Analysis
-
max time kernel
118s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
24-06-2024 07:16
Static task
static1
Behavioral task
behavioral1
Sample
072301554fc5a462653aff34d7cfbb3e_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
072301554fc5a462653aff34d7cfbb3e_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
072301554fc5a462653aff34d7cfbb3e_JaffaCakes118.html
-
Size
53KB
-
MD5
072301554fc5a462653aff34d7cfbb3e
-
SHA1
0e46ca027be7e39f0d7d9d3b529e3729cb982fbe
-
SHA256
580c2ab0e574657924bee7af90fdb0c6bcf0afd55b96729cb676ddc2cdc257a4
-
SHA512
5ba8cbe72edf349be42996fccbfba8fe088a0b360a011d0b72acee99dc6166dee062fa52b6dddf694986602a7351ebf75a0f80f197396f63eaa323bef78019ad
-
SSDEEP
1536:CkgUiIakTqGivi+PyUgrunlY163Nj+q5VyvR0w2AzTICbbfo+/t9M/dNwIUEDmDK:CkgUiIakTqGivi+PyUgrunlY163Nj+qT
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B8F10E31-31F9-11EF-9E55-E6415F422194} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000bbfb051b558c47a615880de8c5b5c911c70deee978665f60fd23234f42345d86000000000e8000000002000020000000f9afd4d73c3468efd8ea0438dd280945964e7bc89dfba20794e757cb43ee283720000000bc2bef75521aaf1fdecb72196d8f15a359c09c4c7fba65c7032ddbd35e7ad60640000000209419901fe72afaec7d0fca6835a9b1a917e49a0a5df2ec00674f440b5cfe12ff8be7f1dc19690e6ffc5fbd7a02a86e8935668194943d1295302750f069bcbd iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f039c68e06c6da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a80760000000002000000000010660000000100002000000075de19048854b8773647f7f78927d764d94afec17b2c9da444103afdfc89056a000000000e800000000200002000000043e6fefa813270dde27dd6a019bace099d2a32b70c1e3ac9966a86b1f9ca84f5900000005f8f9938ad5c9c866d561430193a0ca539cc81dfb23ca1e125fd2fe8ee8fbd09801be936e935fde14e1baa8e48b003a01d2287975aea0a2d6645b1176531492e0578f7de4b6ed15036a3c6500bdb8a4dc5e5a625d8c4eb60ee887d47cfb8e1daba8d363e4f7c5ee78afc2d23ad10dc9457f40602d5a2350b5bb921a53ffd66b8870dc1e68e4d5c0c2da138324617636740000000d953ea9c347e717bc570954e296e686401bb7cda67f8e1964d584c317cef72bfb559d642f446e5147be15bdfed620a7976915828a30178d928e074d24f74f48b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425375279" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2176 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2176 iexplore.exe 2176 iexplore.exe 2724 IEXPLORE.EXE 2724 IEXPLORE.EXE 2724 IEXPLORE.EXE 2724 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2176 wrote to memory of 2724 2176 iexplore.exe 28 PID 2176 wrote to memory of 2724 2176 iexplore.exe 28 PID 2176 wrote to memory of 2724 2176 iexplore.exe 28 PID 2176 wrote to memory of 2724 2176 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\072301554fc5a462653aff34d7cfbb3e_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2176 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2724
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f7b4c0aef1e430a47141007deb9b602e
SHA1f3a1d34c2aae5537c50aec276d3b08226a3d6c0e
SHA2562c2d9d9f6b8b1f0012d8b79d643f83f3f06271babffba2a55b16026ff4e17eb1
SHA512ca812ceb234ea4ece05a195c52c9be83b1109fddcf57a74384bd155b5b316d119ad3d9d3e4d99a7f0cc718adc32cf77bcd86c203f28cef1fc925134375f74cf6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5039334cee76a3c5c8ca5578a8fb03d58
SHA13d60c307f1f54e9636e76c8c1601e72739cb2ff5
SHA256ce2cb95558c18e7335d7c450c37494c4197c6a873683a43b5ee278b6a88a140a
SHA512e8a121ea7544b0c5407e22c5e6182232644b1cf1a2a33e1f47728fa1c799d1c7a208cc15d9f12332a105e9ed4314d911ad26dc6e826aec75e5eef0c762f78b79
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD595f35b7aed5223ffdd3d7046da3f9ac9
SHA11e1cd026abae9e6fa112b782020c1c19996a650b
SHA256b27234649bb3ce578f222952dc5074883a14f4302afeef0c2b46f61b2ec381ed
SHA5122f9556214dc7c2ec0ea4e12517ca94cbb6b902883a7e3b27d86404af756b510d7bf453a1ea3fd46d1532432e1405b012b1d01d3a228c15c4ebd039b96c880dff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD520afe9aa3851cea3a876000a6d4eb7e0
SHA1448ce2f52218ea0d3ce1b9e2193efee1adf26ec5
SHA25647b89ede3304eb7dce79277d85e3bba63170202b6f881ef2de3528e796a32003
SHA512fe5b6686f5f52a3795c4db52d5e78ca468b9c67bb81f2cbf34a529e5515094eecb36500f8f39a108b6d480c917a0212d6e97a035fc52077604114ec263f6ace4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50791ae2669125aed75e1994a0a421955
SHA1742a576345a42d2c9e3a00bd3b0129397a0d866d
SHA2567c4932acc7a43c401bbc0d64b90c8c9b6eea060358ef55ef3bca032b70f14209
SHA51296125337c43ae042999445dad33b3933151a3767aac1f2815d0c4574ace6059bc25f454ffa4a88d239c72cc92420678f3a7746e7a6c5eb8acafc475356089b33
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53ebc65692e75c11046c63d9bff92f638
SHA15b296cd4a33802796658a14bfb69b04512cd4d90
SHA25616f3566e12d1a2fbcfd4b427c0d1d1e3d5d4450d9a5f189ea270b8d1aa063175
SHA512f10fd95acfffa8d774591dece17dbf38ff0c50ec28569c062128673a33291c6c54a002dbf4a511682b5a7003a0da596b44eb780eb38341bfff56b1eb7090568e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD576742325a0100648f41926d9c86bc7a6
SHA1523d192fe90642b15d89e9b6f57cabe464dfa13e
SHA256fc3ba817a3e2afd0f84921331e080687fe1f1c85b351b6de046a71bbde8de310
SHA51269a40fbe3a9701e0ef6e96117db7c071f520b36e928ef51627e1a6a77379e130f4792ced3ff6471f97e7ec051bcf86f5957d439e9b7669153580fe629cf7994f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD513c1f0eb6dbba9ec76198b229f39864b
SHA154c8d1816cc4a18cf3912395a08289ecfb01c74a
SHA256ed5b35e2881e7fd1a919015bffdc2575a3f9023bd818a99a6b6052f5168180c6
SHA512860c37d09824bc7937556bea5a1e19ad7ef442f70658e4348f0c91b7455b854b8fbfe2df72027f6ec431040cdc3f491e21a1a0f3b0a5dae0731f1ac5f5748192
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dd40b44ebeb89f076892a6764bc18c60
SHA19a523ea14aac5ee2c5adfdf8576f234dc9d7642f
SHA256504e3e1d8776fd25e8ae86b841e258a235aa1c7266511c7bd9a3503975c01eab
SHA5122caf38b5d9d16b753a068f6489a583b4c68b3ebc4f4ddb91a35f0959a698949cdcb56f8a1548e9e70793f07dd579fbf476d601f6f1a944acd4f188c21adf6fa2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e5e16433a53a13d73a068346b7bd4277
SHA1e495e45820bfb4352becadbd9a6b018c858d6390
SHA2563594db94e2b889ca3cc1312c0d2b61a0f9666b9912344287853a564da27f74df
SHA512751d37a64b8d87c3d2740b41dec3dd520d77a11ec7b35e24ec02124019f9dbea877eff568dc8fdf9da6849c7add1edb05984c7a952dbf3cb46affa768615a02a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d59eea82390277ab86b52be8f29ae149
SHA121a446f1f2872d8ca1c353f9d9d774ee1b7fc795
SHA25641b98720695506a6c719ed67c881b38305a89b282bc4daa823fad5ca38837246
SHA512e61bf137802a1ccf387eff2b71b62d218d88380b554eb092321cbbfd58742abcf26be9f67d98b2aeb1823e337416843810ab7a9ee042ad25903e2041d5ef5ea7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53ff1c7b1308b67fde5e5608b41e51313
SHA1e0c31091308be24b2636cbfb321969f24e7c5c70
SHA25645248b1e2d663eab7345ecbf9762cdac4e55f3208a964f77af0ec99daf297b80
SHA51232cca0c4a1ab1d4cb71b993403f62b3ef47fe482a9c2289af870f242ca055368c3f3d765b4bfb1db7e25cfe4c22c6882dab22dac147a74dd287999039405aff6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e8cfe22bd677ba24444b989d9c90436d
SHA128f1e9091368683c40a08ae10bcc85a7fb11b00f
SHA25648b5999d0360ac120fe9918e22ac73f03c9c3c4b89d7a79bb8d47851de1ef9c1
SHA5122cda1a50e6c2d0ef830384212ac741b0c76cd6488085eaf6bce91e53a69bf7138797ec0673e9dc9a929a83cd67307b5b41a6115054ca09f340c04b20ff2ffc8e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f78982611b090395f573397d4bfdd3f9
SHA14bdeaf35033cabbab536de3afc3e0e87706fc77c
SHA25691cea11f04a40fa6f9862e65f2c07a36c18eb1e49f3fe31ae68d31e333b14b6b
SHA512cb415a3cb24dd453b2f5cb50e217e2cc8147fb0dc88bb3c1848227c70cacc1c2be56aa73d54677c22be6d9932b839aee7889f92db3afc7ef2cfc0fdb1407825e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD532261febe6ad25f19fbce01de1642ee8
SHA1a5fed8b6c6ab0012c6e1d676d01bf0ee5594398a
SHA256de52c482a84dce77883c45456c596a3dcfe271b9a4c810d67ad934f3ef8d3c24
SHA512c59f8f7ae768b5d4e605a2c2ebd0176f36c028768d8873b7e336cba3d98c7256b39a8142d96f48bce0db24b5cfffc04262a9173a40011a32fba2d90764fee351
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD565fe06d940744c965129e93f0d0eddf9
SHA112a321fea5910d1ef28b5fde3bb254dc19ecd0e5
SHA2563754ae38672e61b23a3992238ffd4009a8300a6db87b3b908a932c4cfd14b976
SHA5125aa28aaf6883178d2d0dc113a4ce0fb245fc5c8d82a7eae3bf6225ba31073442dec73f4976a24f4b38cf7389ce489f89b8f8d2aa27984dbb9b3c594f791eeb58
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD534ac75a147f3a72bd3c4159d83c48a06
SHA1f718a39853b4b95eec784ed74a67ee9085acffa2
SHA256774d32ed67a04d74edf357556fadab3125acf85aab5c1b3c8dd49e556b24bb83
SHA512bbed77681912bebbd1d45a8aa315f150e82d638b20e03e1ae03c4a4da14158ef140edbfd523c72ee598cff02857e35c846636dc8f6b4b1f3e94aa7c52f584790
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bdc94171383800f9facc47a2bad3986a
SHA1b8fbe5a9e0dfb1e444e2d0d8395fb6cfbe151825
SHA2564b98a44d3299ea51dcb368b8871e5a1bc202e856f7ac8ec8c774c73e00c4050f
SHA51298e89fa36940fa47fc0f15892cdf4d3b52a8ca637d79954e24393e565dc98aa68e6ff617b546c982e1c42492a9e2e666831d96201dcc0bddc664bcda32a620b3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\A8DU897P\style[1].htm
Filesize706B
MD567f3a5933c17b3ab044826d3927d0ba9
SHA15957076d09bacaa6db8ddc832b4fd87ed8f05f8a
SHA25697e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64
SHA51203ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b