Analysis
-
max time kernel
119s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
01/07/2024, 08:05
Static task
static1
Behavioral task
behavioral1
Sample
1a892620ac8a158e0d0c3ac9419d6564_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
1a892620ac8a158e0d0c3ac9419d6564_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
1a892620ac8a158e0d0c3ac9419d6564_JaffaCakes118.html
-
Size
91KB
-
MD5
1a892620ac8a158e0d0c3ac9419d6564
-
SHA1
00a3d0cf51d1fe45836271fc8c461f25ef1af257
-
SHA256
6c390dd659380c749b361cd824a424ac115a5ac45bbf15cf8f8e08003111dbb1
-
SHA512
f7e3b0f7825dc8b6a4a04b947850a325f06a87f432b0dad19527fa003e6d7dff532d2d255ba3b99981cf53757536e11639246b8676a19984c04553c5d55e2d4a
-
SSDEEP
1536:B62R6u5DWE3i8i1/oe/l8+uyH/joYLTAN45hATJSYTJSZM4Gjnvlr13dM:o6330B3RYxbh5W
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B1E38411-3780-11EF-A3C1-4A2B752F9250} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000d7e6b99385d63afae79e68c6335b40740b00155a3984a46293183cbb7027683b000000000e80000000020000200000004f78bb7ec13feba8eb13fe5eecdc50bbe865a629238616a40c35e2176fa5400e20000000173e002129559cf2396aa872905e25d7441ceeb9f8b85124a587aefdab57525f40000000e00e585ad9336b8d76ddafecbe3bb12fc0475a7cf5317e5bb87592c4c63dd2a085e13c56fd574f7f173a584693d71233e931b5a2f75a4df0423a9336640b1651 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00d39c878dcbda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000002faff5f1af5367178ce61627edcf22be20e678dd28ba047cc9dc0b26b0fd4891000000000e80000000020000200000005632cb4ab8dc0210210f97fc439f4ed6af437ebff20b2e734ae369358e1557fc900000009e9c4a700e3f863589f3899214fa3863b7e47e4421f5cf69c4fdc56eba81f10960233650bf4d1b11c7715d8b0db0a464c3b6cd6eb77401aa04aa5098fcdc03ea457d08805209b921a9cc2f0aaab813403d64785c90f08e2aab589085012e8f3cf719e2379929385e503f526ff1032ccca82996b741c2536fe22b97f412451aedee33db62724e2a47d16d58c5a08ae94a400000009a0aadd074018e6edbd058bcfff09ed729d545704a736d64803674c534fe6593df04f69911a485839b9950445170a13b53377b36d3739146cfe48525f09fb503 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425983004" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2084 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2084 iexplore.exe 2084 iexplore.exe 2144 IEXPLORE.EXE 2144 IEXPLORE.EXE 2144 IEXPLORE.EXE 2144 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2084 wrote to memory of 2144 2084 iexplore.exe 28 PID 2084 wrote to memory of 2144 2084 iexplore.exe 28 PID 2084 wrote to memory of 2144 2084 iexplore.exe 28 PID 2084 wrote to memory of 2144 2084 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1a892620ac8a158e0d0c3ac9419d6564_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2084 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2144
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54ed9d594510476ae2b77de7faac1b294
SHA1b01f94e8eadd4724566b7f1581ae5681ebb36b3b
SHA256bd5be48627dcacbfde06ec1005473bdac1fa8e7a2f55b81e815ed6da0b4a332d
SHA51267b16affc0a806a3d03203b8c870a367d786630a6110006ec00ed134b971ce92fd8b0313e8b5783e37e2c4d33d2b7078ee4c7221aad4c8312a84c451ba5184ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ef7c33100ba3b8ca2d9c41d6e03eace7
SHA1a153c28ae966338bb34c6a9cb238453862cb4391
SHA25655e895a542fe181d5664763897f7681d54d0be4057659f5e721faf28067f10ad
SHA512af9796b66390e5bb3a6367b6f1e2265a9b7d06583bf8b4661f883878fdd6efab2a5c1b7c6b967baa6d7da4152a3ce55d8125ff16ddef91dd143bebfb3f08ddeb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57be23dfdd96e4104de425894837e9b74
SHA13a3746ff0e77e5d9d1a0c484a98a2332be3660ed
SHA256df9ab58fefafe72c330ce11fb2ab5920ad128cf4bb2beb4fe731d94a04e7b5f4
SHA5125e6f0f736a61967e2a54bdbc6f8297a8352c1589b99d65b88442b62a95fc1351e505556a0ae7664bde1da8b134178c31e8a3b9b44c3a71fb3c3ab1858036c56a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5152df1d231ac0621acea08f2534ec63d
SHA18039f9c51a9a20357f07c753ed33ec3959b29e79
SHA256c5f927ca08f5bba99e23c30a0a536b8896aa47f9a4132671ea5972c02c4145a9
SHA512f5c9513e456ceb9bc3179ded8857ea8d2635e369c34e5cd3d527d0b0fe9a328794128e4019a5fdaf32b13ef81ec76502e60b1819f8e4c10439c15602e688bb91
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58dc1c87a623e6064c657e41e0fa12d4f
SHA11a3026d7bc917e539f3a8982a8067f864a3060be
SHA25614b2af3cb1af1b05183ad0bcc5d4b222fa0854b74401aaf94c37b9f79fba0275
SHA512ce57643853f624f3227d89514cfca367400b90937a0b1e32d5d60211d9f962f52072e054626b825209cb45293b13f9f64bb273a7ed1fd67d3e7e9be07cccddef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD572b5b2d82bdd8e220725451c6c65e57c
SHA14ad27e5f506e0e0080ab19857ee1700ed3e54c8c
SHA256560631c0064a398606703e0f0f80df8d4f8070f83e59422149f583f846ffdc70
SHA5121a2ba820681295a15854452dd7e64ab65be7f53376d4e16a9c95a9c9e4edd094efc7f62e75fc311f9398afe0b4792f7d1372299ac92839853a888c0e34796c49
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5deb3743ddb6d4fcae65b89226b7b9654
SHA125ca82ece1b054d429c57eb4a489f53cf69d2e1f
SHA256d2836b1d9df785dcdfa8a893fdb3a8ae7785ffbec3f2873a340f0132f7701f5e
SHA512881447109643fd16d5ee9b0cbdd063952e8532b8dc3ba6de537f8d2a9229b49092e6fe0765e71ae27052cbb8449fc1b072a563a2068114e3a33fb8d45bb95b0b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c63da5fb37939549422230a32dde6020
SHA111603668d44ee2bbfddb21dbc61567329db7e96f
SHA25626c75e4a4171f77c9b230393f7679de882f6f0f73f862582d753b56c19b3ef82
SHA5126df00c70cace47a7f2dd0fe0b1621bcaf31b0de2f6e8d7d94a41a747f20c3ac54e202a5aa18927f0aae49d2a2d4bbb68dc92e237db09002d842f78d82294895d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56504b3e1d78d6bfb604be65ccd26fe3b
SHA14da25068f5036bab43766db6409b6582103f247e
SHA2561c5f4a106bca0fe08891f0fffacb7f526d01257f196f1f144af07e3ff9be4e0a
SHA512f3f9148d69facff18b042ff75c7f6f8ae01e1ef951ac31242fe251cb46c57e5a94491c67842683a422423acbdb35348dc8c778018e40e3683b3e9c9fee6e0518
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f970b270600ede731cdec623fc322e47
SHA1ba8503df5d63e9bc3f3a132a7acc30897660d115
SHA2561e7b5ec9fe8939a67689c6235c58d29fb4d7fc6cf0efacd8188042333188f543
SHA51264341df9d952937c191a316319c8c88fdfa2d7dd50cf2274a61b5393276fff4140c7c59dfe2cda3c5a1348bd67f6dd4b6b23a2363c9880a09601992b7b20f8dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59bd84e6df8cd00cc75bad1b7da8632b3
SHA144ff0fa47aad6e3279470ce3891ad39714114bd8
SHA25610c1319a154a06a9b45cb4f5b301ca0bf8244f10b85acb99d85def98a3d67fce
SHA51235307b249c7967c02d246a2844756cda4aaf418769e1165ae73c6799d589f8ec352037ef1747270ef23b67aaa2d2fcc0a5ae21aeb5deb9c6d07a2696bafd8b7d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d79a445d38d006f700bc0ed9afcea86c
SHA17efd14e1e43998814383effb53bc56b7216ec1b1
SHA256ceb99eb9a7d3e9a907749f960b6e2bba2dcb52b7e66f2fbfa737120fd953f9c1
SHA5120ba907fe738ebeea1830e3dba3f7ffafea8e475d68377902a39580a8a4d67cb4192d864da811503fc1b0a2237126af59600254007062934f1c08001b3caf0da5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55cc15415d49f9e74060db6c746e1412f
SHA14cfbd6906535d8d9eabbd32a81ba891a771559c9
SHA256db913adb644f6d97400299b59f32eb82d5c5dd3a944763edc8f84515a1e1297e
SHA512dda381077c0cf89304f26657781f2aa97b34ab36a183a043bf59af220af6fd3675a3dce018a0fd86de46aaf4f316cbf289d54ee66c5c5ac98ee53393625746d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ed4ba2eaa1a429a4cacb0dfbae6cf2c8
SHA18e36ccc08608db5bcd7cc9b780dedfdededcadd5
SHA2565ac52ae45e0c11749ff97203cdeeb6891035eac2a2f05124d1948169046d0624
SHA5121adf42c92867a1f7355ed94698a5e1a5401b80b04537bddb0b0d88e628a6d9fe9b53e1bdd6c279bb30cc1f64e1c16f2a4b6a4fdbff48ffb4036f170c7c6db608
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD584945a94660839de57a8ac80f43484ab
SHA195b98e59d19cc27f012800db87ddac69ada2302c
SHA256cc1c7ae7c79d48415a8f3fca709ac81397affb3eb0311a320e5dc169dada35d8
SHA512bb72c9efe5cc0b5dd345bd94d527eccec66bb4b089beaf6e114b36491f80bfb68876c3e441448b60dbeca0cabddd837dd9cf338916142fe8ec43184864164214
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d1efa9d24d895513b7d4fffb692d94bd
SHA19c45708acb7ebbc0716b87be5ca8a74860fc7e00
SHA2560d04b7ea525a003647f45a364d318ea5fddeec5308820e8c015ab0c7f3338024
SHA5122d5954c33f558bb8d24150b6d97e1de9d8ce84a280048fb2918ebfc4b2361fe1f8c00c494b6cb0f4b024afff89e1d8e151af1d3518c7f4933d8da8311bede1e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b39978300635857de6138482524f1dc9
SHA19a89abf7a3f143a01c9aa9eced4433ff96508a1d
SHA2567c864dc720915c5b04a062b6dc9ca10bb486b79126c1ac24ff846ed0af6caa65
SHA512b30e4be786bf195a2a803624d03cac48cf2dea4cca1de86b7fd329001c1c41e077c78e3bf8d06a233780a9e943556adbf1bfb401a47e7449d7f0ece883d40012
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD500019719ace9c30111d9cadbb95aab2e
SHA133b4009bee69b192c3dc38341dbf436c8bd52527
SHA256de92fc2314218eca38f9e44ed76c10d60ad00802ebc06c428a5bf58c57b1bf22
SHA51205bf1f8bec3f9728914770593e0e006475427f64ccaa6ae031fccf06c4c4ee49d103c376c6f946c910802644aa04cb0aacd7a124d4d08349b3d27839632f2584
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5179b7e91636441ab3cf788f63859b12f
SHA1fd9413dcd7071644011ff0087fed16c136437ffa
SHA2564737d65546191392b24b8794335f75a7099062994536f8f1399a61bc3d1f6c4a
SHA512a982a75fe891f4ec33efbbd868439b05b11bc9311eb8b7f0c5633a44472c346eb324c4a12bab177f0b597c5e6cbd622ec8ea0b6795c875b1849f4936f89c2dbc
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b