Analysis
-
max time kernel
136s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
03/07/2024, 07:21
Static task
static1
Behavioral task
behavioral1
Sample
218393298295b6ce81f2d6df5e294983_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
218393298295b6ce81f2d6df5e294983_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
218393298295b6ce81f2d6df5e294983_JaffaCakes118.html
-
Size
63KB
-
MD5
218393298295b6ce81f2d6df5e294983
-
SHA1
eababb97ceb3f34a4cae02bfda4a763ab83fd63e
-
SHA256
c4aec7483b648f48aab7f646fce21f6fdcb0fb6d9bcc8097f38caaf2e4e36d63
-
SHA512
a20dd1cd4a42d360835076da58e52fdab22a99d2a9d24cb139ecaedffd16f0901f32b1710a2043a51a64866d1e81a6562efd7afa5925b402786b72272ac8445a
-
SSDEEP
1536:JR54gn2/CKI7n1IvpNnD9Uutlsa98fPrOzAta1ddKMp23E77Y:euxIvpNnD9Uelb9/7Y
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E2175F21-390C-11EF-B848-DEDD52EED8E0} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426153165" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1200 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1200 iexplore.exe 1200 iexplore.exe 3032 IEXPLORE.EXE 3032 IEXPLORE.EXE 3032 IEXPLORE.EXE 3032 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1200 wrote to memory of 3032 1200 iexplore.exe 28 PID 1200 wrote to memory of 3032 1200 iexplore.exe 28 PID 1200 wrote to memory of 3032 1200 iexplore.exe 28 PID 1200 wrote to memory of 3032 1200 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\218393298295b6ce81f2d6df5e294983_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1200 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3032
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD579c9a5558f4dae0f3f3c3ba436e1ba20
SHA17c0d19871af118ac415770dec90a2f4a7cb2ac18
SHA256033df2525ced41dad695d95c870c4457bc61b172b05d6801983c9937bb681998
SHA512b0fa62ce77eba2e4620fd595caf5e5a945cf8137d147323482e975f681722b7fe53a6680a37c5035999df7f5619c587a412a244582373bcd8b8458f8f3dd3bf0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57230f11e9fc5de9e14de82f15f62d608
SHA1a2b0a5781a25d5d27fa5e3646342d46b58bcc848
SHA256e5bf22f30ec27dbab98ff2fd59e480a651b03029b962d6bf3a478518ab90c3ef
SHA51228d0a566baa6dcb7de4bc4c30ebbbd5f75903e501676bc619c50b5e9aa49dbdf6aad025a4ad8faf3802d6ac0b77f3abf5e629e85c8a387be1996c9a15902ec05
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d2bc1957c9a7b0e152683f1201b5ccd9
SHA16e09295effe8d35388cc6a071fb76c4e624b06fb
SHA25669bde97727307b8e213a841447642275080450c4e7185e7124cd4a2edad9fc8e
SHA51254e983f458a983d222ea97e8d21bf679931f56b5194bcdba59f0a89bab86c00bb8f692dd1f44af33abda3d3fb9c79382ea0f20c96ff7476337bf6f6c4c83dfd3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bd7611507d66858b9b4873128c352bf3
SHA1b2a2284f771cb54f70886daf6339a7a2eab2ca6f
SHA25603c2289099ebbd5569af611151777e5a13e387b2b7078f5e04c60876d40a61f1
SHA5123ca2cfb2f9ae4f56a3616dd032035086ddb27a52b61a9deb2987eb28eeab5f01dbbcdc5058f67e0429812d5d10b7c5e4e9bc672a791db4020ac40122a754080d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD509e82f235bfbc9bfda9563847f925717
SHA15c8c74c83465d4abc40d8d18cf565f34593c7493
SHA256f69f5e70f39c355199c1cffd195b9b8d88937c15a7998391762a784eab371652
SHA51274a0f3fb5c38a0e7d4902bf4381d959333e0775e45ec502c7d5d9cb68dc7ecda0d26a5b564d367ad8c5b61ff118746b2a4d18c50fd0509072b07793dd617be4d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59768842aef555de6be6abab9811d8276
SHA1ad7f77541f3f0640e7c412c74aa42e5c24fca11d
SHA2562fd7835c56f118f22f25feba7d11927947b71f473dc7ca58e3e690dc0440bc39
SHA512dae612ca76aebb637175fd5059d546b2829767996cf91b461555f0b37f401d4d7233e1da5ee40b80e0acfa89aa18538a72fe5f0e6d57c9cd292d09ca5908758d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d47f337554fd3d7bda652b88998b43eb
SHA104d7ced13f0374aa029bfc8cbb3d328624ad4d2a
SHA25650a9ed8963a9b03ac29fe1c1e9c66881a1a5abe56b370097c6403918f41f2570
SHA512574c07b6a0061408706d27e0704c10366f9639a28599b612693480e62488f0e81151cac5210ded68db86542108935ad438c0d7efc8146ecc36f4361fb8182c37
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51065ed20c8ed8d63cbed92ca732c846b
SHA13e0cd128f6836859d2dc105cc6c0ded5052cf648
SHA25615e1e68eeb5677c200fde12d08a9bdd57084dd9f58742c71759904eb3de23b57
SHA512ef458ce59e0aab6ce4b17aba369e00aa2f3628941d470bf4b2cdf3a87946377de2c10fbed4e1fca35ebdf0c31340bd896fc659101db3e8e74813515507371ab4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD549d05e1186321469c8d323e42cd059e7
SHA1d263942499172159b0c0581d434f62e638eb8c77
SHA25685a3cb4a88e7267639a2a20dbdf2e00f0bcc8804a981cea6eeec6bda819fb90e
SHA512105e6f940d449ba875535a5a04756c1bd3f7a6372ddfb8e311e8245053c13efe631c44dd517d8fb1ec947be04d1517bf82e133b0c888f71c77c1090f68cccc3e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dba1246bafb9a4ef6d623b50ea42dde4
SHA11466c4257a92a741603f8aac99d876a5c490750e
SHA25695b821dab5ed9bc7fd2bb2d025204f87e510e512d90ec03c6051a36284087924
SHA5129fd1cc553afec2e618b49e08ed486438b7357530c8e27036c98ae86a7c469d2e494ac035f8a6bdf4f90e249b4684bd0bd38739204d954fbe6d32ba724f7d5ac7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59e24d143159ec09c1d75af1a61667b68
SHA1bfafad1efadea14fab929928e1b45255f39692d0
SHA2567fe08797952b7d46c495912cfc4c6d0659ad8cce7cf9a478a58024325e19bfb8
SHA5126f5b64f3b6d4bf67fb88ae8d0f7ff9ec943f1c90b2da1e6246dc8959b39716cce1d25f573c12c586eb9905500ec0373fd0bc54fdc731c9db39077f03b29fdfba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c2ec8a251019fea4a731812e088596f2
SHA1ee0bf5e93c733bb307d564dae08a1a6639ce912f
SHA256a9c764ea6b58c9f338a8bf2136d6353b38b7bc7fcaeac686038d05babd68fa34
SHA5126a92c63bc58d8d0c00cba834b9ef5998057447a64030e6e6944129a3c2cfd0d409b2276e9761637a5f5d4c6fcadee0195725d1a581c8496fcde9f0662d663cce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53b252ac5b2fbb1108df87ac31020ccfe
SHA15247bf024447393fcef0119898676f5fd2918358
SHA256dcd8f96504b72ad11837846470a81c13f37eaddaaab24d6d4f8761111c8cd177
SHA5127bacfc6e45dd2430fc42cff79e342421aa555f89bb35010a64d7f187d8b31691f84d807229934807e84f0d365a2b04251228a143786b6dcfaeed238b890b75bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57bd1bc8eca63911af900fdb4f82fff3e
SHA172491f7ab2b4d8144d81c911ce076f0d7b796d9a
SHA256c2424f2c42f727b868f9c0652003ef575f3b2aa7ff5be7b557cc4209508fad99
SHA512567a4c8b3f3b1af745018d30e5afb3c02859c761fd7422113d001edf85d3fbba8809aaaeb7d61f0dc5df9dde05b3940c16229f141343f8b63b4e14a90ab168c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5399516f25f9cb5d5a33b31aabdf64efe
SHA19c9098c3f01a658ccef1abbafda26a9aa5f9e8f0
SHA25679dd85a960692cb49c7203645fc9fa349d4b18f096da80102fc50ff96781ac62
SHA512ede483c30729a1560f88b6391a7443bf82ba0cc77701cbf477a5d1f3ab6c7ed1383fa4083cb07e2fb704d7865a98b5de9c7af0a92dad32ba95b026aa7cad7fb8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD541d9a0f7d5fd75a65ea3f402b4080341
SHA1290c1d3aab6c1ff130a7a439aef8621b05aafb13
SHA256c250cc99a46d66c5f6e5885484e56257e3085ec285780c70cd016177924406dd
SHA5126b96f93c8e5ad72dae40d1cb861b0d08329f00c4daf414621ba3ed0c54d88355dcc12f142273fa0d9e8abb6b4b7de3ca3587821298c9c6161840cfca0250cd23
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD563b151e5fe68762c46ef97907837e94b
SHA1a7b0ba50f0f0be821cd0295f2e4f7a2582b8594a
SHA2564fe453a1d08874340e7b7c104ac6993509c608b0a47dd99af8a39f4aead6fb8b
SHA5122c5895f3402f292a19ace5065ffb3608c8fac36674e7702f18889e4ac367d477ba373c20abda658f3dfa5297e1457fc7545fbfc54c4b3f0a17e136f0254d482a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD504a412a3bfa41d835a69287523106697
SHA1387b626bc78d184d7bbeda0e2135c92ec6c99f70
SHA256a9699a67e2b532f18de17a414936acc96e48b18441cca8f681f6aa0c19ca9136
SHA51269a28499609080d989f4663681c245c6538756bb4d0ab0db43b0d11e041f81e8c50f40d75ec9dfe127319a8496102ef41d38422353ecd0a9537fc8ba7471c2c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a96980221503bf4096668c78606d26a2
SHA15fb2cac84586a37ed800ef56e6ddc810b93cadeb
SHA256357101e3b080cc0e142225504a9df8e4c655fc9618f6036835fea9636e5621d8
SHA51299ab7a1fe024d157b80632f469ce8512a70da229952beffd41f5aabe6b2b23db919f137883f2f97e3e2c77b90d6ff1eb48cba9e61595ce52c59358f1c146a5e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5beea7dafc2b27f5f0d935b9a45e71db7
SHA1e75d51424f0e743d75b037d115443df2d3a0d320
SHA25678f4677289aded2d2452730df63af212f8164ca16fc7bd5039c40b93700faf6f
SHA512e4b815a285b5cb23c4e8da7d9aaedff1bf383f82aafcea48d2c69dbb4ba020633ff35b9236eba75afb31c231d4780f5774f57d0e9ee1986745c8d8f5bd42390e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56d2fd730431f4cdd3763ab2b5cc6e8ac
SHA11387e02c23838ea98f2cb3b9ae9acd9e310c3a70
SHA256eb3994101df08e0c804a61d7b429c4baf14e7cb84b1a3b08c4829338d6c65ccf
SHA5120b22a26145a185fa43d7f1679f732fb45a6d2f7577ba42e336c90dccba840be8b89e46dc142f1d0f49e39bd92a40efa9e98c532b48e3bd08339c490a7c1b3463
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD571b4157ba70f55f623d68a53f5bd3453
SHA11950297d7c1855a0c12c9618265f579fc57dfd43
SHA2565f84248b68c5f393ea2a1a55bf86468f09d31580567e947e6cf680135b6c2f00
SHA5122c223e5e8859b285abb1130b07d1b7d9660d924d6a951001eeea0afd11c4a2f0f6597a4e9eb4e971263df17029d645037b438fbd5a6209ee9a88723743e20863
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54f1c1a691d079febea6025ea11b58b28
SHA1ae438387f427a50a43db9bfed5a0e6c77bf9f6a3
SHA256a5892a3836b692310314c996dec256aaab30b77fbba4a716e7348c3efe4f59c9
SHA5124299e68d60de8a74bb2469b4804982b4c08661a7e1256debf6d55aaf161f40ea10f563fd29d240d37c2ad11aa5120c2c8b0ef97df675fbcd062c6fd50197a9c3
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b