Analysis
-
max time kernel
121s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
14-06-2024 08:46
Static task
static1
Behavioral task
behavioral1
Sample
a8ccb61b078e26c5a2e74092231bc469_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
a8ccb61b078e26c5a2e74092231bc469_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
a8ccb61b078e26c5a2e74092231bc469_JaffaCakes118.html
-
Size
6KB
-
MD5
a8ccb61b078e26c5a2e74092231bc469
-
SHA1
dbc8a3f100d49eb1d27ca01aa17ef97dbd40fcb4
-
SHA256
683a471164dbe1bff99d08ff9fc12b1252e5dbb0680d62c634a685b6276789bb
-
SHA512
3db6181739f16a76c5e6ee455486df5fcf7993df4fb65b378fb499891c7eca5bb4e8e07185e3721f8a8a2446f4b333f3c8c50d7136773f2e1a990162452688c7
-
SSDEEP
96:UhM3sHfTBmjJssmK00Z2LwGiMFWhWJ7ZdwEs4wI5:UhM32QB00ZVGhFWotl
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000d6e799cb1bc1bfb876b1851ca20b707c378913265d5671751b5f53c9e399a993000000000e800000000200002000000056db6cf4784ffb6095d62806091492b64806c08ba1fadf2c030877651935919b900000001a926a41b54197792deb0e9ee8776eb1d54a33eb537b00ef660ed30c44492a9f477296df002a34f94bc57a64c1315319b0d1aa5879fedc2c94b8bca9d2bfa2b6ac73fef037e2d840219add7450ba035bd60a8d5355718c6bef629b9af7ef5abf4b3af04c38b783c7fda67a4d1aad6280164a6068cab5bb68cd1f311ddbb155bb7813fdcfd53fdd66fe2dee36444a13a14000000022cffbd58ddff28a9abcdd89bf59557056df4a0d1bbc2fd8e7216bd914629c4c6b2f5b4254a9b8b0a06c766e3b00241baed71a71bad0179dd9bb9281d882b5da iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{94B52FF1-2A2A-11EF-968C-FEBBC6272832} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000007a6c828b3b7d07f029baf3763cb7ead01e0a80cec67bb2f69877bfcf280c8b5e000000000e8000000002000020000000f7c3b6c9cdcc8152d9d61cdbd0a650abaa532590201215a882bef0cde676ccda200000008e7c3b07a284f0aa73dc2b62e11134910ffda19a086478671755ea3280a6236940000000f0403c9b6b0d121d8ec4f08fe12824dab17fddd61d29339b5334cb982736a48ef964e7bcb3e9886d2608ff52c40ddc8e309015ab9cad722f1dd3ebb2b420bd14 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20e0636a37beda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424516652" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1752 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1752 iexplore.exe 1752 iexplore.exe 2124 IEXPLORE.EXE 2124 IEXPLORE.EXE 2124 IEXPLORE.EXE 2124 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1752 wrote to memory of 2124 1752 iexplore.exe 28 PID 1752 wrote to memory of 2124 1752 iexplore.exe 28 PID 1752 wrote to memory of 2124 1752 iexplore.exe 28 PID 1752 wrote to memory of 2124 1752 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a8ccb61b078e26c5a2e74092231bc469_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1752 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2124
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5502b7da46119ac285183657d8165ae8c
SHA10651f7f65db8a3a103cb67e793eb2f09f887dc49
SHA2560d6d7dc2d64d27c93853280ff519bc83efa4197dd39f0dcd57dd3ab2d9241d66
SHA512b60fb19c2736ca4243ce6924839ef22d9f2794c168a12a7e1c1e6e2dcb131a1ab386f347ed1ea619d9cc5a0328a0d3089b832bb3438abface2f3f239571e58c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD545a725a8853394ec32ccb55c1abd1789
SHA1422b238c8261df781db0f166362052fc05700e92
SHA25695af41bbfff12ba6883a3814735909b703adebfe7ecd3cebf6e8f945b22ecf9f
SHA5121f1253033976dd93c4dae5b54bf46c4ea49ffac2a3803c1506b34d2e379aaaa7a4c7488af531ee9e69a17aeac4732fad4b4bb396cae44c552f01edd93cf47de2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD567e0a9aeb1b0edcc034e1f5b344d39a1
SHA1169fcf4a3ea16b3496450cf81f251ec6d7cab66a
SHA256fb3d5e882babdef4263171bf0084502032c3fbd6d9a40ae4c7c3fcfe7cece9f9
SHA512414bda16c9b22db92bea8d40d86c4cd6e7ed4b3eb6e61510ebec11d5fd53453af2a87e6eabe083bdd1301a266075da4e6ab2693d372d13732e3097c3da08b26d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD575417cbb51d430fa4c0d040369fa4bcc
SHA168cb7ecb9ae6343f7fb5e98876cba7484650bbdb
SHA2565f3e637aaad5cb7949f352e10b30641426b7aff22dee89bb6a1e9472d4a7edc8
SHA512a1aa650223896762e2dbf6a0db25e5b209434cd491bfbf9d475d1966a7d129f391d00feabb17792d51f68471d08cd69fa116a9965d424854d781253a731d43a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f48d27dbb78ae757d677a489ed410d22
SHA1c526b2a3a4a95a134735d8c6e29efa0c7eb415a7
SHA256dd537f45df2e5986fdc6144adc5b7930df2602628dfc6d49996f8a9274f7674f
SHA5123a53d8935b487cdf7973017a403f06a942d32fe4ac4c6779c3473b5c4666dc1e1d354ac600e8fd7698c9e668cc6914a77a7f36ebccf68b7be6f561bf6d6ff291
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dc70893b942e82f2def9b547aebb5192
SHA1a6dd1f8a812b3b569c5824dd781a5717b31fa380
SHA2560eeb9df48020f379c1c4cdd518f231038e54cab6b84d978d0dd3bc69d5974dcb
SHA512867cf971ab598f652e012ae1294e9422c524729fc2ef5fbdf9d244472a9e9a5d53bb6f79e6f947d69bee6a87eb31cb7bd81390ccde8048a759afa90c2ab8128e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e395d9b4eddceb522d742aec8e39f71d
SHA1e5eed68ecd3ecdc0094968c6a7841fb2696403df
SHA2560bba1876576587e04b6e8e49bf34eb45456803681b4579c6ba5ce71b52eaab5f
SHA512a4cb85918eba18ab159bbbc37e94e1a6e69393db781938a27574ee5d87dc1f36dfbaa2bf461e6b70f7c4aa1ab135e2e45eaccf55e328dc9b4544cb70a9fcf51e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a24871b61dc58640356e7bc170077478
SHA188b12d2d6296ec4b3aa2aa4ce98f6248fce4cfa6
SHA256d89c9b7372b7c306412ff21fa0ae7fbab7fd9a7b0efb7cb737cd10a3ba63370e
SHA5125fb9636e09ca9e28c3a48694882cfe1f863a34b1210defcb39d1f16e8ab83d5ee7c332b0f74972bdd0df1ec7da14bd924390127be34945f0b8a6305b189315ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c7f8d4917fbe5dd35f28aaf25e1708bc
SHA1e7e39356bb193478747f6d958e2ab31a9b733264
SHA25606180ad45c957e8d9699f99bb46f2d7d9f368b75d099f11f54ab5ccfb029cd96
SHA5124ff642db404aa3ca459c3ff2075a2922bd4cb399518bae73d60dfa7250f8982bac4be0b0e0392bbad49c14907f41fcd8e89ee2474c1773f55ec2ad25eb58aa43
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55e850865dc94ac4b1cf14531180c5a47
SHA121a79b7b24ddebf2e4ac6e5f421393957c716691
SHA256b8a15b3ceb942dbd2d5fb576a0af1f1d6d6562e89a85406075a7f82d97b3eb83
SHA51256b7c0d8877e48e104d89062b6988a7931b2bc4bad1e6b43c1fc60beb2cc33c8b1437c4dd0b9a732959e81b46f0eeaa219c29a8a2a2394816eb7d39a8a34681c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57cc7c7524924d6dc157d0f698ecf4393
SHA1f2851fa1ba46e0591a120d9191f2936a2000b308
SHA25659b0160a9483ccee60b1b05b2d15ac2dfbd385615c12dec3b244353f749aa742
SHA512fdeb033519d06246d907bd1e44b82f6d42cdc219ee8bd033741ca1c3a540181f41078a49e3b65392720674778446584394c9cb5bbcb2c67c88fb7736479979e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f1d353393c44cdde0931258e295d276a
SHA1fba76ea5a424f845de68ccb8746f95968952730e
SHA256f294c1842dabf3463f8c7966b5d744053a45333794b758b1a19e4fcca2a85442
SHA512d6605cbb10abc774cc07774beb7d5bec8ff43988850de6585068eecf8bb06d463c30e5f47d82baa063556c5adb8da70b44ebad3e54b5cce08229a947fec7552f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50af06cac88ee240278d7fb1f95684a79
SHA1bf8019e103ccb903fb35093ff084935b79add9ec
SHA256c65e4c38e5c0fe17e8b34dd8abd183183a463263f56f21b009198a9179953974
SHA512407360711f0d485894e7b5f4efd6e38f679fc97a6237715bfea9b3f404b3cd851de0c0f9319f24249df201340bd3bf6ceef44313c1e14bd3c2fe896136ff916c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b75f1889296f08ea5bbbaddbce4ca402
SHA17f06f0c52d28940c44f8a0e85ac58bd0c6e66e0f
SHA2564903eeeb4fde3d1be11e59e67bd44d193aad5fb294e734cb692f37e89e5b8168
SHA51219c37c7b799a64277e9a6d48853fda4ecdecc320e49dc2c0f28cf9dece83d377af0ae799a3c8e676474cd716391307820f5ed4e54842bd42eb07361fa9887d0f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e3cda7693b4a5fbe6733ef3f89df93d4
SHA1e9e331422a8c1a7ebac68e38872771f73e23d618
SHA256751e97cd9d97bf2736079d65b1077212cc4bfa3d70b9622c55be8eb7f6a48427
SHA5128657fa4d9a80be1bfd780c5616013f9d24578f98e701f2350f6515ef55c77cef4e51eb538663eb138c29a9b0b08f81dc9032beb7c3ccf5620266c497991a1ff6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ad5e7c3232b45fa2605b91ef755407b2
SHA1cd24f69de0a0ecc619d8d23fbc882b334b19a1f0
SHA256089f6a6febc7d8696621a6cea9b4f0cde2f25da3b3773bd47befc2002a93595c
SHA51209885903db709fea38afac5f29e0d920f8a2483de33470dee118e22724360d33fc9f58b50fc1223919cf0f187e9f6d5f0ba4dc1bcfa5def34c70358c6e955291
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57523072bb34f16091a061e2ababe6eee
SHA10104c3ef1d4796d55000e099c2853a242f0ad913
SHA256268593af759629b27666f646fbafea2a5313df1249473598ff8544adaf18af7e
SHA512c43a86be7a226b24966e431476e511837b64f4107e0a96ecef3c178a7398e3ec0aa9bf7a9cdeabb2585f666635b7bb651dd500eda3419e7d7263022e9aec75b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD544cb7f57caf4457cec912dd22831feb3
SHA14e5dbc3293f09dad1389256cb7a8d8ebc43b1dbd
SHA2560eada82165ca667b1c6c7f89b0f07a00258f5b68ed80a3ef15b6439f688698d5
SHA5129c012bafa736adceee01814f6ff32236702adedd270dc7fa63d9b6cb6f4151282d369bf2985de03b69d8f156d25064a5cd8db8ca68476666ed231d88d187459d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cb1431c7d7886c08d2c86124bae676a0
SHA11c681d8af24fcb5090c398d4bab4b57dc5ba247e
SHA256241247005f3c50952392e87e493aea1b285f790cdaba565a4a58661d1e10be7f
SHA512085c73287e068c5fe368f670480d50c2a9bac04ad3e8bb4b1e21a4eda3dfb85f297d96eae09a103d55bb1eabb6758334dc9f97834706b22e495d1d6c5b87e209
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b