6e55
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53445c4ffcb892fbe7954aba40fd6a5b6
SHA12ece088290954aa5320e7b30628f1448b280b8fe
SHA2562ed1c96cdeabffd3939a01245637e0bcdba45e972382686c5376027065c55923
SHA512df4e64e1bcaec4b350f57dea50bada38931329e52c4e8293aa9063b3bfe80b6abe6cc769547e52384131b86a22d428931622a956fd0b8fe999ae5896d9869046
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a75a338a0e71c509dcf754edaaff68fc
SHA13219de63d32a01a71bd35652dc79558f6f76e07b
SHA2567c2065ef0d8046f49a08b2f79c8b64c182ff0c05632554bcb3ce6ae00ca95707
SHA512842063f851073f22e0554e5d1b9a4e5a887b5de66b091dcccc70f37d89d4f15481bede5ac74bbd012e9fce8b8316d7b160175762674a1976cadd924c962c13e3
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b