Analysis
-
max time kernel
121s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
14/06/2024, 03:40
Static task
static1
Behavioral task
behavioral1
Sample
a7e297ed018c7acf6b7db89e912c20ac_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
a7e297ed018c7acf6b7db89e912c20ac_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
a7e297ed018c7acf6b7db89e912c20ac_JaffaCakes118.html
-
Size
460KB
-
MD5
a7e297ed018c7acf6b7db89e912c20ac
-
SHA1
ca7ccb3d2b1ff86efb7370c22d754209a92e41a4
-
SHA256
193a332ecd418fb5e56b6ceb857c0002dfc5cf06d98e6f05285b9806a6bcadab
-
SHA512
1f58dd2e05d19ac5f7bed2f8bf2629b2800dbfc6eab125ae5e67e97228c6fa7abbdb7c00dfd2b8b099b4b05641ca18a67c8fcbe1ae5858b35c5017395baef303
-
SSDEEP
6144:S7sMYod+X3oI+YxQIsMYod+X3oI+YYsMYod+X3oI+YLsMYod+X3oI+YQ:Q5d+X3H5d+X3Y5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a0390500000000020000000000106600000001000020000000d40be4db6d4653bfb1cd38703d6898da10006134e763b2074716f426f1561bf3000000000e800000000200002000000034634fcd2079f31ea4e06c263570a4e35c96d0ef1b2171ca522922e58d87b85e9000000035207eaad4a63679ca3ba4a44491bb23ce608c955f1c11a83e712074f6d68efd08377837a38af5db83c4a9962a0c1e45c93ce54c8a077d3febf2d8795778f65a065d8f282215f036c4ec00c5d36256ca3511493bc6eeedf1f01482f38f96f26248d588ec7b552d928a5365e2a6a35042794cd07a9434f9469abd21ee4dc675ad9a805b340f8cfd925b67c904629e102840000000d78e5096c36fa70875a1552d4a1096ba13d5a2767d5f9e061d84c9b9fbfca9179a77bc925b176c6b071f70efb6a46db495117128ae756622dcdf34e42a9ed0e8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a039050000000002000000000010660000000100002000000095dbee215382562e0533b660034edeb442e112394bfa4be1d056678f29babc82000000000e8000000002000020000000f62557bf76af4b99f0f69524ad82cfe9ee49a04918202b03a3667a66e53ef955200000004ad44a0b546b8a25fbdb15d812546dd4223496bdae6d4dd77b220a0107361df340000000882cb70e13318cad9649126c553cdb81f05a62a51a757d8e207e9f154dcc52a5a3e0276f55e9b8f78453133975b24703152f77dfc59da40930fbd1676180cd8e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DE3289A1-29FF-11EF-9520-E681C831DA43} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2004bab60cbeda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424498307" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2868 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2868 iexplore.exe 2868 iexplore.exe 2060 IEXPLORE.EXE 2060 IEXPLORE.EXE 2060 IEXPLORE.EXE 2060 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2868 wrote to memory of 2060 2868 iexplore.exe 28 PID 2868 wrote to memory of 2060 2868 iexplore.exe 28 PID 2868 wrote to memory of 2060 2868 iexplore.exe 28 PID 2868 wrote to memory of 2060 2868 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a7e297ed018c7acf6b7db89e912c20ac_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2868 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2060
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ff7c01281bb3e9ec9ceb3dd67bb167a2
SHA19b2c27738290eadf812f522f183776fb2b99d0ea
SHA2561c48b1b65a31062eeafbdb3aefbdab979bef0033d5cbd8f837ae1ba6760d1c1f
SHA51262e86ab68b0731f867fd46a1b18c8b19b3ca657e9595efd2704857dd14f4f1094d691ba61e45bba0d151ae9eff1aab38429084833663b7ca738bdf29090b79e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d67412659ca598c8b83718a8b0589bd8
SHA1cdfe3405824a92a04188a96c411a4ec9cf9d865f
SHA256a4afa3472585547f7c8b9169532da04266092da6a411cc8689478be43252be5d
SHA512c362042050975890570478bb4ce34f4c2b12ca575de50ca9ed0126e7038053130e9b26abf29467627c502867edc8c23e375ad516aceb39d3dbd4cb19ef9aa4fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b063765baeff0616b01b3e91127bb838
SHA1659a1629700d0519cdec7b56451fc1cdc4da9cfc
SHA256decc20831c56e1942015e789ac07798ec9a5c9a31d893a51635efef95f5ec97b
SHA51247b7d88204424531f071ac3d19ead3f72e6cc0d00e87eb46297eff5e7bd487986920040752961cb728b93fe083c612188e639d8fbe59cf599e2ee5aef6bff1d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51c73d325737789d8c320b051cfdbe625
SHA17661f98d781ee35d3d0b9b183a756aaf5c5f8633
SHA2560d3b5ad2f7e044c25832328419e2a8f74ff8f2833827dfdb2877288f6ec11c2c
SHA512e81b4f6555e01dae6bb53515d724e39fa03706257871358afd460b65bc416187b9d6dce0b406717c12c56a63ad552e7a863db767b6f6b78138a1e37c381fc3f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f35be5983ced030e2e970bdda49fac11
SHA10ee5784d1e4880b5a961ed8408f2a449868deef2
SHA256e9e3f7aadedb3c8c251ea0245e907d1cc6cdb1ffa4e9f9a525fc90ed1ab3b3da
SHA51282790fc832df68722aa12ed3750a500d4e60d8bbfe1dd79be886be83b4464d255fdbd2b5680a5915819a07c213d55adcb29bf6ed1a831207f8e26814882692ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58e346eb8850dd70c744ac7eef83ca8cf
SHA15639acfc5a6e6496bdc407bdc5783d2459cbc601
SHA25636fe5fd5068c9bc587a0301f81d045129312c5129c113398938d6f45d0501ea1
SHA512435cc64f75732026e9e29ae1a8a1018fbc76c2cac6c6bba779690fc4fb3eca2ce0da734fdb36d6a2a09d32f1e14e5393df76d376c646e471386e2ba5807c1698
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD522a9574ee891f62a6d7a8baf0e417a21
SHA1049f162678e10a85e9e776c2f5aad6f33f29c10b
SHA256449104b03fede8679a1d19cf006930a4b71a332b16b9f4138e07ae8ee8f45648
SHA5122645bc8c8338e5c663fe33cd96c6a7853d6cb2babdb43b3159e5d963f702acf8157dd718fba681ee7df5cf6ce2ff03bc3963a1a549c3a90f1c9353086bae08db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD509e470b2e48d72c4ba29be4ac720825e
SHA1e41834da229cef23a572ed460f318953ccf8ab04
SHA25680c1b55a70d59ffaac91cc379b6497e54646e35149767a410537ad2109bdf613
SHA512fbeec4193861e8439d94b5c77e660569b9dfa259278ab6942df2191852195cd3b494479f03ba6d8fadb56c8724c10a948fb61f8c6a7e2cf9c3d82375872e998d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a99e4982d593391a9606dcf1d6c74845
SHA1ac574b283f243872fe2b6798c85bb26f5e133871
SHA256d315629d2d47385ad952b0e1d48d0dc530949c85ff9084277a73b54c39b3cb7d
SHA512b4b4f9510a1fc46d2dbf4addac89cb83b68bbbe6e9d409242fe598abed514922595f4c69892a5faecff79061c1519c18f4b73f811bae947e1f67dab383f0fa3d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fdc777984dd90adcf10a71d961eb2881
SHA1f5587a705c81bf8a6668a5b256437624c5d37daf
SHA256fdd0260454efbc8251db531b230f99bee192c1ac930d2966fcc8c95f18dc26b4
SHA5124748f85d9fc1573a7c650967aaf0148fc6ae44c8ed4c243e3530aa091b19135a95d644ed579f8e9e70933e268922a351b194ff816d70a5d93509c00461f1018d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d177b74c0b72cb7af0fdf6ea522f48f7
SHA15f937db9e2f5435b9777f25e383682f9e813b4ba
SHA256b90495b70085553b0f43acac457a8acb51698da5ce7b06575d2824a79b84c9fb
SHA512a2cb8cbf457fbe1df11119df19176f47fb935a59c349c969f631113cdfc07561f467348d5cbc74be96f0f2f587948bf4971487131f350a30363825a4744e05b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55d8ca52e7581a877b02254093c80776e
SHA1dc62e9351484996b34f0461e813b008085d3f093
SHA2566c658b3bfff9601fa60c22bdadf6cbee950d88215a3e2a67b89f685aacde8eb1
SHA51220f7c6420c90473936ac6c51207b8ffa98261e5d231a4aec9d1fa79f119b3658baaa35ea5f1ab58b755c6a3e3855cff0650edc4d1ee633d3f8482e7a7fa38f4d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55362507a49f89abbcd3a7f952be3d30e
SHA149e87be23f94d77388d2a26d81a03bff37b96147
SHA256b75dd55a176d2ca97b3dd2c10e8c0e31550fc45806918306d54c1ba99179b7fb
SHA5128a4f5f1cbbbf0943b60c91ccef3f26a2c65ac8c9ab67f14dd6cdd8d557ea6055c72d9142e82a7c264dc43301764e1c6419dcb40ccff5cb638fd1f56d59cd7587
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ccb66df31b3927ea501057267bd9d6fd
SHA1893fbda5f39993a7b1cc06b322e577e98274dbf9
SHA256633a826b8a205ca3d2c2db082d5793712ffa4f382e1e8e794be9f6e603e0fb26
SHA512ae513d546675d937e0c1579b9a6b93470c447d1fdf0dccb8dff1569220d0de6ce81ea1e3f0bad0ca833564427bbb47edcb376a79eccf2e10b65e50d3a964ad48
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a3445efca470b9a934a7f472e9e6fbb0
SHA1dfa7d374865ef33eb74c320c949ca197b90cefb5
SHA2568b1566eacce9a58c4b660862f3f5f93320df17a6980eea60aac0c28881c90dd6
SHA51223c845b29ddb9e660892995578fa6984dcd160dfc71015ae1472f2eaedc7ddfe89d623a5be70b8bebee96dcf0c6639a200653d32bbac3c71d06cd8d33a03926d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD599a0dd0ace4822bdb59febf65258e0b7
SHA1f00d3578ca02a396bd6ea07070061d516015a768
SHA256d19e95cc0d11433ead3bc5f912a04f1c1460c9e720b91c155da7c7a916163d6a
SHA5124f09529a2ff15212acedfa366c35f116e1eb911205145f5fd0dbd9660a4adee331046451f927223341f78dc69f2fdee65c54e5836ad58661e1dcf308300a8f5e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e63205f2155443b5b54325e4c302a584
SHA1951c1ee6998484d8f96f296159c95debf81bd19c
SHA256b94a1d921eadb8dd40ed38c25dfec5c97fd794e27c76587e7cefceca76060289
SHA5129a0256e5363c36710548b756568fb28f27496f77ea4346f4e0a200bbb479497c52d0160ce3f25386f3227d41384ec4861ad841fdad40e30dde6b32b26140cb06
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d3168a270440a2a6b4aa63dff8e5df87
SHA13cef02c204c48140340ed5b09fca660118e2185b
SHA25683ad097b2871205048fcfc323ffbbc8f28e025748712d3b645d3336ec1b8dbb5
SHA512b729d4691394e87142983baf95f1a7990cd1b1a1fcd9043f73e25d6c95ff6634d2dec412ef7eca64d2775e4d6964bd928ace45b66ca6126e15a765977d71da01
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54ae334bdd45f092d4798a0a200810f48
SHA194a0fcf39ce40876477cc9d8f5bf1cbf2f4e0006
SHA256e3ad9cab760cc2e0e4d5603748339ab9906cf1cf723fd122789969e4788fe3a1
SHA512b6496896471c84425b9c08adc3b40af9d4a51601a644b04c9ff8c3f2a324473283a5a3ad4e4d841c2a8791568a9f10db4d44bd31d835299073c46916c8f0cf35
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b