Analysis
-
max time kernel
134s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
14/06/2024, 13:07
Static task
static1
Behavioral task
behavioral1
Sample
a9d48e7a051a8d43dea6efbe6bfa68ac_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
a9d48e7a051a8d43dea6efbe6bfa68ac_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
a9d48e7a051a8d43dea6efbe6bfa68ac_JaffaCakes118.html
-
Size
51KB
-
MD5
a9d48e7a051a8d43dea6efbe6bfa68ac
-
SHA1
a315461c0d93b302a2bae43f8fb6a1ce6fd55348
-
SHA256
96f2517ba53328fbf0106610f423fce7ce76d7841e4ff8d03fa0eead64a34e39
-
SHA512
2c06b1e7ececd47225b07d14481937a8769e3f291a3c563aae29671627fe367b4c8d4a00ce0d03a90032988100311c06039b602537188d86cd90f32012be66a1
-
SSDEEP
768:SlYR49z3ZNh7YsxuaFvG/Es7nmu4eyTP9BzTJwLY6uwjg:Sll9bfisxu8kmu4eSPfiM6uwjg
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a03905000000000200000000001066000000010000200000000dd3d78c3c81253c4d991b32efc05fedef8f3b6cc5d1e890b0c7570768bd4e7c000000000e8000000002000020000000fc1888cab6bef6afafe92152af43b2684dcf2d46d89db1976da9af877854a5ca200000002483c8228279c1329edf4a6801b15145dad24bb5cef893edb9da1206b78011d140000000c4a599013ab4eb9a19d9b5ad9bf71df73a076f9e9147e6f2d74b9b221e862dba79a68bc0e17902bf544eff337869c39465ed155ce89e9d3ba9da89e38825da49 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{09037051-2A4F-11EF-BDE5-DEDD52EED8E0} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7009cecb5bbeda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424532309" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a0390500000000020000000000106600000001000020000000ddb7ef01a97e7751c54435658564d4095ca4a27ec078ddba976d8866fa12c8a4000000000e800000000200002000000043d9d67032f0f22351fbc809770c27cd1269f8539580e4a0a3f4226fbe373f39900000001a67150e032252cb48e3551416c2f976feb84a9d63630485e9c97267d774bed827a73c3558c9fd5796b81a9502ab53934b83b8b135c2750997b1a77483444dac487afb26a2ac40a38883bff3b377cb84ef2b3f117e865c9def699a3ba7ee4e6b8463476c61812556d619ea8de7f4f999c5a94c44460c1d387a67798f5cfa83c1524f1610d9fcc9313095f97324b35a5c40000000c02cb63e35952893123b629e782cc1369fa6704d58cb94f2f59bd0e39931ed004eb2d1ee2349492998597ac7ec848418f1c15e6f814922a9ba59a33fb7288f40 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2296 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2296 iexplore.exe 2296 iexplore.exe 2152 IEXPLORE.EXE 2152 IEXPLORE.EXE 2152 IEXPLORE.EXE 2152 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2296 wrote to memory of 2152 2296 iexplore.exe 28 PID 2296 wrote to memory of 2152 2296 iexplore.exe 28 PID 2296 wrote to memory of 2152 2296 iexplore.exe 28 PID 2296 wrote to memory of 2152 2296 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a9d48e7a051a8d43dea6efbe6bfa68ac_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2296 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2152
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a787e92ba9a3b69f3d0c04704152048f
SHA1b3972c486ed6af1aeae9fb6c4a231076f80d9649
SHA256976b524a46b0a6f708880a962e89e09c2457b7fdf4032f54e317301a0d2051ec
SHA51256864c4b0ed0741375879d95561bb63d35a60383f7d61437ab194b36b4e870b660aca914023014dcfa8b250fe126d04bb7a0489b24d38a683b8acb7b190481a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5afa4297ba1de95a45ff8f2fe8218d048
SHA13d0fe0c66880f128bba73b8771ffd116b51af90a
SHA25680cdec07014d935766d5327f1dec576a2dfda62c7971af69c132274b63feaa67
SHA51213adb876b993abe4b8c73179e3de338dbcc1ef384c9b86a52e05482e038d510f72ba437fe89dd8b07d94da370bd094a4f9ca68d8540efa980a9c9c2536d93998
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50ccdb4e7fccc65b0c2805be71c23aaf1
SHA1181ec5ec57b4da16f1e3942049e382594d9a096b
SHA2560367707bc08f4e6e5e3554b5487dd66a0a94df5796ca726ac1dc6b0260f44194
SHA5121a260122434067fdb41fc75ceb1d65afbc1e5e01dfa888981530f0ea448df743db1be14743b50609684128ffd4aeb0bea60d7e929fa82fae571adabd4ed4fa99
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51686630d9e1e4412788f98ba4d8b32c8
SHA122a4d5e95869b25fc3411b3e53e5a62ba1cc3be7
SHA256724ea9547152e56c7a0c3858d7fc04ff6b9571184680d13fc29f249ebe7545a4
SHA512843191fc66cb07d288aa64f8820762259c021e5a2eb7d0b06edd3077c1286c340cfa1f674549e9c91b6701a8b9be54bea5b699cb531471ea1479fd5a010451c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a298d0a54a30ba77b48e278d673e0009
SHA1665ec3499552eff3195160612fd7ae2353e98bba
SHA256bc8cead34be93a1ad34cf7a3868c579e3d1ef2516cfa4429790950049e49b230
SHA51265bebaaad0d9dcf80d88b81cd8dbcc17f7a6da0c12fb44711d16172b2558290422cf4fa4e0288f1ca3b8857757e8d938d899bc956fbf8e408dbdef93ac2ced10
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56ba42548b085e4fb5bbc1a2cadfe64e3
SHA1f18febe4224af904b5dc536a525d0a59bdad544f
SHA2560ea648cdf380007c5f5565bb871ce132b8c72c5a0da8faaff4d82d4a6a929128
SHA5129d7413c58ededb27b6485f93c44c9b494aa31ddb9c3672938365e2522fd60827f356fadad568e36c0db6bcbe9f7f3b8d983740e7e8e1c717f91611d851f75e18
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD511c0dd3e84fb56111bea7a4785f2846b
SHA1ac3dbba925c2a7cf811866701e6ef797ba78cfc6
SHA2560c9a8ba6a7287bbdcfd4616cb00ac90e384a37c94346d4fb25bddaecdc220590
SHA51231ee326676a33632e93754cd984e9056408b53a7ec74ff3c8ef2ea7da3fac2dbf597c8455ab6c5b3bebd8fefc4e2d7fc7e0ab42d77760c252caa658cd283c4cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b914ea85b7ad59179a24c2869aebc3e9
SHA1363ce4d6d79f8a93bd8f6c1daa6cfe784c3022d6
SHA256473e2262dec14015202dd4fbefb0c8c7823c1b00fabf480c538ac4eea2d6b63b
SHA5128daa019690df14a587c9b2d11e5bffd434d6bf9f4dae92d548af88eae4477caab599eb71ecdde6f35bb85db8158dc7863f273bdfe74bd7e59fc6ba6e83175e0d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b2540041b04d6b6962aefe84dad21852
SHA144c89314da9100be9f205f736362edd859bf839c
SHA2561b5c1b439da21b5992fc38cb23f9e9c8bf221c819433218161fca83c91b5fa20
SHA512be31eedaf2fa26a121ba6360a442d7ebf7b8574ca5dc874930ad8cfe6a95f4539370425dd0965f4510c41e60a04afdc06f58a7f403abd701743b97681ad801cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD551990df0961faa5975b178b876a12ce2
SHA17af1e6e02e15b0ad08ac3f8dc5dd582062a12993
SHA2568bd5972bb376acaf4efe4085fa125d1fd93a81b136e4999df2ee70e36b47b1c6
SHA512fa09727ead28a3a542acc4882bce4de084c39ff18a764f826a45dcfca082ccca7bc22b907fccf4d7116e98bef60da189b187477f5d5f2e34f4a77683f856bb88
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5abd2ed10ee2bbed0a9fd37f4aa909e66
SHA19b5a967e93e60ef76717eb9df0b4d945b76bc624
SHA256f9e88c642e77ad9219e8877ccaf0823745f319dd0fc64b4ff08a3a0732983e68
SHA5122978faa1b14d3d041d237f85b7a0fef43cd390cc03bac1154cde20aef2c965f6fb7fd572732690d0be2c9325db4fa65dc1adea4b7955fefb09a8112426c93bb0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5307f258e611f93b336b84755c58b222a
SHA1255f19558d742a70a658961458c1be6b67337ff0
SHA2565ee43dc83efc92bf22db3dc9eba3620c7dfc44ed5e3ed5508d2a95a117588a96
SHA5127659b5a33611b961fb5be76a10fe40679f93dbb75ecd86b6f3af66cd4f10e0ddcd6650eeb8b99a05a45a682c18cd12bbca08e3c05bb937944a9600f1ca31df54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5438c6ea68527b3acf235650cc27603ac
SHA146d5b59dcd0af1e38cd42b46c2f83e4a38ffb727
SHA256b68cffa0dea255405335116c3b69def33a6def0bb5fef27cc21ba025b6e7d435
SHA512deeace591dff582b2b67c196c82a6150b5591ea58e864dfd804716e302d9170550a001e1318d263e4a71b25a108cf2aa9752bbdb5c6d94a7e763cedc177c7fa3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD573f7d6839f761e2d9b1758d3b003235a
SHA16b1c37588855060369c61d4c7aa04acf71add427
SHA2560fd60db9fd7bb56aee6e3cae8878a1cc32fe823dfd2f21c05490018c41596924
SHA512dbe85931d3355b6bb14373aa8d895109d438f2700125ad5640ae5ba13dcf493dd54e854847a94424545c82d518959fccf926d1111afcdcba30f4b92ed6c17ab9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD568c0f9e5aedf5f63ef6cd922537e4e81
SHA15b37b647dccccf0d0c9c3b59bed0b5a186b552de
SHA256b6a2e40ff8d4e2ce1f4fbcfeae7147f41a2c656ae5987254588cc8fb22d1dcff
SHA512e29197277ca539e838f0e4ce46000b09e7a6bb1a6c53dc1fa1593561e11126662a23dca977d5976bb7723a7e6cc6cc4dc4079ef5e1eb24a49fb8ad321662e0eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51300ba349b5d5eebe1defb69b3b21e7e
SHA1d606b8664042f651274f566260d432ed65414b56
SHA256726167356ebdaf6b2632bd20f00d72da92e2a41fdcf1d923c5ee1c54c63c07e7
SHA51201054914fa611a582a3162aabb6472bbc6eb31b63b640ef9b381c7684812b0daff64b8941b10960deaf541e94859e8d02c68cb18dbeb0fdf219018efc17a8bd9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e195e3a053b2f4eac17e5400aa1b5f13
SHA1fba0ac28fc1c1e2e6691f6a876c08ca9615b7952
SHA256a5a2dbc1f686c41dce1aaf00df9a82824f70f489d8e0bb220b05d8f359c7273c
SHA512cc331041aeb5e29a593eaf9daf9c76e8097861a999b151a4d97dee869ef82f33ed06e643074d2d1a068eab45f92a6fdd91b227e643978b3572444c0ef7c9d941
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51a60c1a7a51f7353533de710f5193c99
SHA1d99af1ad9a078bc82223c780d2c0d1539d4c139b
SHA25699d59b32063781dcec92461e183f122e8f2ee358704fe2dfac6169b4afb0dd2e
SHA51244cdf0c5962056f085cec199accab2e6105678cbeee08b233ec3ac03ffa7a5449193fc487134db24877b39701fa097aa1bf874da656426e243ffc18296888523
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b