Analysis
-
max time kernel
135s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
24-06-2024 20:40
Static task
static1
Behavioral task
behavioral1
Sample
0abca7044ab92e339b0ee71229040241_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
0abca7044ab92e339b0ee71229040241_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
0abca7044ab92e339b0ee71229040241_JaffaCakes118.html
-
Size
53KB
-
MD5
0abca7044ab92e339b0ee71229040241
-
SHA1
7a06633a2be1f63fa780d66f517063b1c9b25f11
-
SHA256
93801422f3d4d743677b05d944239468b2894d0d046671996a85d13cc49f155c
-
SHA512
b475ef4595cdb7d950839120832f8bebbf85e7c01c43f9db47c43dfc2f8b30310b59c7f6fcf7b315370c3fcaa1ffba6dabdbc41cf60155a66867c53fad1f2465
-
SSDEEP
1536:CkgUiIakTqGivi+PyUFrunlYK63Nj+q5VyvR0w2AzTICbbnov/t9M/dNwIUEDmDe:CkgUiIakTqGivi+PyUFrunlYK63Nj+qg
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{121AEF61-326A-11EF-BD87-DEB4B2C1951C} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000006e0be6ab543407757b02f24149d4b399c1d5eff5ba0ce42849e29fe585fe0d52000000000e8000000002000020000000e54ea1b9b21777f3da0554c6d4d02eadad79d19eff11c19de4da02e8664a8b0b90000000d2bf23506d0b3a9bafd8be810aa3da8e9747b98ea551ec73db1b4a15913511eba70e4f9a414eecb879ac369734d5dd1dcb3f7d7fdbeea958bde7a3c4a78700ec8ef5ee9237cff20b781ea92c20d3c68f33ea4306b3a96843bc6592a025c88aa77fe4db28ce9a298b312e5ac2d1ed9ca28c948b5a8a4646ab0aef3d64ee2fe74caeecee48897a5030994f0d2bd7c3b87e400000003af04b0a0afde4d2abc4a08918668876c59b50602a4aa592d03adc118508a60246a59029210a49209350f9abc93b802627ea8c5052e79610980d12d2519f9f41 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0e1e5ec76c6da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425423531" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000c9001a92f4dd3f48ca2534c1474cbbe5a787d58ef6b862a88738dccda20d08df000000000e8000000002000020000000085cd24cfb0c678767c1ee5fa2b770858c97bc24673aa559201c25f2d1f1266e2000000054ab289a2f628815c41bc3ffca99db336c26d6870f58ac3eb4cbbe897f3d167b40000000cd8290bea1a2d8b5463b63ba3bee7b85c786446f62a94207c34d3135a094fe34abccda039d38ae9ea9e3e010417be722ab705f0eab070821ffc9a8843b8cb387 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2232 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2232 iexplore.exe 2232 iexplore.exe 2844 IEXPLORE.EXE 2844 IEXPLORE.EXE 2844 IEXPLORE.EXE 2844 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2232 wrote to memory of 2844 2232 iexplore.exe 28 PID 2232 wrote to memory of 2844 2232 iexplore.exe 28 PID 2232 wrote to memory of 2844 2232 iexplore.exe 28 PID 2232 wrote to memory of 2844 2232 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0abca7044ab92e339b0ee71229040241_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2232 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2844
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD518c4585a8ca0c34aaafb134df8fa55c7
SHA1120291c2c89c8fe01bbef6e14567a0305d60a768
SHA256d9765a3ae18dbfb5a53edbf9a2a584b268a6f95736c6daff3b7d9a2909f7f74e
SHA5123f2aba5ce544a242a98fe6be418d204b3952ae22c6965873383be89434a7527843990e9fc13a67eb0ca6b10ec2801a553d7370b4a81acc64872e95841a34b88c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e534a33ce8bc21a0cb095b1e3816f643
SHA1ac034dc49a1a36d554be569687568ad67aa1b89b
SHA2563c55db55203925fa9ee22df80fe136f326466a723b35b7ac203151d0e740f0ec
SHA5125b37c769858c2b19ea0f3ae3c9db38ca951b726ce4a642bb7446ea9eb9c2fca7fceff2f0385540c44bfe287d2a49b339d3620b8d26cbc2688997d7fedd4933ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD536c63e81c567cf50ef153e5d489f1a5e
SHA1c286e7a7e52c34d0d18765fec4a7cebb5616e7b0
SHA256c9054698c7b4d2c828d8d07fb494ac78a89ba273a1ce99699c92443245c0282e
SHA512d3b67b79b3043b06ffc4aade9656a638085b22db4d6124d189cf3df3993e5e3baf9af5b943e51f96b43452631e2e93dad7ae3fc98f1bf1d4a480a52c2a026e1c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ace88302efeadca2b22fb8f6e4df5716
SHA180ec954468ebccf41e8c1d3351e8f3aa36798e78
SHA256052295dc887805db6334b64dfdafc278ac1cb3fa07d15734958ff52baf7d8f5f
SHA512ba5ada38dfde311d05f2e2b376082d37fc2234560e19a54c0aef857be56af3e530bfec37741ecc2613019367eaa2955353a0c63ac665bedd8340f46846fd7973
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e77939ec4df66adde1108eeef898dd52
SHA1901cbf107565db96ea46236cf07d8a309b4a917e
SHA2565e4f917d8e117206d643d58ba98aee57390a9d9d504be346b7d36ac18a5a5476
SHA51265b6bf2f088ebf2e3f22ea4cd5f57c606c3055df3571ab629ff3596306a90d7eab47d95717802197ebdf115cd39f847fb5c732bd7f54ba9257a1d6325b03b658
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD513530170fc8e0f5644f9b14d39b1adbc
SHA13405cd0bfb686913b09c3ebe768d9230b41a5a2d
SHA25676d48b8421c3088aa49c07b7d3dd095bfca40696fd0bc40f008a21a3e33e7732
SHA51249b4d64f7315c65793efabd565da4dcac841c1ea726723ba40d6be4c833d0b98a74066a5fd99d8e0437a6736f7af934ece103e4eaea9bdab59fed8f163336548
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD521ae2f334ce3830a736ee38713a5f0ec
SHA12ea25f84fc9ca1efc30c772a2b28155c08f5ce04
SHA256c93544268184b741fc7da854f19dffeba39a1b51e44b3a3479b2de0fbaee751f
SHA51213c4713e8298e8e1cc83135c92f55f27fc6d41c578232b7cdb99af8e2158fc5e4b4d72914eb0b34318f55175fb67a9663cb9433016906d0ff38a0688f460ef55
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54b2d2822588560ebab41bd00c6f14227
SHA17707f18d9819bd01bff28331b1f597a6334b0a26
SHA25687ba201999ce9dfc0a8ad6cec84146ac43f9ebf3e70db057532fa07fb7328e0f
SHA5123a238d272273596aa84d0f248314599a15917a48836db77e0e811941c8821c56d89cccaef5ceacfb7a3d12895b3b4a67b3d95dd6f7f1c7c1a8c94cfd1132af08
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51c64642abd57d4ad2d79f27c698e9857
SHA11062af609cd5ce0eaa01ca6325d0c3a6020c5534
SHA2564cb1eba073f15ad2d222051a6730375e4f5196d9a56e6ec2fe7b6a7e2613b234
SHA51250c25eadf6de5626d0b05548dcb37d78e18a676014e502d3fa6975028435eca890471d48038ad765871ad2ec5c44138edaaf9825a93b9bdb67b567c5f54ec12d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD578aec42fb6062af80816853a32a71f4b
SHA1815b77002e7ab01f9f970f485f606986f85e1544
SHA256e0a4f10d6e190dffac2b5abed687c39ab42fbb5a4a9c3667867f194709b54e0c
SHA512ec10830bb655db3f5ba633291eb2ba18830edcf6788cafd390955a2108ee3f0e0b310b762016b7947b4b7c178bc84806699479ee0f442aae639b5981b6c99f56
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD598b76497c3078a6b50e460f7f42fdd1e
SHA180b9f8df82bb4c1f64a1292968d2d9731afe95bb
SHA25663358562c6cff28a200f52cf0898785a5a431c2373244236010eeb7a72a850f1
SHA51202dea771d267d75b21b8607afb74c5a8b1784c03082340ca304c9a4b4539a5470bc830bcd585a9bbb710e241f7e63241a27861d5383a6c089d5cefd3e6846b69
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f88b377baa9fc98c529b54e39a4dfda4
SHA13c92ea20e9ae053bc73b3468fc40b2ef830a631e
SHA256511389cdda597c8329abc62325112a7cbeea4e9eedf65cdc6f46bdc66879250d
SHA51243e88d541f7cd649249f590821e88ea6240ba5899eca4b8a882c8432e8231751450a71db6b80e8cc7a471aad0c35848f0892e8bc4cec44d6fd783292aadc247f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD563657ebd0d4d65ef1570fa6119e79ea3
SHA149679d2618aa0d23192f2e53097ae23db1a72141
SHA256c8ec621f1712417d28867cfb5f5b3ffcbeb1217a9904621c3998f5652c787afd
SHA512963d1561a5ab8ddab79811a9ffd3b0666459975ae1d36be1b33ff6199e75da4ab5dd5662e37802f6b343f0ff156e641cde73212384fc0be2dd599f9971f5f7f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53d2eea6fbc08eac2ac9da79f5c4a541b
SHA1e1ca8e181f00650906be8d9a73f1caae5ecf7745
SHA256114fbc62e9392330eb395939a78b266a4289b125c6bff30cfb341143cd09f505
SHA512c508503b6a9e7a3d7b873b0f40bfbe2bae6b65e5f6dcde9fccde673de6a11dfaece81d71c6f9a30ce90b5737ba9256afd0fe511d2c1f31aaad662945cc44a095
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d168632b7b1d0fe7fbd288cf2c08e1fc
SHA1c563636f71253d1279c7a795e8af4a376113ca4f
SHA256fa0e347f364563e94428094d665d3a4b890f351f730b45947eb3dc574d118920
SHA51217adae379b4e4909c5797b2fac0fae4d29f9b702449b5d0d66ad0877dccdc578bd2611c3a5672c095cd545c4478a8d7392f1cf3d3bad93b8c564b1e6bf17a950
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dde3446a1e760a6f50bca187f5ae3088
SHA1be058b5ec5e729f6fdd3e30e8b08dac99d7bc458
SHA2564c27fdaa7d3b44868ae4c092a57735427712ba6d2362a42de69fdaa494f094e1
SHA512b33f824eb72b33ead91bda33545ce028528381c24a17d036d3012238461ceab3cd5670d9c01dc9c437cb7c782b09ddee6eb71de13f4b275fa33c9fabab9b0bc7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e3f9e168e42a41562b781aaa90342871
SHA100e7739775db49fe32c8038dbda63bbbff9bda2e
SHA25609b7166136b1d9782761c70e6d8ad4245b1cd4e4533bd3a547cae4355fb2cf70
SHA512eff211c5d4cd520e6918b6a2d4656f562579eb4ace6809a1cf5e9a0c7e0baeed0dee4e8be0c4a4ada3a2ebcaa8a4d239f4976c5bde15da11ed3a8928e9d93730
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Z5LT06Y3\print[1].htm
Filesize706B
MD567f3a5933c17b3ab044826d3927d0ba9
SHA15957076d09bacaa6db8ddc832b4fd87ed8f05f8a
SHA25697e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64
SHA51203ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b