Analysis
-
max time kernel
117s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
03-07-2024 17:06
Static task
static1
Behavioral task
behavioral1
Sample
2324d643259166c5a589c850c4428bee_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
2324d643259166c5a589c850c4428bee_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
2324d643259166c5a589c850c4428bee_JaffaCakes118.html
-
Size
6KB
-
MD5
2324d643259166c5a589c850c4428bee
-
SHA1
7ff5ff201e4585a7f41c35197a1f61ac5776ff0a
-
SHA256
723a0780e429947298b0285ad2ad0255d22075b04067c56695090251db04c947
-
SHA512
ddc8d9570d36969e091bd8e9ab26df43e512376970b1a8d8674b3d626e83e4f3c669ce8ea23e44ca2f780323ef487c36733807f5353d4f3e93655de0b37880b0
-
SSDEEP
48:GCpoIYSZd/pianp4dS4dUaXpidS4dsqaXp/dS4dlaXpRdS4d5VaXpwVdS4doaXpv:ZpYmpiApFIp0IpfIpBVIpwMIp9DpUW/
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a80760000000002000000000010660000000100002000000023c6a8f4978da3edb050d51f4cf1cedc2683ca2d5847df6fa998dfc1c39d078e000000000e800000000200002000000073b056d27a8590abbfe260b84a92d4f50f9b9e4c8bf10b71767c4cbe285f6b9c20000000fc54ccaa0c1fd152a26f5516454db501bd73300595e149b83c5c630dea25554740000000db6fad04dddc8fe0fff9e1b7e86e7643337e05b5db20229e94bdd56a5f8b0636e3bdf3c040f6dba56021ce4a2abbe783d6a1778eeaf6cb373c9a8c5b1c97fe6f iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000009315c30f119500e5a78e37556391a05452f61d3b1eee6cb191314f5fdf124e2d000000000e8000000002000020000000ada7dc8f41336e34be47feca68a2ce6d6e0dce60f62dcedcb47198ec16a4386890000000ba2d807706101cbde309b601a3e4a07e8ebea2f712cf91b98e2496febdc40086820fd8800de77467cf67fe52d092181e2d79e5e37bc16e97b3a5df7ecbeeda1a5dd1a6a4d7b71b8a5ee407c3b8f9fe9f6e729c4efbdd4e90919bbb315f8432b5aaab3da1b911568422c6cfcf154fdd79a39ce16a90d2eda22c9b42a15392d2bc24c791cb122235c934719713fa24acdd400000002ca492839e64d612738a9ebb6f63d684c1c84049b8e721ef0bcceb39cc1d00ce277d74e2a13e63a84f1b017e5380f26799cb8abcc640ce39a2e4b1e507b62a27 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8C607F11-395E-11EF-B98D-FE0070C7CB2B} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426188241" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0191d626bcdda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2224 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2224 iexplore.exe 2224 iexplore.exe 2024 IEXPLORE.EXE 2024 IEXPLORE.EXE 2024 IEXPLORE.EXE 2024 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2224 wrote to memory of 2024 2224 iexplore.exe 28 PID 2224 wrote to memory of 2024 2224 iexplore.exe 28 PID 2224 wrote to memory of 2024 2224 iexplore.exe 28 PID 2224 wrote to memory of 2024 2224 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2324d643259166c5a589c850c4428bee_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2224 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2024
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c975981f140dd3949f44b305fcbc9598
SHA10366783a6e63d61d0e1aef92d09d5845ab9e7d16
SHA2562ebd20383a03f112423ea0d5bef516b85f05a40bef7c9742c64e04b215e8137b
SHA5125c60a6c1b8e7ae6ea411f46578c50c5ed8ef666d1bbc40a2575c415c0a7c3690b1fa90afc671aac9eb4cac79846ab3510a08261ad8144a3bc20b2519e127ecdf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f9f45055426199dcaa0a4c0665e8e007
SHA14809fb7ce0c79a7fc4cf7a81e19ee7a0fa93ea42
SHA256f772d1a47536535ce3ad6275a20088bbd38d64063c4bc1e600391bf2816ea642
SHA512224efdde1b0b65b938f1dcf31213ce294dfff1dec3e7ade54dbe70fc578f48a2dc2c06cda454c549f78f86e513997550ed755cf70454d0211546bec014fb6335
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55a400965ce1b125aceb92625abbb367e
SHA1b46dc6b3dec28771eb77c25482fa9de8baaf1671
SHA25629bf3cb4482405c9e84f316db382a40c23357b1c32176acd8ec6d8860e1560ec
SHA512240077c115cba982545f6c0003cc2fdcca5b61a7f5faefce5fff64b9cafda765911e1a25c9e6346b0c46cb81b51b7f3bbe9466272c521428a9014fcc87a204c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD558048fa6e31fc9f4af41b44fa678baa9
SHA13ff0aaef385951419ede9f1efccbf330a0c83c02
SHA2568f49578b5e11e5e420863234490cf7b0719cecb42df76b299b2f36ec4dcaa568
SHA512dd924a5e582fd0c3de56bb59f6984e1f7d584e327e509799195c0a6c83415d3b3ff90662773b901f3e6676c712e1fc11e480e112ea1c076d2d95368ea572ee39
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53b1e3a7094995b1188c0a30963e18347
SHA17b1133a38f1510b8e1222b5e224d9a54a86de591
SHA256dd76d8325c295c13fe04c48a5aab89c9999842437da4a459bd8411ee769a5c47
SHA51269efd0d9704845f4333005568e7fa876cd087d884c06d6899cb7d57fcaa3b40c7c99d8df91f0648746e4493e4835efeda042e0ea08da5ee4bafaacde27e07cb1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5787fc7df6fae1720d0f6f5d80da3b28f
SHA1999e1f45418e7877453b0954213e11b3393bfa92
SHA256b58398dc99443ac862466fa1c029e4ae44be013289ec6e873d29e02203dfc5f5
SHA512fdcd9fc0b7aa34c2c9e92f7f6b5eeb63d08534a6b2d5c093d5ddf0cd8db0daa803295ce162a6ba337f54e997e391b6f9da247d2be4a454f9f95d3796f61620eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54c03ce725eff3ad16076cc5a75c51834
SHA1a7c735730948b0250145403447bdac7ecfae0312
SHA2568c1b747dc3dc9e1c24ec8c89e21f874b2740a7e18d57a535c3c0baa2b49d398e
SHA512634dec76e8ec559111ae6b5a9b3c56b99ffb3f0d734203388bae43f353e5d3738b8ef9e1fb21ec929b3662862bd719b09cc056be4b28f78565d565c35718d39b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b92ad32f9c9bccdd7ac7ea17424a3934
SHA1c0433d6e6a0582e4de8587b92b22f22ff1d90548
SHA256b1c78b7aafffb121df8a38da61cb9e41ad065de50fe9892e1318f57884e3b333
SHA512a4476c8e74a2538365d8bcc035d99794f822c6a508ad131564c85d95e3a8bedb8c4cba78555fcc789089912cdd5da8613e487f971d19beb1e8032b9f6e923f0f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eb3a98dbea8d73dc0d2794fdf71e1708
SHA129614b8230d5d0cedaf45b56d03ede1ffc44887f
SHA256a0840b23ee37c846ee641188ac32fae6fe497460087d86933ec4f258820de07d
SHA512d6371c0aae65a1807e289ba9b05c9780678a640b8f27afccc80b07a627fcd676e5f89a01fa1f0ae05fc6534419afef561e8b6e2eb6fc5f43508f66e44fe4922a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dc61ca76077ec18df31da4efde186749
SHA1846f8ede372f23e16201b6aa235f5409d63c42c7
SHA2568fa2e4dd77ece08292b918690ca01ca62cec2e2d3407f04a21a1d700a7be510a
SHA5124e2ecb310798c5d0c2eda73a540c603e036d51b226c4aaea3e776d078cf7a7c5fb4148c200dda073832b0be641ac134484d8a50f305a4e562c0f3433fefc2933
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bb15c76c282c939eccbe6a5f4b34dc55
SHA1d1822fecb6f3c5506b7d03aaf235fb1f8dd59e86
SHA256ae60d0363603e9e27e2ad061bb83d37f1c58fe05aed7375cc7f140b43fe342a0
SHA5124e4e28fbc68bf4c672743691970e4883d152a469576bbc81e5e1e6db2decb97bffee32a22bf7a920e18d1a0b7d8c308161024dd44b0e09cba12953efec32fbe7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52ef0d3d33f781d953ed2474bc5bb2bc8
SHA1407267f85920158d7af34398527d0c4b3cce0e43
SHA256e542f217d5f563e2fb3156d38ee0e2ad7646ec7a433abb17e02ffc4ad8b53ca0
SHA51283527f5206e80ea384943a5758ccedf4a56348eb7e27425abe165d4c9e0d13db08f6c588fa1988bd925602e60eb4c064440d7520c09531edc86ebbbafa449ae4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53c24efcf3d0e97846da9a5ebb2632d69
SHA1ac81a856d9a744a417350deaf7d89c1884c851ac
SHA256c589c996ef04d9b4320b9e14773f0dcc79abb3bc9fe96431dd9776f316a2cae8
SHA51228c8e91a96db5e1587421a8d7e06b4b810c28f1567ea5fc2a55e2fcd0be253c3bdb01534f97d29711dcae6badc641f23f4b09e7a8eee8bb3258ecf1693d41400
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e879294a81adb2da1d409ce53c366343
SHA1c3a0833d167349d08717bf00d0f8f2d4caba0289
SHA2565144349fc8ab92013a14a81ca2d4f9141786ef5c9c4ec84db7a46b1ee275ab53
SHA512752c36d18673e09685908d4caff325912ba36a4c2f8830227498fa05fd52e165ede087516bc3e4868f122db1fcc145e52b936e1f70b44670e41d77d60a177982
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5120695b0a83cd5ae1ce7e9ae8c193a47
SHA1302767a07ff7a1a530cbe404a0845386f787ca6c
SHA2568b119e324647a52d0472ead22f757c249e181391a0df978d4bcb812860e24080
SHA512a8366efb334003988c76697574571b4052950cd6b6ecb91eafadad675bc13e48afdbc2b367f0db6f1053ec9e530461c8871399b7e7a7cb30d836f77a35e4deab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5551af0b56e16d702add2a8bbe508bf33
SHA1f8d2bcbc1a5463e15db6bb778bd647cfc8d972e8
SHA25639b6190a88f36f37d8fadc7a86b9f6286f5432b8ca8a9322570b7542c1a252c8
SHA512e51fc8022d329f4e18d6d41ac82da33712a6fafc0b1eea58db9c8f3c5e54c334c3469fb635386b813a451c27a5790cb3123e5cf1b66cebc514d2826d5be7d19d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD509c8324046f16f88fedabcd82062298c
SHA124a1bfb67c28423f691f1206ca4472f9ec524439
SHA2567b87b92eabe2b29e86f1b29fb6d2434264daeb7e17b9fdbddaf8d29fa8636c19
SHA512c34dd8809fed8b441d90d42832a1f2b6fd6fdd41cf960aa474c2831d97b7040809248a3c2bf47aaedd556cabd70d8e53456119bf595bc4ca57ff727bcc41a460
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53d8be2c6909bdf3dd3abf5d5ccabd775
SHA1fcf4574d18a10c9c78ebbc4c8ce209a773c09358
SHA25611cfab73ebc6b6d81ee8eb52bb2d181b5f0d6de3d256647568f701a30ba0eebe
SHA5128dd550ab6543ca1ea3aa9480674c1c8f6861a3042bf9b74b83398753f27f333ddd5c1137c43612d092753f37a4db1e20b5ff6657f2e820dba9d95b100f1ba780
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD569cd616c264bc056a019f873b8fecd43
SHA18d573e5faea2118be224229d90ca730e4c7275c3
SHA256b14662074e86ffe1c792fd7e754edd5f08486d0d8f96089e9d7f40046fe9175d
SHA51280464f158476d660155f6094eec167c40106bcfa565a17953677f69c9eb0ddf88ee14fafebeec00f6605d74889b8785776389786714d39c5a4e9d0123c93b265
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b