Analysis
-
max time kernel
136s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
24-06-2024 07:57
Static task
static1
Behavioral task
behavioral1
Sample
07515db917c883990cad5e3dd13a9077_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
07515db917c883990cad5e3dd13a9077_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
07515db917c883990cad5e3dd13a9077_JaffaCakes118.html
-
Size
53KB
-
MD5
07515db917c883990cad5e3dd13a9077
-
SHA1
a72b89024d8d43fcfd9b3de62c2e4d0870dfc616
-
SHA256
441dee69cc9b7761ebc6f9007ca061bf31e750371b35ac4e5fa5632256fd0040
-
SHA512
9d9b52d4c9e5596b9536707ee2767bc46f589ff94a01c748b9fb191374e9ba41c56a0b2eafe5cb587e972be30a70f9e61de8b4ea337eff654262d59e5a069f33
-
SSDEEP
1536:CkgUiIakTqGivi+PyUorunlYH63Nj+q5Vy0R0w2AzTICbb7os/t9M/dNwIUTDmDm:CkgUiIakTqGivi+PyUorunlYH63Nj+qR
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425377749" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000530a49bfb9e63e763fa16e8c129e9d204f983d4cfaea325643898577a035ec99000000000e80000000020000200000009754b19e464ac1f0339d0f3679c7c7b22bf04f65802f3c8a92e6c360717620ef900000009f2a17f03c4ed25b29b973464337b65a6fe4596da85848916332320d8172cb07a19ee4ee80e368a1be1b3509281b8cb019e78fa93792d8de04966c9e44d91eb9d360b1ba66da94c554f4f2aa58aa4877e3fd21a8edeaf5c1ecc6caead89407c497ce16cc5744d2948b91425754c074c8b7cbe1376b07fc422de38f7679528abbfe2fceee6b6c7bbcf44ee08781ed907d400000005345b132de3965ad53e66f9e94fb79b61ed45df269efc052ebec58005b522341cdb999a97f6da0995a710f8e0c3c8a3c963753932fe81b2bd51d3d1d357cd845 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{791AF4F1-31FF-11EF-A243-C63262D56B5F} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000009620240800cfc5deb39fbcac78df40062abe48a2dd15ddc5a3bed51354524283000000000e800000000200002000000060476563d9b9dbb177a1c33725240a180053c050d2dbfc21e21ea11e002473b720000000baecb0194fce826025af73f92d4929f51dd9c8187b16990237119414ba09da8640000000b15b0071edb300f5189a948028007b03f5afcb00e88e49f138f491030c835015f31959993ddf760cd67d21174f826e7cc2912ca5f9b2a42b00ef169d04e515e6 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0f2124f0cc6da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1704 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1704 iexplore.exe 1704 iexplore.exe 2548 IEXPLORE.EXE 2548 IEXPLORE.EXE 2548 IEXPLORE.EXE 2548 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1704 wrote to memory of 2548 1704 iexplore.exe 28 PID 1704 wrote to memory of 2548 1704 iexplore.exe 28 PID 1704 wrote to memory of 2548 1704 iexplore.exe 28 PID 1704 wrote to memory of 2548 1704 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\07515db917c883990cad5e3dd13a9077_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1704 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2548
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55d6804bb8361be98eb8b7edf9aa9dee7
SHA127b763552c05fb6f766d9db90e91a3815925cf00
SHA256d46e0cd48a5a2395d16ca4e443cc2dffec59db406fd0c8c0b4fda21379e36ae5
SHA51289d989ae6817a99d59389523142dac29a176227d907870a47033401739e4eb71078e04908975c031793374c0658e22ba5ec1160f866660ab150d70b63df07623
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD586e3a5f5cf1e8194dd2f1a263c10c5e9
SHA13f56d8bb8ac7f9c6599e79dee67fcbf320eac966
SHA25633f42c38b694dcedfea4790b81930d41a15b7d53f3f37e3c0837a5a94c74ac9b
SHA512a38b8b724456d4508dc8e9455fecdf1a6744a9ca29653de893b623ffd704e3c3057cec9ad75ed0a557071441fe6e9a6adfd7c54167a08e282b5614fe8c1bd8ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ea03c393165134e87db40bb1b565d8ab
SHA151b3caae194c03d748d4c33bfae8fa82b58bec84
SHA256a7af64ec84109f995fe8cd9cff98a1b8094f3c3423ab946247efd10088e4db89
SHA512c8a818c26714aed457220ca452a09a0f103d92a1be98e8eda7e4f88b941e050ccb8ed428a3a2bd7d2d29803815aa4e17ff33c4a0cc3d6923258ff57d65a66750
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD580643c4f60ef71690b2bb2b255d8335a
SHA1456627f877be9422ef8bf37659c8f4815a950971
SHA25665e3b6a2d886571cde42a051e40e3aa7f84c32b94aeef583a209a216da7f3cec
SHA51266334f073b7485e52fcbba96a3a590bc6a39a09b8a9df2a0c8bad3d7048532aa4e15051913260661b20899bf9555292b221048f114e44b0497a2b7dc051d9e9b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5850d7e51e5bc5f29f867506cc8197804
SHA164257dfc919e4a974bc31fcd56d6392d4cde92d6
SHA25600b4e522e857f44d0c648b99131efc242867c185c58d3258f2a82282645e7764
SHA5120a7219964a7564ea0e4d691cd58b0d904c0cc1549006a3af3c142cf10a385d3b54acdbee01289b3043c42a8f912bab4325bea9effe6259435e01a8539922d710
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD586e0b4a719d47260bfb9f030adca08d4
SHA1394d6f58b4e4bd0dbe2edc2cb827d24fc4256fee
SHA256694adaeb8eece7b796c9e0a93a9474a6c1c0f782dff6363dce7c388288727b28
SHA512541caf10de9991e503f6334451c2094c651d02ad9fcb94b6e8c34fdc087780f2d9963dad5b16d03fad760700e375604609e63a1cb97ffcd1f67530e67487ad7b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD584a08ab6088cc5cb8a0244f353a69284
SHA15d85d02a91530b6fec3ecd39538cadb01600ae6b
SHA256fef57dee2bbf41ce8e5b99649be2a6bfb0e1954e32ecad040282cbf08a4b1008
SHA512c1b95fedc8e19a1ed9e69206d5fd3835fdf148e07573223d4d061f78cad4c4c9d6718c057799276c7e228de327f4d6d067abc604ec958761c5765a793383624a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD513c958eb2f5438ff20823f3df97358b0
SHA1fc75497461589a92b4d1440f369599807cacd044
SHA256b6e4a0f4669d8e4ca7a48ae7afff95ff6a547992b7c6b1ebdd5ae31e935beec9
SHA512709e1bbb81f8536056ed590fe0841d67bf68b6583eeabbafc4fe2e519533c5ed68913405099047089a6796d9280e1443bee5d243bdc18d6176f48fdaa56baeb3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cbc7763975ce2d700638357e4e296137
SHA1fdc547bf069c995ef60b8759013046f980174a3b
SHA2561976cf2bc6bc74f84f6e63bec0dfd62648b4bc001288f7f2b3cb3b2cde32f98d
SHA512b8a0d47e8815fe3295556cc9d22a216b9c673c2c0fa7e46ad3e2f78e94655040919484bf46428340ac0d39a871cc6e37354a1d1a303de4db3fb81adb7a0de91d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57b9408789aacd9777663b2461f70c922
SHA1a990184a323fc5316de7b7cc914dc1daaa94cc16
SHA256444e4420c7cf5176c0f124ba356e964db55e79160e4b6c2ff53c2579a681d2dd
SHA512d91d9a8a519367ed103c35004e02e069ef7f5c48645a3534a24e213cba51d79b0aa03ed7bfb9b41ae3c72ae38032d36aab3e5263db12aca403f0b726089a621f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57565ce8ddf2d33b9c6378219d04f218f
SHA1a0b19edb28e257d120dac0587fd456cce78334c1
SHA256dc9e342ed15bdf648d788e38c910dfea9e55355fadcf667067b674fec7abe64a
SHA512b7e40da6099eb0de620859c19d33f3d6baf510cca3153dc737def9911c10466a648e754fe503f752bb1cf0f95c67cdc84c05dab4207b8b0c3f80b7e28e6c35e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53298920ecc8b35a2f9549985d0d492fb
SHA136b91ba496c665c952233c544739e54f6087113e
SHA256ef7dcb60c3e4bd855bfc01e732d47bd863c17c9adc528a5da729f93cd818a3c5
SHA51298a57180c36e4237a7882d958dea8b1ebc6c824aacd8a87b3c19f4f8b504d02fdd7d72109240e63bb1a86f34e37fd270e7f16444b60bf14a1f9faf49e1bbe14d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57b19c0dd6f15e4237fec1a0e43c4d4d7
SHA11b7a9a3cfad88b4ddb13f6076a96063ad4855c1b
SHA2560f545acbe11052882d2697994d15a91b25ad267cbb2780e99b312ab877dce269
SHA5128c3cad555d50351082118ddde5bc17a0c3fe74fa13993821a90f5ea04d003b9f44fbf46794d2a98ae245c94255cc5dccfc907991bab77e6ee6b9e5398ec4c967
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52684c7b5e7039837b29864b2762614ca
SHA1a5a569e676804f22db016a7cb5717a3d0d889fb1
SHA2561e78701e9644478a14f72c21cba6229e43b884572efa370beb7c11aaa79812d7
SHA512b33545aee8647210efef13a641c3fe55dd5e5bfbd29af63088457ea5f68ea76d5274e0c86be93ba2093ac64f118884b05944a95e4f830dee36a73723a853e070
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fcf8c8f022c82d9ec17dacba7681bf89
SHA16b32f218f058c4f459f9699eeb14744b28d3af20
SHA2565e96aab227ea9bba586e3ecbc17aa1eaa8e4d898fbdc94bf8facf2420ee2eb53
SHA512a77800b96872cde38e13757176bd46f28eac53d6b4cd5d439411765f2457b0112f28ef7ecfb34c431fb9bcca62890de7ab0c6f54fdaf46a3170be160d03307e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f89eacbf038b6f709034f020f278c7af
SHA184bdff789f4e802e73ab7a1892a663414462c4a4
SHA2568738ea252ac3e77bfebc018c38ceb5241d980b0c9904a4afc9d0fe36904c7e6e
SHA51245ca944cca5fcbf9e61a4dd825d2bd0c54fe4440adb4dffe32b82d5707da44bb83299d9d8b5eaaf486e3d4e8023134b0867b5913871bbe8dd371f1fefb8e0238
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD534d4f72a4850dd13afe5146131f1215e
SHA14a7af960a0c08aa2cd33fc75fabeece9c865e9f4
SHA256413fe8613f81bef1d7890edcb283fa4198e21a6f4083c88a65557104dd501425
SHA512cc73dbadffc35fbc651d8476b0cd26a8f1e2bfd5313596a02e0001731f3154df6898740af880c98d2c90f3af7a5c6a894d0fcaf9f50f7dece83f17c132e94bdc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e98557c8284fd0c352ae4c3e828e14c5
SHA1cb394930800c92dd91244e2c1be25d0ffb4b4037
SHA256dc07811ba447df29839d217b497adc9d3f65950113d5a71aecdbd8b8b0ab3ea7
SHA512f86826dc8959efe7b113b342231eae58ee42d19508ab90c99086aa50cb5ea4b84dced05ec2e1c70ff9e40ddaefd9be903098eefef68c88e9f5490f4b2fc0f349
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\A8DU897P\glossar-js[1].htm
Filesize706B
MD567f3a5933c17b3ab044826d3927d0ba9
SHA15957076d09bacaa6db8ddc832b4fd87ed8f05f8a
SHA25697e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64
SHA51203ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b