Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
03/07/2024, 11:56
Static task
static1
Behavioral task
behavioral1
Sample
2250091ce559da5e499a46012c87fd28_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
2250091ce559da5e499a46012c87fd28_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
2250091ce559da5e499a46012c87fd28_JaffaCakes118.html
-
Size
73KB
-
MD5
2250091ce559da5e499a46012c87fd28
-
SHA1
20980201392ea209abf44fc2e7a87a0e8bff1143
-
SHA256
879c58fcc822016f0fd4e72d6c16611c350c52df87a0f50b59895b793d02c545
-
SHA512
07529cc8f440fc858c7efb47defcd0c3960c74c0980b8c1699532f93b948ef1e133d099b7ebd0d70f2a25dbaa9cdf49ef8e60172ed96b979fe699466eaace20d
-
SSDEEP
1536:8nNiGvjf/a07Yfj4N1LOwfwEUyt6vC1BDhGVudBQ0e/EsFz5dxBiNR1Iik:8noOaejOUR1Iik
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{51EF7E61-3933-11EF-8132-FE0070C7CB2B} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a03905000000000200000000001066000000010000200000002ee393ea9e50b36bb2a8d5b98ef9cb42bb94dae3ab332a4eb55fe406d385a635000000000e80000000020000200000002c01b0956301b7d4151f922405df35b7e0836cedea2061e12b7580476e57ccda20000000f5a2c65f6a27eee120f231cbe24880cead7089dee6de1b6f998387673eb6e042400000004216dd886faa13c2d71a89d2dc1c16934e9d32f35a5aec5ca850cdfb2f95b5c3f8ab9511eac772e983ca28660b3afa1eba8b5767409ebafaabee0de8490993a0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d043ed2840cdda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426169672" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a0390500000000020000000000106600000001000020000000eb88b40aae537bec3c317a450d93f39a0db65a1b44a8f971d3b275b898fbfa63000000000e80000000020000200000002e60b458b968eac5318a5f9c46c063683491ad563d989e2fc3e4b75a34f1883f9000000021b2d2aeadeac81aff5633eca9dc7edb06b4a86372bd965be2c08b65da9c8a7a06f85be38ecc8b7c6373677351cbec3302dc3d315fefad0a35563a29106040977cf50221574d66f53729d72fefc6453b5b7fa1989fceff066087211dac766f51d88461b4b3304cd68d662630666fa46beea2e507637090b4e40b71dcfe0b18c4e9d2bace1536ecabd8996ab6c4914e5140000000b55e1b65b5a3a6b3696a3f629f53cf57cfb376d6e7b7117fc65548a0fb03d528d943c21d9551d91d24224cf12354abda38c1f17405fc73808694e1df7d0feb8e iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1760 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1760 iexplore.exe 1760 iexplore.exe 1968 IEXPLORE.EXE 1968 IEXPLORE.EXE 1968 IEXPLORE.EXE 1968 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1760 wrote to memory of 1968 1760 iexplore.exe 28 PID 1760 wrote to memory of 1968 1760 iexplore.exe 28 PID 1760 wrote to memory of 1968 1760 iexplore.exe 28 PID 1760 wrote to memory of 1968 1760 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2250091ce559da5e499a46012c87fd28_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1760 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1968
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56798cfced23de4604d3e72f1eabfaf2f
SHA17b9bf212ff5570fe9e858bb5f4342f658ab5a658
SHA256f164f2e242ff10b040014f4769dde533eecb0024423611e54de3b22e04c3699b
SHA5122078d49cd0ebe232be6e6939fc053ac4d17f9ef0a9216759c984dfef44af406408812a91872d5bcbe3c276f4362cb76fb71435dadb3a683f6f249589b0d1b861
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50009e230feee7d5c204e398416c09f7d
SHA16f48411c41a50108e4f1bf685b991c4151f62e9d
SHA256ab4a19672823553a5bbe0bbe5c2fea73f93c5142e3e9271f0d88e1117b959f38
SHA5127734f109341788300073dc9f089565cee8b3e70ae3085b9441efdb75d242abe9f639e6923496876e07c62b05c107509630e1ce967b05f3c6cc02687ccce29b03
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD544a3e04b9271aa10eb93ecc4b85fa77e
SHA1a96e92ad867232cdc4471c37211e961c79d3ff53
SHA2567b8fc04da001227c48c41b2a72f9b2d94bf439c92b10a761ac5fe52863a289d9
SHA5128daac285080f5925b5577b7378cb749119def4727e4d92866123cd9611dce7b667d8f5d81b5bc32f27659683ca466d7e76bdffa21aae8ce7872f869340ca6fff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d687830ad04ffb55d79598a56b4c8fca
SHA14fd7abc931cb5d1d813ba0861689e21e621870f8
SHA256c08e5f2aa98683f4c10c4055d0ee801304f89e66cc76d1418f739f451005b701
SHA512bd74945a40ac71e4deae266132b06284e392a79bd64838305c071353d2fd3263094e88bf6e0d936740067f889ce798b7abd0f80b888d9facbeef69e3c69cabaa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a9552a86c139fc9c1eb70f1fe9129026
SHA10942df6819ae64e7a79c67d72a3a4cc376a48ea2
SHA256d2f56206634b5be2393faf32e6f31aa86ce1f37ff28f98a55d63bb92ac05ec97
SHA512f581ccb873ea3e7eedaebfe5fe2787de76ff3dcf9241fb346fccf82fda4f5a250346150bf5276460b9757f11fd2ecb274d4cb14ac4e5f1beae2b3b02fdd3d3d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD519bcf5ceff24fb34ca7fc12306de9402
SHA16ef85c1313b5fe61a2a5f598f83e921eeb03a434
SHA256deefe1b51acae6ba70287c173deb4477f64bfa0f8e10fea3beb653d29e318816
SHA5125e05ff104e11d8884bbf240bc819923889227ba29730da2c7816ebb8a15a34ed9df3476ad2a4ed0d8bf09fc9e066fe8961c31554c79ee65554d136b057e6cfb6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56b71441e1905a6f38656fb228582a387
SHA159ca2ab7dab6063fd8730bd092a053e95c334481
SHA256e12a159ee07103acd793d40115f6188e56a0358029c07bbf388fb3f162692807
SHA512b62fb63543a9d6e721faba82e0bed2dd23715539ed94698ebfd934ec8360d375454596ea16003cc4984f4d73e887299b9825fccb5ee4b0d5c2176a9e3a16e43a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55994698473d844dd830d59e328169e15
SHA1b8ec1a0143e9d5aadae884f2dad0a437d2099b7d
SHA256285dc4a7f9d0c4f2b8354ebf6a8f659963778bfa1416a8b336a0e1bed3503d40
SHA5127ff4c7371302578c244ef2b74f29ab082c0812b57d29e9ef0a5d58cfbe338ccbb1a4a0bc1d02ce1223f7561681ef17ae2fc12bf3574bb230dc90109c5309311f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51019f696c2b25d24a1a26a551599289d
SHA16e0bb11a48c5e8e4f5bff9adc3cd8c8f17865818
SHA256f309cca1982437981dd52a8eae83eb75f9770cb5f38d5a5729957b0302f369e9
SHA5123acdfe13004f1355ddced6863ee0fa0ae4f492f6526967cb03a55e93062b8e72b25298ab08db3113ff19bb2b0fab49b5d274bfa69dbe44faa90bd444088e7077
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d25be0dc57aca2733c3bc14848c59192
SHA1dd1cdf564d0e73ed444e1cfabb6baa547fda5490
SHA25698a33bc92196e3fb70ae2743671a3d2b55df0770a1fd032d1949cddce1a3f53b
SHA512e48269fd12d0a124a45525d4650c2e351d72b0ebdde73fa9b58d57920f75ca2ef6456ad3024a45e11fcbb045a7c6b9c9776af9dbf7cc59efa2ff82fd1b3e3077
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b291bc67c05cde2254fbd3dc4573794d
SHA1742d7080f5372dc7294a88536288f83ea546f870
SHA256462941d93abb1458f8186526ddc900344717b5a48a2040ec669b1900c8d63b69
SHA5127b60d0cc55261be43ef6b16f64e52562ee0d50230e4f34f291e5e0fdd4bbe2fb97c1847cad314bc9c6301369f04986ea3afe049301f6434c63452cd00c043a4b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5113187b2d0d425722e41ca599ce0f784
SHA155689973dc4be96feedf4eab40670281e670e0d6
SHA2563c7c637f3f6f704a0b4b79d34364c09b7863818795823ed61cc686893d98712c
SHA5123b516d422c3185dafc5d175d34aaba105207cd98ed01b11b931593ca0e3950ac32436276f99478621fc24d8c5eac87ae29d637996a81261af35d80566370debc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD513d6bd2dc9c88c2ae12c4539d5c8af84
SHA13997ae3061727d5570b53943cd4a49b95f0bfaf9
SHA2563d63380a214e1fcee637c176c334a7c28d3e6434ab25dcca438d78df450e75e9
SHA51226b9832e81a8e2b31c24bd194a5f90c3830b5df8afa6a5f6fa5404d622721e9711a2032e74497c547595f810cbd1c7df6c279f2a19d29e3dba575ba08a5708eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD552c9357d78f67545acae842c005e113f
SHA1a361046c21af3d076ac75742acfb2b0e81a2e8ef
SHA2567f31a7f50f8eda66b3f4dfa89b6c33e0bac3e62255f694c1c99ec50ef58c66f9
SHA512614ebb2722ef5c1924ba567b7cd5aced2a50fff0abde5af29b9775771460ca005b29dd27bba4aadc51b8e5f85cb3de6018e7be47eed722bca56d7906d6d119d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55e7a74e97c8a93f06bdaf573d7e989a4
SHA145e0082ee4c03e9abdf047bde6ae83f2932cd289
SHA256eba11e4693db7cdf77bb20d8068b7a200af413bd4bd3051f71a408541c66ef19
SHA512ba246f033245475de854dee2ddcae87905a69dacbf1dfb2e01c46f4c59e919b5a36aa1066b2eeb135f7982ca87dc2840444a8ed4b11000e81260f26da46fb97c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57df4826228b743557a05a0b648a7aaf4
SHA1daaf07d542ba296343eae451780858a66f5f025a
SHA2563a95f72da638803297544ac3b1d7b57665694cd2d58497b100c20a39d2e134a5
SHA512b377d76ae6cc0a247c5195354c5c973cc92a226c9ca7cb1a99bf08f972db990713354b419170cb6fa79039a5b16c85f8e32edfc3846ad7d2dbbedd1db8575e17
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50020f51847b007ea6ade4fe1a6e06507
SHA196c049935ac1d2788d79434fe385dd50509cff18
SHA25685cb515f6ce64a446b06e886b84695cda840a7fae5dfcc125ae1b40dbb800d59
SHA512babd5027b64e70bae927fa9c34fc5812c665336d933aeaf995e959a7b15b3a512f702feb43936550130149af124518b81be6d1709f15b3108200f3b496973176
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51c6e4463d43370f8340af95553938139
SHA13b39741f3c27b1dc161f2b09a1a4c2894225948d
SHA256176e6cd24ef412a83685115368e135d6b3d6709dd257c89cb1809efcb0b4b152
SHA51213f572c7e5d296e7e0cd4f7eded3f588d61d4adb4d876740b1a8e3a036c71e60fe8f649e5e6169930305f15a1cb500a3ce536be462582c49f77f5c7ddbf18075
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b