Analysis
-
max time kernel
141s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
27-06-2024 15:03
Static task
static1
Behavioral task
behavioral1
Sample
1671806b8afc2f73615072313a01897b_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
1671806b8afc2f73615072313a01897b_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
1671806b8afc2f73615072313a01897b_JaffaCakes118.html
-
Size
28KB
-
MD5
1671806b8afc2f73615072313a01897b
-
SHA1
b173c8ed20c0f791720c999138e7e4d1100565d5
-
SHA256
cd576e5c97b1d83cba0e6284f98231f6ce2398ae7a2b8be29d06d2c6c0f3e395
-
SHA512
bb1d2739c69bd7c5b3dcd3c27eaf3468f4932d638ceecc65388d34e7bf9a499d5be86a10780cb6f0842b6ddf6ca593cae6f437f82772073cc06255a7a4c63b7e
-
SSDEEP
384:rvC1wblhAMviBJclRMj3RZPCYysPgeDywU:rvC1wbwSiBJ5j33qYBDywU
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 109ea14ea3c8da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425662490" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a03905000000000200000000001066000000010000200000003906b8a963c8a32f2ab07c34c2db8c75d27a68d945c0d79f98bf5cc2d6ad4374000000000e800000000200002000000033345785c47d4696ee74b7b1056bda9639be5df630362bf19f43ffcad43dd20f9000000031e367b6c7a8cabdd7a28951261f9ce43c6020b7952b49c0353a69cd7134553057bd8c520b92cb863603deeaea25ac855cb75fd072fd84c37ecef06e364fd123040f2ba4fec0e5d3682f263b4ca3b106ed14477e126c92a39b3378adef868b384af94bacbfbef50d35c22df8432ebde234c18741c946c2334d9c5fd7d17f764cfeb3ec1ddc697f1f1573cc9b6ed00d1e4000000028caba45913833a1928b309e2bd58f4f567beadf5294d19b45f00a11e0ada2898a1e556713e501c6473fa595e8b4cdbb374ea0383c29dbd1ef24962377f31eff iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a0390500000000020000000000106600000001000020000000624be1ecf14acb190d0191e5d970eab3932ee6f701ff1686db245b899051ca42000000000e8000000002000020000000d27a7b85270b9489b3565fcc96c5557371e658ccd91df5a0ded3b2a510471bbe2000000068ef48094a9318081b6d86e09ba1192032a5fe8b76c4873ea6f74ca7741718c24000000057e1f9183c9185c1c07363aef764e56c3ef8c7f8576ab3d0b70c72061212660a0cd0561bccadd9acee5496fe56e4c6d9e49041907720690ffcb5acbc11581bf4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{71590971-3496-11EF-964E-D2952450F783} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2072 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2072 iexplore.exe 2072 iexplore.exe 2060 IEXPLORE.EXE 2060 IEXPLORE.EXE 2060 IEXPLORE.EXE 2060 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2072 wrote to memory of 2060 2072 iexplore.exe 28 PID 2072 wrote to memory of 2060 2072 iexplore.exe 28 PID 2072 wrote to memory of 2060 2072 iexplore.exe 28 PID 2072 wrote to memory of 2060 2072 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1671806b8afc2f73615072313a01897b_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2072 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2060
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59836d5c5f22848be53549a540dfd38d7
SHA18def6e9bdfa453ef370ffcce65189ad8c1ef7de0
SHA2563e9e60428a4697d06c20f87963b66fd5c3d024d0edf8423f6c74ff7be810db12
SHA51207fef1ea4c536589f2b5019d2fe5dee9c2b8cb013d357822a399ab10085ca11dcf2558229e164f9ef12ed7d8dadd6ca1779deb48182fcefca77284a310feee98
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5822152d0f8240fd742c89d84d1683d7f
SHA1939563cf5a5b89918d35253051141e3d12cec55a
SHA25615d0bbade5bd558ac5a5aadc79381346e5c5efdadd8419176cc089ff181caf73
SHA5124d697be824feeacb4b4ac7373ffeb2165bf60c0650854a8d066c8f1143ab80c75caccb8425c2588fef9d682b441863762c4c08e2820f123f1756c9859e1d62de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD544a968f5963c32204219df84b6d967f4
SHA172fcfcc02a80f33a965c7ad7d02a60048c716d1f
SHA256101f4022389f3bb2fb6cdc4d2bc84d51726a7d4514f9571af443ecb7d2a82a58
SHA5125e3c3992e3d1da2b1b9a61d4736722fabdfada25708371eeafa1756dcc4779e203376d4582826963a6d31ca4d239482d27c04c646b624c97e60aaa2f348c3a67
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD516e9c33fc3b395983ec3c3a93ba11815
SHA191f388222fbe2d34734bcb8faa6d0d8ac830137f
SHA256f29718add5ee68fb26e0741c376345ac8484fb2108116ee8a7517b58bb1303af
SHA51253b2a1c3b2f561ed6ec99c65d3cc2f1c5b5b48c308e86844431241a306e94f2373f3a42273ca5f7b817a552d979393fcec2fa315e4524b67590140afd6ec9d3b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD554773a2e3510b15b76e957389a844519
SHA111d6cd150697b1fe3d2095cf579ca343384bb172
SHA2566cd5b2ee6d5e4f14e56a8c8235c0bac4a30e35a1ae66026ec49d9de64f9ce163
SHA5120a13b7d4d45fc5ad22b87041e7113c381385186770cbc4bf050bcb615ab91890e46f72341d1b3bc88a6fb7e707e367438a315aa0396f847ba09c7376bc19f27c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e91cfc68987138a12fd44c5a0edeba2b
SHA1a4d47f54097a6a9893a960ba15632f5f7406a2fa
SHA2560a93bf9f2a051895a7a0049726a726f03ffc810ae3cfa8f559a928d42f83d250
SHA512c41b51aab3abeb970e5d5a868bd9650004ab5a5bd11573f56a0ab26785b4c4e7c8ce2c2cef117f237bc2c5c4c2edd2c3b96c32e1f5482dd897d3766c1faa35c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d7eacce95e1837f4925728a5a7f86436
SHA1e9e8ca510c76deae67a539541b334c5c3dc7defa
SHA2560b1997d2b0b61ba168f8743422d7dca3dc863a7fc18bb4ee19aa78f965f3c82c
SHA512d72f4a8c024a3cefe78f1802606ab84826821d1f296bc130db8d57b03ea261d68769c71ee19f2beb62435f016e48291c8e86043fbd46cc510267e7654062226f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ce0a9480781979fd24ecd6685d2fda81
SHA14708f445be10e147c4599ad14a6a9049cccf0a49
SHA2564f20340ef43c1519456d9c737517d209a430e4e5e8f9b16ff2a66e62d32e10bf
SHA51229bc16866205c08b3e6770c8c80788a2f90922a6460e18516c645ad36b7221853fd8879172b8b229f734675690fabdab96bc6843d2796d4a822d97544bb84178
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53d394fc318dd4424f787b8453c44d2e4
SHA18d7896ea60a4b9e893a29a35c64dae1b31f716b7
SHA256c99524d26959f83b44b8387f14414fe4f31f9f29bef14c73e98f1c0b989841b2
SHA512fc089d550d993ab9531a6af78e6cb703922a9e443d56374147bd4fc52b57641e648151623c586eba7ea7cd54ada77b870e93e62b1af2af4f71bee55931d83a9e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f03de826ca09dcef8be4ae2ac0a747a4
SHA1939bf15180112ab6936ecda2eea222e20722147d
SHA256ddb81a1fcfad21b3cb725e09c7a4c61f054a3c60ee97ab838f123a156413496b
SHA51268627b96e03a1e369fc72311da7a4413c77ae8313967f002b8db1507b066b38bdf16a6d5a49bf5f202dcbb99b08b18ce17303ecbb504cdfe3d5e09ddc2d13945
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53b953848379e1a640f627abbb440477a
SHA1892d57b68b59b6859eba87e886af390912843818
SHA2562464aaad5f533713e20207948830d777bb4cad57603ebe633596a97d3543f1c6
SHA512daf3248e4b2a49f54886be19d5993e0f3b57b57a3c6d70f5b7dc9cd4ba6ecbe5390615a3fc0ce86e74341463ec4fcfb57c4e137d1543ec6ae26068eeeaf162ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD583cbbbbc0520cbd7070105faf07c505b
SHA1ee975b6a340fd3a4899e3e1d62661ba2ad0c4339
SHA25610a9d45fda5c6a193aa66cdfcb7db50af156db6bc582b72fc5a930bc5fd1f035
SHA5123a7eb0d75e559b785cfc647f44d1f497609094b742f410ddd0bca933ac34b8f0fa32bcc0fc6ac64fb6249f47b78fbce3e098fc4b4e9ad9f1c8693c13dd02e358
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59ee45e1690f1bc5ec5d4be9ec9d7dfc5
SHA16be7191a3e13da971ae6412ee76ca74fad630bb0
SHA25694c5a3f5cfbd6a154ea10764643a41104d419b2ac6cf49c6c4e8955fdc3e423a
SHA5125eb833606fd7d4c0d736aa0d4c864b13d2e201b2566d0375ff4ad009d2a70696cd98f4029b4716528ca0d90cd9f39852709f912105c9dec31339b42bea6bddad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53b743b9f50cf409f067b544763c116e9
SHA196b0094ec491fccbce5c394a12061c624cf8904e
SHA256680eceb85603376bc52cf90870236bc5372659460ad80ef6140aac9422862442
SHA512bff3bee4274ff4dda3f290dd27bb082e994bb96ecbe93bd29488da2235a29f63eb1d009cffe34b48e025af943bb89e80ff7d20fed8fa12fc73b0fe897db25b31
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5726566f0aa23126e820a5dc90778a6b6
SHA12ed58399d16b95a7ebc689cb432b64c742d75a82
SHA256f5387a81b886ecda9311ae747e9bf9ad53837325d747291b9a93ee9169c39b55
SHA5128a06c6f48c514f710f83e195bb31caff2677be6e5d1c23ac058c42e73c158c8d94933a8aed8008c6ac98ca82bf4ba8f4bbb9a517f7e6e6f73d92e634d78bee76
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bb4f435b1cdbd7d2ef41e39be44e4bc2
SHA17f4af73ed1df45009fc9596fa121e8c87c682a68
SHA256a5e65cf6e703c1c3be3edc223fa2e594234ccb9e4efcac01036422e37ff65ca7
SHA5125fa5e302d9b49db97d61c5207141921d21461b4de7c60763139ae67529a3dd3722857799ced7375748919e4427433a65ee89233b110572b32931b208aff5f5c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cbe30dfc0d08587c5d6aba9d81633a10
SHA1872a84a9e241021a9a2c7fdb77c15d0cc0aa3851
SHA2561ac6213b43248927b57bf9b59e1dffb9983436a14fe0e7b71924c9812503c96a
SHA51228126e7367f5941bb64532beadc61db15ea0ab36ab7f837c403a6344fe260c95aa5776e0b5eaa362e82d1d5901be9615e2bb9aed9ee2195cb32cb789045f9bfd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD595cb36a5f66c33027cb516d5a4634900
SHA108692949bf96337b2b829b1fbdb2b76faa7c403c
SHA25681307a839253ea692d247be2515657dfd2667ddda33f0b377e96441aed5c4f79
SHA512c7001f34e1304c0afdbf524e321bc541f45577f7d6fb538d6ceca620505da22b941226e3030161f7b46ef5b6b8858e1053bb6ca77974b71ecbff0c9602e85582
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51dd57b85bb192254a3e7915ca7bc8645
SHA128c04474160f67c2b67c8f83baf08ae63a985a1a
SHA2564c3a1dde505cf4302aea942ca9c165c1cbdf7edf93e41146d6b25c0e96d4dfaa
SHA51220eb5d82d8ae7edb24d8437c307cec8b2e5e6ac05f42f5721cd12da11b6fac5cdab97b73c1f4e6f9b67e7c53f0c8f267ab7e74e7ccf5f7b351762f64ad8e256f
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b