Analysis
-
max time kernel
142s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
13/06/2024, 02:09
Static task
static1
Behavioral task
behavioral1
Sample
a37f59d29a07823af1471afebde00390_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
a37f59d29a07823af1471afebde00390_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
a37f59d29a07823af1471afebde00390_JaffaCakes118.html
-
Size
34KB
-
MD5
a37f59d29a07823af1471afebde00390
-
SHA1
6d640275ad3a6fd5bbdcc6260a1df9e8adfaa364
-
SHA256
3ae62420cf279ab539cd664523959b4999d3872151a5edef97133424a50837ee
-
SHA512
37c4460d001416a78c57d1e757cad4df04cc57a0d4f29fcfb9c700144dab31f4f62f30d9809bacb2029d256abea68c9253f229f8e4da99b2a0791f2b578e2a4c
-
SSDEEP
768:/7EpFwSXe6eDewe7eIeygjI1tCJC3CNChCICrC/CvCPJExBq0Z24HLx8lF9Fn:/wpFwSuDqtClpjIjEWmyP84yiJ4q0Z27
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{04B794C1-292A-11EF-AB87-5E4DB530A215} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000960e0f8f009d755a2a385779a73aa79d91bebfb36e1852f83d6b4fb8c57769ed000000000e800000000200002000000000d19864c46ce36aff2536863b34a6e0db57a7af278ec311ad4029d5a76ace852000000021df57e0e09b58889d1ac4132c0362f96a4f30a52896fe7d371b7081dbcf709f400000001f3193041961b4634acb5e199fb1c146dd0a21c61c386250ff97a91198d3833b3207216d6c76a9ee52d7fd5cf410da8ee135d1c16e84cd9000a291ff7a749ae6 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 502a41dd36bdda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a80760000000002000000000010660000000100002000000081ce338d025af430bd38c8319f0c5543280b31ae23596627babef10278092a1c000000000e8000000002000020000000b036a85d3b4b4806b176a17bcf7a2060411ceda36fddf196c8bffa3e83fd652e900000009f8a0723f2b3740bb2a7f01a9a7ad8424a0e14330f0611cb3557e063876cf32d3b44b9fdc79ef5f9f279fe108ea2444fa1a3c66af5c74f9ae81d6494ac004f01c588ba2dd29b5a2a76f5865f35a31a305a13d74df7053eba4a7969d1c51f47c9e8a477ddfd80f60e83b67dc49cb6cc683f9fc993d49747dfbd8bffbde3ba311fc61aa806c99e1c847ef7969f0e6cfddf400000003ccb06a27a036dbd8085ebd90edd331da8657850f1ab6d65a80d072a19b551b07322ec08a99bb989711ee1b08be59af05937e70dc1adbeec314d29dbfd329f91 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424406460" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2764 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2764 iexplore.exe 2764 iexplore.exe 2960 IEXPLORE.EXE 2960 IEXPLORE.EXE 2960 IEXPLORE.EXE 2960 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2764 wrote to memory of 2960 2764 iexplore.exe 28 PID 2764 wrote to memory of 2960 2764 iexplore.exe 28 PID 2764 wrote to memory of 2960 2764 iexplore.exe 28 PID 2764 wrote to memory of 2960 2764 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a37f59d29a07823af1471afebde00390_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2764 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2960
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51c5e7e11c629ae7d3205526f165250d4
SHA1f30ae8fedc5ab2a18fa305cb95639bff60e8ba99
SHA25609cad464d1f8179305e679c4a8bb650da192f7d698f8b6ee3081055462b1cf32
SHA512a658fb820c4a33dc9a447fda289af7f5845baa7d333fe9e40ed36e537b4918810a85d78849beefecaf99493fdb0d19c6c8326e08e1b8a63834b4152cb61de215
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5084f89867909bece835331096b82d9ac
SHA1575550c339eba7e19aa5b49b77ef70b0f615ed9b
SHA25646a61d87205b280d3f38756fe196d5f19d8545c48ef3ff7d7c8eeaf4745e6ed8
SHA51235212473cfdf2bca78100be46cefad801c62053c5451170f53a3be6cfe9e0478ed61246b5891d4df51c7a03f2f09cf33d78d4a580b95c4e1d2834467d245a8f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d2a536ff657be8ad213adba3177215dc
SHA101c052a108fdb804b05bf99a86c4ac1ff71ea8f2
SHA256b3297c8aa1b048831cd772174dfe294cb97e7c184dc3338d7aded2431e99d16e
SHA51260538c5e6e059bd76ad92807bafa35d1b8675f22eb842c800c0a16cb5e6afc83ca59f92289c842705f19330f57633e9c23b8d2144d9201bdbf7f608c6bbf48bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5df1932a57a548015dfbb99198bbfa7b3
SHA15932ab56b2eb5b3cf4eecadf1f5c1f954e8b280d
SHA256da31d084317fefd351bdea4cda111b717012fce33d3c43ce364a080eb97a8d03
SHA512e951248226b52837033be3c46d62bd97c4d2b74e45ba87b8d646f23483250084acbd04733d9fda6ce11dbe588c21424e318e612f20ee3fc16f2e332e8023a978
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aecda2f28a664067d6fb6ef679168038
SHA12db1e683c8b7f92f5709c28888b884e74aaea39b
SHA256d225644820661c13b9c65d8d7e981c1c39bede257cbd1f582e2be346d7ecc660
SHA51259f713dd38a3593d5083cec35299994ec82e0bc4b6d37a07d27a76197c876c5d0073cfddcd1762cb4692221d111ea4891afe66b9ab6d2be4ce16d0244a68fc23
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d595b7906a7512a3f6a98eea573792d4
SHA1ffe8a7633885fc2b489aaf61f7750ecaf7fbb033
SHA256ec5fd122503baba4f575d86705f1e4a11d4b5aed5dcc1733cbcc9d6ba08fb731
SHA5122febda53af2c21b9bf83d8e30608320e4d0c754e2becd72c392c7b3074ec9e9b8d5a3628fa8206e9b26a9b218206b1ace197224ab407e4bdbd2713393edaf648
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5082c300a2ec61dc8191dc6a81cc54da4
SHA163208cdc3b02faf3c9f329ed203385298a9e7de0
SHA2566084314696bc4dd683ee4fe08e5de42f3669b9464b342a5afcdfa09cc5661274
SHA51283abee8f0dff4e0f636811c29002320785bae7b5253b9622e244019c26d29eb6fc1a6ed0d617e7aff2da00af7a536bb029ffdf3349866ebc45129ce2ca6f3bed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c06e586214340a4aff7e61fe8c49a57f
SHA1bfd3663629d834da20e087e2b90980c9f9f3e71d
SHA2568ed2958b11f6730d189bc86e93322c014dc3be2d13fea2db4be2e05512cc51ff
SHA51267dae6f1cc1844f628171cabb367b63d7475c6cc821b1a40babe838705435449c15b1fc576a94bb2dce68bed8632759015ae65aba34c4a68caff0639e6c5ef30
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aa74c65cea51269ee11e21367059bb54
SHA1e4e329a6778a26aead91d45f58c506c716df356a
SHA2569ef444e0908ce9eb93c08db944de1ccc599f55a0fb570e05a526b9a96f2521b9
SHA5123af95b011e1076cdf96b2289647adbdfc84ba8ed42db4f742c49ff359c14703264a18802badecc9e3df0d9149ed58b507625e657776cff3613a8ea0520ea8b0b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ac9266855321df63f8b5fbc31694c0ef
SHA16c25957f336de689bf7fbcf19d6a1ccea094d416
SHA2563f111832888793dae29e7afa44670d22af5fc4e5466e747d308df4385bafd5d2
SHA51274608eaaed2feb780da0f6ac30b6841c1358544db828e819ca89a12b37239ac0ff186aa53c3584abee6619cb29fbc6ae61bf9ee5f7bacf8b7955d6dde45f4005
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b364870941e94b39475b3780d96df625
SHA188ea44c766f1df07f8e05028d5abd000256a5b3d
SHA2567c65873632beb0ae053ad02085e166e9b67594679ee1e2cda6a7cd170b44d28e
SHA51254eec290e630c3c0f8a3c3e5b563d1de1c3f86e126d98ee981555a5a916c3e2e7b83ba048ff6618375dd33bb70d6b64e50abd923239e4965acef9d4682b61c0f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f968171b3dcb883b85e60582c133b4b9
SHA1db062a7bb2d9ea4b8be30eeab2e875fff20aabd3
SHA2563b7180245d91949aa3e423df2cb1e10198ba9ff461ead2dc567dbc2bd6625730
SHA512ca4c3870416e1d245729f323c975f48a0355ddeed090534df2ea12033cc219764248ce1bc8bc5deac91c5256085a934cbefe06ca06ced185c9b67582aa5f9d72
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58b5cc57532ee3f325e1c6bdd5b44b988
SHA15c6b99d96b9bc312554bedf90a94ec818f799d7d
SHA256e409b6a8d053614490ba556b3f1d376d8813cc1144fcfff029b1649ed494a94b
SHA512343bd7a990a9969d8a76480c62fe3d022c0e04cafcefd4780e167ab5873676d2a2bd36f07db6c47a884b0cc5bbfd5d309d826feae3ed70d86555db5d2d001e2c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c8f6951fd6a5c1a981f937c1ac908fb1
SHA1c55463edd69915b1fc3d31ac4689f68eda35ad4e
SHA256f10031498e4e65d760c90a45a9497e5427b595555fed4978d10bd87d653d914c
SHA512c574a42685714da3655fc08ade822179c7714f30e82895c6c3cff4404be3c714b2459b2223abdec04230a99fb7d273f071dbbb591c2d6885dfcca9a185e9feb3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5221b4f233f8ae4faf4107b524d56ae76
SHA1f90a946607ec08e1b75a4e5597ad27b60d14689f
SHA256a171465a83457a5ebab0ad197aab44133263dcbd68ccede1054758b0951b3785
SHA512b7dcc1f46ce992c11a9b148f64c73d10cb5f0b9f6653ca2064a2ab6a601e1be926c3b86e5f8e52ba8feb9022862c72ed7d4331ae72bce680a985d4de975955bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD556afbab8ef81531a84c83c45706bde95
SHA177354d7d36d51f77b7364d99db5a784a306ce038
SHA256315599685632075854b153b38759c70760cc0784fb4762e93da232ab056f4065
SHA512a8d7735163a3e8e8a29e08249c4526d1e4fdc922f2621ab89c0f246c43316471d3a095571f8b49536869666a5ff4f5fd1f6b0d8ff5e4af1dad5004caf5dd6fc2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58e8b22d2a549dfdf464fff05abcc5455
SHA16a28e5205b6db979c2063f1fdb6dc8edf871cbcd
SHA2568400ac35f1a592c33c2951f5c955ee28f56a306ae08e8dc4c319ffcfc4840ffd
SHA5120aeff7f1d7e034906f62468087f9a6e8bad616a5336f378ae621c2b53012c76d22aad0ec5642ade6a74d0978db63be0f2cb8c6dc75876f4a2d61d84607ddab86
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54c8bb17d051ecab5dabfe401c94a14fd
SHA1a5215e8585464f30999b3d8a10f38da129368ce2
SHA2569a4c7ebab207c6e5beab062c39f52e55f79e02ce2e0871ebb5770b5556510fd1
SHA51249e6cf9ee809ade13ea767988ed307ecb109aa204b3c5574451fe0ca3310cd284ba19cba4eaa1476407c10d6d7568c0905cc24e6cc24929ae5cb9940fc936ca0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52c011df1e48e774dd8e4e694973c6586
SHA1db3803cc1b767fd58fe73239893fa3e89d43ab75
SHA2563c46bfa8448d0588b1cd81c68b42645485cb3aa70e6461a6281753fda246b2b2
SHA5124cf13a37182973fbb5e1159c237d2471c82596980f9ca743cf817ef44f0f4694032946f209f1f325198afe3121ff17e8c7598c9b1a5d5d5364910224f3ed0d4f
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b