Analysis
-
max time kernel
118s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
25/06/2024, 06:12
Static task
static1
Behavioral task
behavioral1
Sample
0cf9ef31da609162ed6aed3704d72791_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
0cf9ef31da609162ed6aed3704d72791_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
0cf9ef31da609162ed6aed3704d72791_JaffaCakes118.html
-
Size
7KB
-
MD5
0cf9ef31da609162ed6aed3704d72791
-
SHA1
0ca6161209ae75978c0cd7aa3816cb64d866ca35
-
SHA256
9288b07ebcf0ef7bec410f81675f4a9e8bbfb542a5857cb5105f3863f453a191
-
SHA512
f5401ffb2cedb3e2a30e96cf0ede9d1908b77c9d241d7ab84f991d84775e8fdba5d6afbd145096e0c98554473183984147e2ffeea0f7e92096498912c190ab04
-
SSDEEP
96:uzVs+ux7fMLLY1k9o84d12ef7CSTUWne0huAcEZ7ru7f:csz7fMAYS/Omjb76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00e746d1c6c6da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425457854" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000000553a24841dc52f895ebc5c2aa2d1b4cbc57de4a1f735b10b988e14338c867eb000000000e80000000020000200000005a7a65f70048d2924e9a77b0940d4e0645ad639b3a29a2618903494ff98c1dfb20000000a47ae579f3ad29749441eab3eae4b29698f9a0766fb58924b5165fef1169891340000000d1094884317ddf9c08ad74e610a23f45ca105a86ded39fe117baf9728b5a4913a5cd80bdf56acbfa5297dbd564ee2ce46d3f8ecaf636ff0b618d0e437b7d4a0d iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FB974C71-32B9-11EF-AC4C-424EC277AA72} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000dec7922a923d9e07a096da2057e63a91d5b516aad90151fda7308aafb6330967000000000e8000000002000020000000eb0c56c4943d0dad0bce3e919ccb1dc73746a757631e1de1371b243d82dcc26490000000bc9a6686cbb7fedafde2ff95898e80e87528bd5c9f004c87ab830d91027a8885386fafd9bbf32522b500c0018312724fbd00baa69fd9c6dc3458223c8d0eb25c45e179d90e3d0b2594903cfba892dc36d2ae47c4226f8cc029a315156c33442f9a74028046029cf62c28062c6c039d934c024324c4aac8d66eefbd8bcdf1f80f3645fc945d4c1cbb45dae30fd6ea393f4000000074e689a18eca2500e0b7b25e58f3efbd6be9b4a3fa737849e37d4b514718757f0abee0d41a6ecc6b2e4e906507dcce0fb5ea53e817bef2d6d61e4eb66ed25d7f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2436 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2436 iexplore.exe 2436 iexplore.exe 3056 IEXPLORE.EXE 3056 IEXPLORE.EXE 3056 IEXPLORE.EXE 3056 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2436 wrote to memory of 3056 2436 iexplore.exe 28 PID 2436 wrote to memory of 3056 2436 iexplore.exe 28 PID 2436 wrote to memory of 3056 2436 iexplore.exe 28 PID 2436 wrote to memory of 3056 2436 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0cf9ef31da609162ed6aed3704d72791_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2436 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3056
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5553ac9fc1be78fb1b0a0ab88b19d7dfe
SHA10780bf50fc69bda8507de697f63a3f2ff3e28090
SHA25653c08e29cc4d9bccef96c5bef29443754d5d89bd958344e76f78466c7b3212c7
SHA512b4dc2418c4cd039dee38e10e21b7e6db95ae6c57f655ef792ca9c84dfb268649b1aafed20225e4e28b6aeaba1a53c614329d6a507fe997485d5f11760e46b04c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ae404984cc6e9475af42959c50b91545
SHA1e81bf7731818b8b55130025d96ef89fca8493cbc
SHA25607ff22fa3b5d6b1cce5dd312610aa4dfffb57af26f42d46d886cb5e198087c0a
SHA512235e0404d6a238fb92bc67bcb23c39ae15c3ab68260624cf7a0254870ed0108f650b4f6063fe1b2bb2eb53af8e5547ec6af0d3f3b2d0f66b1ed5d04f4854aacb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cef789e98abb8a01b288f327c7860c59
SHA1b8a7f9b48847a70edf781ec52e58c3918d2b138c
SHA256c2a63df2fe44f6aa875a0d1abd422d34ebd42881982d72a055c1f8aa0cd81a87
SHA51298034e563fa87238ef4bb86ff2d0bd25b524a9c79e9b021324c3d7aa8649598b3c2579dd9cc44c742c4ff13d54f0d4f9d33ec463a819ba7e561327ef1a5ef0bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e8fc66151a88011def3c5482bb4d816f
SHA12410f426170efd7fa8710252775f2acb9c8d3c64
SHA256f2c05c283f92498ba831e3575bfdb40d3e16a016b30dec948bfc6eb9da157dac
SHA512e0da4e907bce89ec12932124a19b484fdf24d0ae01b781db0836863c630c3c14d4108fcb43fa93931cac54dec0a02806818f3eae02c8888620ab2c1069aa69ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a648ac08b1f7fd8dfa3c579eda6ae086
SHA125be06428de5762847a211f0640d6eeb2ca02ec2
SHA256ee319cd9c5061cd3c57929004ac67fbc8769770e0d714302c1415d1fc5016920
SHA512eb8d63a08082fbdb0d4e388eb8a8dab197dd0f50cd0e6c59f326332fdc0d06a7e69ad31df68bf845828e995529f01ab88b44c582a3f08b4e7463d9617781ac8a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bbf66b5e235d8b25ff9a8b82ce69a93c
SHA1a6e46f486e49b80dfb36ccab42f06ac5d49c0437
SHA2563013a71e3c399f5c5daedbb43a4dd675f92605fb933e8c5a3b1a674d150ff2de
SHA512bf9ef860f79081c1b322cd4cfdd017eb01f7a6fd21e6ee59cca5c52480619d15e783d69cd0fea10a1967dee78a1d670ace28bebecc98e09b6da938baa54c5057
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b55f171b48e8c67cdf8464aff23d1d67
SHA1ef01e62706734770cee291b74631ba1831478f25
SHA256cdbe46165ac421a064af597fb8e53fec4a2b291dfd82eaeac9495b5de3a63921
SHA512a2ffcc24db121d6e14e07b6d069e55ff85ae93ab40fd7eadd26cb7b124635e3a5cb1ceacfb6b9f4a19137cb93bf67648c6c4382b60e4803588930193f6de11ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD575f15840e6b20c10852f7766c2bbdb7d
SHA1cd7f89e9d44695792916e0e84a2d930f0d7e2f43
SHA2567e3f97fa68dc73c0b630511f21770c04fbb64a68b3ceef5fdcaf52a655be6e50
SHA5127d4c2109cb86d4a404b0757e0a296a2e9b304d0a4548fd8d95e0587fbc0985374837dfbd940c0719dcdc2efb5b7da468ef55cbbf09e28bd5f0c9f4f04c73cef9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b7a80bf729ad4dde6087936ee38d9efd
SHA123b286b87f732d6ebe906489432432ed56303459
SHA256f36147c8fe951271677c9a0d5b6e46d7efb6378d2495bdca420da392e3708ffa
SHA512a057980136ac260fa3aa1c3485cfbddfbbbdb1c762924190d31b9fbc8633fab74d854205f159ec1739710a400d80c35be02796b6380c6f9696c8bf634e436c60
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD572c581ba86693888ac51f3deb454fddf
SHA159514e5a032d4020cd4a80bf7b4673a2e9ccc8c4
SHA2563ccfc7e37c686f93c924488c458eb54279be34f01334c9cac7644c905cea45be
SHA5121c17c6fd8bec4307038f54e3d0454e0b83abdeb4ed62035d8a0ec75b3ce1a16053ed96f8d7f567998978d28890560085e3e7c5fc300dc794c3152f616e8a7f86
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e715b2914f59d4d7e0dc3f711fc00c2c
SHA15b7b15a14f7d6352ba82f2d5388d9372dc0344d8
SHA25673285e19ff24d8dc3d084d6354f6990d1b93798f66fefc0a71f7f572c172c79d
SHA512b90e133229c076274095f16d7a4f3df0d78173882e93e61039e35f59c9a74c29723e33a1a75c7653e9a52ecb46589c59c853856fb32cf228583c13ec6992ed8c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50d9a6e26fbd16bdb48dbf2b034f5b248
SHA14d790c636c9d4d3b7486560ec1fe08accebd8bf8
SHA256206f9ca1f9958fcdfd8e64b42b4444d67dec47ea6cead07ff4f69f8819aca1da
SHA512a3f06969b99843c8faf5892d66687563b63ba68a1c92327b8178a72450f10b42fafb2475748f2e35af517a4c871901cac81d539659f8a1eb6c3c61d08cae0511
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD583c818c877350c0135797f0ca38d8c4b
SHA1af19623822a0a71c3b138a991f96461515fed0c6
SHA2563e52eab4e8855c2a7ac553bff15d68389506bee8af28edafa96bbff3841b873c
SHA51248b6a2e57fc40f8d45b5bf68c40fd3ed0b17f7c9b8778b2495376c79a88041be37878fbb8b11c8554374d3c46c6e1967e261e415900c65aff9d5b697943de981
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51dddae472862f0f126c058ff1939771e
SHA1ccdd06774af87074ac8df132e9d903a94e50eaaf
SHA256c0397d417be00bca10e5b614160e4c50f321c3468b18c06fae0051b341aa0db0
SHA512ff46d0a94b56bf8a983f84a9fade0e9adabdb1d233c87845acd5f34e293de41831a5e4c7a9eddadde9a4eae126b5b1344a1ed94ca7b84f09b40991b5b2308485
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57463a2ff82330a3d863e7020e52a4145
SHA1e808b6859cf814b24db905ad38049669e8ae6c98
SHA2563b139e8e3fa8136c06fd1276c74590758ab54c020853509821d39f6f29136a65
SHA5128e6b1c411f5a6f74bdbaa4088593d88f36dea7d5a8a9233dffdfc73b961276bec97f33870ba1dc52651c3840f3e259ee611177a14dbc454216ee33d20d8ac25e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD574eb758c2ef44d75f3b6ce354258ce91
SHA1fc252911a02026ca7eae7bb5e9b9988a8f2fad38
SHA2562421ff4b03648e8f41ebac95c419c081fd426795ea1da5dd6f23289fc1620042
SHA51273a947aeb74f38ece58c684fee2fe7cec151e6871288cb8c25148cad710604f89f62688dee4544c8e3e34922cbb2f1e535099fe0c254da48ae41ae5cc41f561f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56cce4ff9235a45a343137463870a2ed6
SHA1c3ca2c6f6483cdd9bb0ea52dc53d5c1130363e2d
SHA256f181e7286b908128afa39a7bd72a79f100da232e863176a6d40d13a0a03a971c
SHA51277f8035d275d2709db67c923b8cf28214924d1096de368f9f4dcbb62692fdd9af4e37e2717fb9371705566dc19e21bf2f115a7c5bc1b10e217d8ef7f85cf9cf5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD568a38c6df5dd3dc41deef96788fd8c49
SHA1d932b002ec182dc961ea993cd9e027c351a4ba83
SHA256a06514f3e5c30211b5d1ce6a6243b7920d2ea0195160069f17f5aeffefcf59e5
SHA5129fda91e82527b8a24709db980e1848c2c1c397ff2120e3732d956f643bd67cc17e3828ec8d36608b1267f7df577fe5fb70758c3b47236edb84a0fa633b7a57dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57ec1834d855387e6287bed3823d5af85
SHA13f9d41deecea8fb4184891d4c84315183b4f022b
SHA2562bbe74166e533a2bf94d906c990df36c8d986d220a34cb1507f6bd517d9879be
SHA512652f614eca70f7ed2b127a52444757718a342d20d284bd917518b3453f76b8e9268b38b1759b010760be6a765bdc6d62d73ace40107d8863362311a0dc084342
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b