Analysis
-
max time kernel
136s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
14/06/2024, 02:42
Static task
static1
Behavioral task
behavioral1
Sample
a7be35904ea27503a598aee0de38ec24_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
a7be35904ea27503a598aee0de38ec24_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
a7be35904ea27503a598aee0de38ec24_JaffaCakes118.html
-
Size
214KB
-
MD5
a7be35904ea27503a598aee0de38ec24
-
SHA1
717b90c5746067ebd3ea35eac267ccdd503af0d9
-
SHA256
1d392890ddc2d5d9ff73bafeebac4a5f566d0de95d657a3e07f70c5c0e33878b
-
SHA512
9d1dc6df24e153cd2d07745c1dd9523a5074f7009ba1fda32ea9158bb58a627f386ef0d890833845f96287aab3e3db9ef31ac1a8ac643aa437e340751a474f6e
-
SSDEEP
3072:5rhB9CyHxX7Be7iAvtLPbAwuBNKifXTJFE:9z9VxLY7iAVLTBQJlK
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e08f13c904beda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424494805" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a80760000000002000000000010660000000100002000000023db96398bf31bef8938766bb3271513aac5deba832fc7cb7b8c65a92b64d688000000000e800000000200002000000063136c75f9bac1dca31adbfb498f4a8d79ae0b7ed02b5d50f258cd634b87f9bc2000000077f99e71791e41ac317a9cdfa5804ff186c8eba2eb657858c436a9e611979f0940000000e532b2042c78832107040fb64b5ca81a1e0028da1b29c22d6426d90bf1f32c15f40ae4c7dd5b9b31dcb0ec31889dbc9717a34040fb711221cb7564d17184045e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000ba6c73996feccda942ffc57e8e57a46398b4c16f5312f3650cbf9f658ee6abb5000000000e8000000002000020000000a7edcd81657376cdd6c430f4e26fd5aa7192edf788aedba6f03c7d0ee87f415c90000000510a8f08a14671ee7121af3300da6724aee31ef7d93b886fd51a2dff0dbe59f7a3faebb21c79466664bdbde5130c216b36d1e78a085521af38516c42094ab47d74090b97548fc3c28084ea3e46a4d6dc5d0e1ab6e52039b72a43658e8c707d44f82dbb61b912c6de3c876ab1e94e3d40b2fbe48120ea1cbf74fef02f7ead0ebd4ec1a6d0c8d083897ea5288477b0986940000000b1224936dc654c61ced5139c4bfd1c7a47d619d474a4aa7303dc10431fc449458469c13779021e5646d2eee784566d42478af7f112679297743ee8ebb84ed1e2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B58D9B01-29F7-11EF-9A64-5214A1CF35EA} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2020 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2020 iexplore.exe 2020 iexplore.exe 2424 IEXPLORE.EXE 2424 IEXPLORE.EXE 2424 IEXPLORE.EXE 2424 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2020 wrote to memory of 2424 2020 iexplore.exe 28 PID 2020 wrote to memory of 2424 2020 iexplore.exe 28 PID 2020 wrote to memory of 2424 2020 iexplore.exe 28 PID 2020 wrote to memory of 2424 2020 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a7be35904ea27503a598aee0de38ec24_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2020 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2424
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51dbec1c51acee219c1c53a78ddda5645
SHA1185a4fa86920f4174819414f0abd73eb0191f8d6
SHA256aa03e3e4a449fbf5cad9ad0c3921d3b370ef3f221c5644b145725bf694ab41e3
SHA512ba6c4a82d2edec1e0af4a3f998260c9f24751a29a226db33319f362294679a7414f9d22e088c4b52ab11a345996e7d5679e8fabdfb964303d245f8a1de1182d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b6622948ca4b846cf2434e7f4ab1652a
SHA16ddcc76c57967a507e6e562726406c309a7e79ec
SHA2562645a0001375b8c1f489cb8373cc83971cf13c1934593188859381deafe4c084
SHA5120800dc59ad3ee5c2afe06de47971815108b367be6b0aa1428112b705ac26d5183524e40634016d4a69662dede57071e873583183ec9084321714311d32b63e1d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54770650c54d2f1ec372739c6c020f553
SHA147b90087438ac52ec05a08436a2d0cbcd103caf3
SHA2569931648ef6ba4114da089871396dbb2377121206cb001e3801a461d6702e2bea
SHA512fcfaf4219e8bdaf07e8b2a80767d7c0c26ab41cfcda30d2c08cb8bd4064ce3f4e2f36e30e915f1da47ce042a813c54678b83b617a7a2077ca4342546a0a5e351
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5458532bb092e15e019ba5e514d203465
SHA1de808d4a3be8f6e33ec9458cd65690ac975e8dd9
SHA256447c31a37fb40a327762b719b9de4d6100333681cb0254f2f4c33d5f988216a5
SHA51250bd81bd4b1dd7c98394bd289044a276ad9cbf50ef6836b4691d80588406c64c0eb56a3438bfcc5e83e8cc5159d87b4776d786579d03a4264ef2fcab6198c2e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a83302d1510c3cf194e07c8070d25e64
SHA1dc5cbfd23f45a392290399199fbf383cd9f0be63
SHA256e6eed5c877e9340924854ebb6c771536ffe4f15fe937b7e708d05cb544e56eef
SHA512512e729de3ae8dbddd1ab9d6bffa9be0e256c7e04e235cd301c56877ca912a0ce494d4be21a723f9d8e572ade872107dbcbd38bc3ffec81273bffac3baffa129
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58e9b562674d805d58a0fb4fc2735aadf
SHA1f16a1985f54df5eb75897f888e53485e2da6ec46
SHA256b3b44c3cac4382c885982bb3e5e3031add3e37bfd9ebc933c41ed70176c53172
SHA5127e9a8ad77b669c0cf2431edd5e77a45c01b5ec8aef029454b6ee9ebf628cf3859abbbcf4a814efdb2a783ab6b616149d6bdd55fe69e493bdbd95652f1ba9d698
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD533d3861808c655c88f989d13d4918977
SHA17afc01bdb4853295fea3299da3ec04bfa04f5af5
SHA256c65e0c289f75a04a266be86a22ac3c330d25c72aff99a8184c74f8ec928fbd5d
SHA51202011598a2674b8df20c510b9b795e87f994ccbef171e62e101437461ebb7d71106d4b9ac410cac83ef175abc363696a63d36c80ed5598a9251dc58088691ad3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b78a638e51aff68bc410a2fc86671f46
SHA1cef310d89fc1d7770555ab12b904344cef0c1379
SHA2563a367ac939e906edef40a5c6f4be6dd8f24b5f05a7c2abec4184e020e4de8781
SHA51299df5a218b7d23b6310d4b6e4de456766cc121778a75fa718d2a8d3bf0fa342bdfce0c86e0e06c8b14b57293e67bdf7c3d3b7fb40310eed12fa5d08c9210e334
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54128acf352efd53819a751ad249a35f3
SHA130db4e27d3d1704712608c9b59c28e07bad34bc4
SHA256fc1b23ce92fea9416578c21276d90aceafb49baa7574c10225d904d6a452706c
SHA512cf2c1b809cf6d97d96a63defdb4462c766ffb7b81b9198fa540eef836ec1ece777363c62599d1318cce9ce27a600a600f10c71a3640c46e908f2489ddc3f016c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD522390f51ddbe223379deeb44bfb2b01b
SHA1204b666478e38ba13a2f89b9af9a0ae6fdfc1db8
SHA256ea9a0e70cf531c8a03d62dae0654b6d65b9ab51794359e3e736e7db143ac0174
SHA512788e2cc8576cdfebfeae1b0294a95f010c3fa5060f971f6a23f6bca474ae32e56a1760233dabbc0aa0aecbcf1f4fc6137a5f50f40b7f63c29a99d7439277b6f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f9e5dc6fbf629f2726ee3c62cc9a9457
SHA1426d93e9c6d443852469cf2193a6732d6e727be1
SHA2564ef4dd531382988f9e9eb4d258b914f5f4f5d6b8846044736658d4b08528579e
SHA512cc1aafa8455a5da187841d33f0df50cfde897b4299a2439c918e63696c9b363c81b7bbb94e0de607fbe948d0f1db0ae9de98fdf2d906ae0cf4395fcd6a030cd9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54d97318f8c24617021641971db7d70b7
SHA11bae84aab0b2d6c79b1ca1f77e9189f87f36b9a5
SHA256a2294a16383fbc241c7cc2a1d92768c47df84d9d07b8dd4cefe4d5efd4ff1d75
SHA5122d8ed6b03e5486204d53bd71f9e6fd4d84c80da821fb2bc1e742404b59b808f50862f65821ce65bb53be7d90c4b17a3ebf4fa1bcb169703bf7e5b667b748a06b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a526e617f035109a0569b0504f077a90
SHA1c6f9b4d87611d0729bba693035f98ac6e1ee713d
SHA25695f1d45292db98f5ca3d6df2554b7be695960d1eba3ee6c73664ec337800c61c
SHA512b7f459d73ee8dcfd14f7860e6e94bb2f25a8270ebdcdf4c9e3fd3373543fa5e0d111cacbbe2780fbeed5f19a7db436332992e2a0a7202cd6fba6075e69cbd0ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d637237dcfaa979cfcdb7b74ad0bff14
SHA1e0d6bc8bc4e873e181dce079bf29fe966c63dce1
SHA25615c6005a7be85877dd8c7ef7c10c23e51966ee9818fdd5353053e7cde3ef694c
SHA512381867716288c715effdf16bf9edbbd9128c57978ee642fd938fc6442afb54725c35e103dac38103a56641b8d85ca65b4642f7c8147cde3df541989b0e823a7c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52161ae5d83bb6d9565a972631c6f9908
SHA1fd31185720e1a5883df29ca4ae4c1a808445774e
SHA256f6e2abdf3727f520d22175d5f1fe202a031d8cd85d259ff002b568cfa50a2c5f
SHA5123c84c71f7d5e48be63c8ebd58d2ba67a47b9f186641690779a2fb9987ef69ba8f6766604f8c559e4a925d849d81ec0589e40a98e32184247958a12572d93d64b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52830a8ba2879fc6aa18948780b36165e
SHA1b9bebaa593aa03e5be0957ff7e9711e6e678a992
SHA256334b9c20d1f06abe33e0d047d98703516ca0882949c9b89a40a18a91a468082b
SHA512e1c5cb5b3412879850564da0bc07b22e8fff1b0d068cb7885e2d59d8df75d7e406fac34ea432b0ae0ad668a4b961b0b0c788e576712db080992a1b880303a755
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a6ddaae64415c3101229fc4e8cad79cb
SHA1488c278bc518a087788105e3cc27cf50e980bff2
SHA256cd9e0d5843511f0269ef4acccce3157d89aa9f5a1a13fba153f2cd4289fc4e21
SHA512caac144e6ee215df875622bdaebe2c9aa0fa2a5be310f60ccef7f28dbfc49dbf79b26292f906916b1054b5209c79603b388ab80ad7593c2d86d1aba1e5bea27f
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b