Analysis
-
max time kernel
120s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
15/06/2024, 20:44
Static task
static1
Behavioral task
behavioral1
Sample
afff283b34dac82c30556a66810e35fa_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
afff283b34dac82c30556a66810e35fa_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
afff283b34dac82c30556a66810e35fa_JaffaCakes118.html
-
Size
42KB
-
MD5
afff283b34dac82c30556a66810e35fa
-
SHA1
3b1e42e886c7b5056aa2d5a8ae98175edbdf655a
-
SHA256
39495cd12b5b47894fd300f66ce6eba38ae22623bf3a5688ebd96dc9cfb6b961
-
SHA512
07706f1d7f9cef2bf5a247ab4ed935baea7b78fe1abed9b61d62c8edc315aa5c87fbe168b21e6bb888492670b02611c7dc2df2330e02773843c9b864252d7b5d
-
SSDEEP
768:jJJVOCLN7hoQQmgj/Ryypw9R/WD1EnDorsLpo7Sa1qZt5Zhzzat/:j7Lumc/Mypw9R/WD1EnDorsVo7SeIz6
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{10B50571-2B58-11EF-AF9B-7E1039193522} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000da289a8f64306e0c36d8f7223af5374d1f1f8c4e66a237b9291e36812f7a9b4c000000000e8000000002000020000000bbc92bc47edfc853b895ef1d0e0a1797d6f883163a429d9dccbf5b8fadd7d2d220000000c182d09568e757ae3fcaaecb1d6c14427dc0a0d33c801f4a11f86aa312999191400000001eb9abdbb10e00c4223edd7a27abc5b3ff5cd0fe0e8ef8f2fc07f2f78a636da97c452c3bc0a3aa7a64fe5c2e41da8714675e28f25dae30556ed2f8131a163639 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 709279e764bfda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424646141" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000006316e058aa7a47447b78e8fed94c9e6358c91eb9a21e6a3204fd95c5d3830732000000000e8000000002000020000000ed41b300be5606b4e02ef9cfdb2797fd3569229c2587ff9cddeec28d6f065bf4900000009f356dd8d5f12adcf7359c6f3d274aca61e236e82ee9980bf3c3c0466a1e5119a56a6646283cc8ca3a7c1690dea91b17fada81809532151a80a4dc3b0f700c6cd8bf6e9d5e4676f508a5fae33fbffb600ebdc845243667c57469d278aa8d5cdd64406f237d6ea9dba81d41da2339358700333610ae3fe6e952120e77214d3f47c6f9af900074a1893272f3959022461a40000000e7ab268c054c1b6aa12949da2e3b4f5d38df5199af79d0b8742da08714c838ec8bf9542c441ad1e4c6296dd5c71b191cbec5c9c171a897b7b10939e982753e08 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2152 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2152 iexplore.exe 2152 iexplore.exe 2744 IEXPLORE.EXE 2744 IEXPLORE.EXE 2744 IEXPLORE.EXE 2744 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2152 wrote to memory of 2744 2152 iexplore.exe 28 PID 2152 wrote to memory of 2744 2152 iexplore.exe 28 PID 2152 wrote to memory of 2744 2152 iexplore.exe 28 PID 2152 wrote to memory of 2744 2152 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\afff283b34dac82c30556a66810e35fa_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2152 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2744
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5af1fa74a61a305ee121d6363bdfd4392
SHA168a320934b9d5ba73131684ce1f2245473ca4d5b
SHA2563431eb2e05dc04c35b67c57d5e5d6aec75370bcbfa084489e9b8965cae83af0f
SHA51270def1c609fdb25c443fa6ff39dee939c39fca4699ec618da21cc3e0cc6be19e19e627673dfbbbca2394d586914f8fcd4d8c8419ecb549e95fb9dda459db92a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD566cac7fcc4d6ae2fc30d824d3b6efd13
SHA13f8eef854e29f70e58e7279baf433860875bbf71
SHA25690f3c58239229bf7015934b55c75a10f14fa7636fcc65dac6933da14d7bf7b5f
SHA512daa72134a027cf03a8ec157345959334e85769e47fa801a14e4c2f295042549ab044e6893da91962a3e23ae91da59fd55f131c85c983e1f3b0fe9c32bb3120c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57d3d7ddbd90bae4b3e7424e7225ce856
SHA1d8333fbe90d806f95ec59af40d7ebfc231d4de76
SHA25643e77e424e7a745e1e02aceffaa3c8d1da2c911235867ff4e0cdbd95638b874c
SHA5129b85f94c97b5bf228db43b8a741b0b09686ed26ebac2d22fdbfaec3395004acf2184f45a7f7036dd349658742d98283ba5e076286db09b36c3a30c929fa18d3d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ee43b1d82b7c9a7e4034912713435dda
SHA1d35c7a1a042276abf831825806f7dfe686c4fa3a
SHA256b43e0498cfd31fa357df549bc2272f9731e646d2ea3c7741240549800a777d88
SHA5121c4d951f78e8e7101f6bb9719f42808fd364a95c46c2dd02988517da87c490dc5e3b5a8f8cbe7a27cb053e3dde99b236b0fa5ee2d8ea216fd20d9606f36003f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a93f6039437072813c0a963458a8c670
SHA19e6e8c808e8ac5051baf5e0754c426b00f175a33
SHA2564adbc7d2004bba2e5e0ff7db07c6f27305da68b1753597de482a52f920563007
SHA512553a2e7005ddd1685c509c8969dd831e47d7449c4d1b64365a9444897d4e4fe7d02239f0f9f0b64889b8e1be1e26223723e10e0d56a19ac6e7ea83d09f8e1c15
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57e2f25cc9716396eac02499f153daa4e
SHA153e7506eab891789b06c398e1f886656021314c7
SHA256146a20820d6f4f41bcc4e8bc2d81f6348f76421b5d34e8c1c2233f9cd8d92410
SHA51290c98a87cb7f8ee6fac910049817485f0de556fa9aa19dd7f9275ddbad55cd8eabce37d038b3a7b8bba120b7f8a252d13da954c80b2c78d7701c7cb4572543b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD568a60656282fba1989c9afa6520bb538
SHA1a77e1bdb27f0c71536fa335ef126c2917d5008b8
SHA2569e1bc56a5593c74bdcb7a0544c1e718eddd81ef0bc87db9620deae175eb9c1cf
SHA512b55c7b4ec35144418ca24f47f22aaa5921d21cbb3441206ad992ae60c29104cc42610bd966164aa196dc4850207b1db768d35edf688375c3ceb569c5c5cfff85
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD519714a1e865765d96a2e83a21d73650f
SHA17d229de06ada816b529ad0767ef10fc5cca9ead8
SHA25607a47d29994602ca58cda2035af2a0bd4da60f00e25181b22e93f3b497c829a9
SHA5123533b49222f443e38eb7064a0ce69642e5f8373b37c4e9022dcb9db4204132c4f01be974338b4da02ec18614609e40a03b331bf784824723ddaac5665576a4d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eac56f925473e17586c70b13a2a56372
SHA178d1133c9cd3ed18c8fd8261f3e81632d0e23c96
SHA2560101ca8f12e76ad339c6babdf958bda46ca2e2119ffee4dad574bbc7d30958a6
SHA512aec8281a57c1037934c10d35625589ca46f5a22abba8dc00b50bf6f13d8c22de28598cb88ff7f65093ec7b1214f8204d3dd8f8bfdcfccad40786cfecc917ad2e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dc412daa5ebf07037fa52f0e8e9e89f1
SHA1e302f3b9b7b357a9c86a3cdc700131035f2f88f6
SHA256015eb210e1493ef27e5f9acd05c25ef0980552cdc8c9a3d3bc9da67ef728f9e3
SHA51261eb499b16a5f7952c05b795bc32850e1e64b5c4579ee5fbe0f1477428efb3b7f41bfb7c0a0013713da5c44822b9cbdb008739e3265ed2b409811a4104b93ead
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5de6430ea01708afa02d7f967f4f9000c
SHA1093d10a8fa25d23704e6fe0bafb10955c69366a2
SHA256c7f33956dda984ac2416ed29a0bbf100c2148e3fa81525139b596f740f7a6022
SHA5129fd6a4be7d7f5bc932a52a3d3dad2b99839ff1250dab9027b207cbc1ca5aa5f747b9d9e13c592451cf1b6598862603d9a5025d48069d323d09d6f02d1fa63f27
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bd14525ba6eaa28f98260a7dde01c341
SHA157d787412f8b14a61ad4e779e8652a5d53e01f59
SHA256e5bdb111949c2819dc68adeb3042f70dcc770118c47c68fb0f38190706272aa2
SHA512d894d42b568916854dc3cb831aa38e59d0e554595d557504830bffce1bea6a7119c70b909ba4ab775430b3d456bbc063ea11063905cbf9db240864d9aacbe009
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c4096a975bdd17a1f0eb8eb2bec6d101
SHA17773c625e56ff3989d1d93ee554373f3dabfb2b6
SHA256e9613f6783771d889e3612486999280dca61db0b0fa595630fc4827e0a6bda75
SHA5125ea4c3b390d7989cb655c0898fb472d4f13e532a9beabc68b844c1e58bdd3c7bd165a0982ac57b95ab8e944c82e9b627fb84c7db06a29687c4f849f4b06320f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52ed484bb3f34ca82f1420f15757b53dc
SHA1a8f6bef1b27e5d3789f744877d5cc8f32382b74c
SHA25659807827c65b8995999c04593761f7e0fa89dc00ec00f69acfa6bcdb14368697
SHA512cda2113c5ada9d2af9fefb826d31d5b79af58b61f10580076da57879820aba3462109e3df7e11907ee27068ce6537953bb9f5749c6de4336c4936f992304140b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5894f77abb7a9bd70f8c4dbc4d548bc0d
SHA1b72062cce362922d4858d53ea041bc1ac925840d
SHA2562b239eb4fb59c6036bee14ef79328ebf2f64d1eb60944cfcdb8349e0d41edfdb
SHA5129d17f6987cb47757c2abdceb4fb12910c0126bdffe30c1df82a4ed597cb36723d1919e898c156bdf35d4714e0e8bb8b38976fcbcd71aaa6fa0fe141aa3080926
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5af38792ed824b611f5d4cd197eab37a2
SHA10515f7f89b068a5ff029ad38864b9ae5154e1282
SHA256223d3bec8feb372b59c906dd2f5f298558d6924c9292e6b64103b355e8ecc02e
SHA5123dd9d41f57f3bd935fee47e17e8ce6997a40a020e169a95d2f46e68c72778e3c72b7aaf734d3e6d1e2a4c979a8a8ec014c15d9f8278713089ca37ab91b545c6d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5afdd9b566e4b782baf415cdec6ccefa9
SHA1026bf16d2be38da4ca4e0410787d6c558c45ae40
SHA25605d76de938fcf11b23c6cff7a8b8d26291ff3c459d70a5412c2fc132023b8f8a
SHA51299baf3233448976c74714dd30c018d3e4f76e54bed86117b053bbd2de164343d1db3b46add39aa0b99f2a947ad0622dd66a441f8dc181a0534614e9dc1e1d1a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d72b7252e55ad57ddaedae141504bdd0
SHA1da8e00c9424d3018ff6dfe94561173d9e2376f17
SHA256064795189dada257545ebd86d29034815c8e767e9ce5c44697b7389aeb4394b9
SHA5127ea8dd9a4b4ecfc3e03b8663295b109a8576cc0c7011481d3a085e00a697b027aea79f0d2d294d6bdf54ac3ed9c9a23d42cb5c7848508f6cfb85ef8fb7bac27b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5037fbd19a4d404d75fbfe4ceb8daa12a
SHA191b256de061a5caccbeee75ee90f1d1f301a7ed9
SHA256b8ecbbf199dd62410e51c78e810cc9de9bcc400f859ae832884629f8c56f335d
SHA5122d3cb10d2091398d71f00ba54efabb9c0e0a4fdd5af72343bcaf24fa5c065bfd2677a4c2e85a0a1c2282d9e18346b39dc31f96ebfe9b2fd69d37d02e11e3b67c
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b