Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
04-07-2024 06:19
Static task
static1
Behavioral task
behavioral1
Sample
24eb52ed87b4011e1827a0730ba8e727_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
24eb52ed87b4011e1827a0730ba8e727_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
24eb52ed87b4011e1827a0730ba8e727_JaffaCakes118.html
-
Size
35KB
-
MD5
24eb52ed87b4011e1827a0730ba8e727
-
SHA1
a0fa9bc66bf5438c82f482148cdd37a947ec7787
-
SHA256
d03dd67777c429d96b7af207428b2bb47f30cb39ea4c465c15bbc23a4bbd9aa2
-
SHA512
a9e34780d3b7ac7272bbaa517390ff2a1b69cd373ca1987824ed5fae7002dd8db35e478911395fe32d6a75238f98125bdc1eb349357e670e52c7e62a9825c77d
-
SSDEEP
384:tqSYTKKUkNYew/l+TwIAROLNuyPqYjnxibxiE:tfc+keew/l+JAROLNuyPqYj0
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{61CDAA11-39CD-11EF-90EB-D671A15513D2} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426235842" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f004bd37dacdda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb810000000002000000000010660000000100002000000068bbfc7bf0557c68b2eb3387082fb5d749e7d8f96e3c723d9286a9710beee7af000000000e80000000020000200000003aabe60aba56d30f5abf6fe4c2520fb65d7b76ffa403d02db12652c1832c846590000000ab5d9efabbc2f8d43d141348e0d6413cd717048e5dfa6fc44a1caa465b6fee64f713c8e30f2d0c0a41287d028ebb0c43af0765ea03d07d025478d7594bc752a7cd2552e417ba84af20176f9c8357652f339b7738f699f6f8828c717e9d31f3505d189385c54a838d28de2030de7ac9e982dadd44aca689e251e15ef0703784f29e5f70f3d1453d444d2e1f0afae52c1240000000034f96043452ab72b4d8554ae10c439e8ea0d447119f2050fe3c55e5287c96e6b66c040e69c5eb17cdca5f38150e04c689f0485552a8ea34aac867e018a90b2c iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb8100000000020000000000106600000001000020000000ec7ee3210c9aa20a5d2bd3ef16d326eca0819a0d1fcc886043832a174a3b23df000000000e8000000002000020000000575786e6c65259dc5012c1ab0d93102d9539d4105a137d6a3de2652e3b3cb0c920000000a768411144a009896d3c1ba6971e851a930de7b33d84a441b1155a7116d6390840000000edda8b6dcd6bfde9f2e4a5a8eec85396a6fd85014b848f271af62946d63bf9116ccac8213d15c9b6fc7767b969f4beefd8fe32f18b88ad5118f4065199ecf251 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2332 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2332 iexplore.exe 2332 iexplore.exe 1372 IEXPLORE.EXE 1372 IEXPLORE.EXE 1372 IEXPLORE.EXE 1372 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2332 wrote to memory of 1372 2332 iexplore.exe 28 PID 2332 wrote to memory of 1372 2332 iexplore.exe 28 PID 2332 wrote to memory of 1372 2332 iexplore.exe 28 PID 2332 wrote to memory of 1372 2332 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\24eb52ed87b4011e1827a0730ba8e727_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2332 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1372
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD548ea669a93726cc2a69f71352d840cfd
SHA162c6947235db107212acfbfc2fc71b64d97012bb
SHA25639f2c8bc7d88c9f694f9e6bafb8b4fb312bdc5b52a1b7e2684760e1325cf6467
SHA5120a74eb9ab0c0314a942803f05077c861a377872f90533fb975672cea3018d1a8e40d010f630f758ff508c8339b047a2b9822c8d2d3c237c069bc36b58b049555
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5abc717bb436600217f81088af2f21bc4
SHA17aaa1bf9249c3190e34186d3c3a858c31bec26fd
SHA256507082a7b8aabb292fafafec67609ba26cbf24f7a3584a59424523278da657f3
SHA51274e98087549607003c7599cc6cc773545fa019abfb53e920da35719e109ca48aa59f43e74062f747ee322d407123338183372f08852e7cce6683e77c99a1e2f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD597b582ef4821786bf2ad65ca18a9511a
SHA1fc999b6e0ad2c404d170db4fc641e5812e74f5f7
SHA256c4eed9551a64fe4dac862405fa3be3de5241295ded3bfd9aa8f952e0478f6a00
SHA512f27d19c58512a118a48bd5cae4e76b8da77a0b453554e70b034891e7f377521f064934f2b69cb7e519e7b19cbf8c768289334d3b9eb14f3e06b1fb51b77ae874
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a6451f6bd682b0f2829c8187c8e60896
SHA152309960a16deadbf4d4d21b6f12d511db606dd8
SHA256733b201852d455b2eae3a762fcf138050a01dd14d056d67d9542a0302398f3e7
SHA512e72eb55e9e6baf9962d7d4edf151e7f752d936642b7e16cef103c86f774db7030a45556500a79993d588b8eb1a5fb592caf95ce5bc43a3e2064b5ad700753ac3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5205128c518f9cf10bc785a7c4a484ec1
SHA1acd6f2e8665017fd909bfc42704d73dbbde8754e
SHA25676bd3fad5f46ac74e496f09406bd640497ac5deee6b21661e66f2beb9efcaa48
SHA5122fb35130ad59b8f487469ddbcf882561075bcdc517470c2348a079ef9e5191a3a9e9bdce82eb9bec3addffeeff4256d0a3bbaf0980f19c418c63c16089ba7d20
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59cc27fa680b76b4ce7dc34c2eb43b25a
SHA1bb1df0e190221e133356c70f673f965bba353175
SHA2564add826c0bc03a0f58f9b4107800dc02891ffd1ceee3aabe1f57597a6e5f4df1
SHA5123a4c45f1dc54f358a2081ac476a8895fc77c573e75b9fd364ebaab60311a95998f62e7ab782c0e39437a76c74f6b5cc72c6daa6fed33eac49d4efbe5dee80773
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD543d1f31112bc8f91c7deed8e25f0c69e
SHA19059998bcfeba4c320ad830639d75ac539262501
SHA2562ff629e109ceabf97ce4341e8b46e01ca6143c94ecb99c2f77db0ccb3e3d34bb
SHA51285398775c298c77b73449652a1c5b4b0f422d146e792f94f100684ccbec53ccbae8724bf8934be4e30f55eb2418a16f53ea478c81c07a80c603a719fb552f5b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bdd76e61a981820befc94cb02996a89a
SHA1aa436661a831c207bf94c4421cfb98df9a1ae0d1
SHA2564c6acb80b7148c17031d3378206892f9bfe4187c7bf975695ded0d573ff9719a
SHA512def8f09dfab820c256818d87160c4786b1b7f7279e41f8045ab9f087095283480cc81bd18a07dbdd6dd841e092ad77e240bb2bd3842299ceca01281d6292e126
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD505dc0407ec583c784f240f44704ba3e5
SHA1b5df1da9a91ab5085eff79267477d8deade4373d
SHA256f07a0e5859de0701e5d60888230a513b793606a04c50cd01f7502cbb6f548240
SHA512ddc5429d15e0735642979a68add7b35a1d3a8f6b8dcc9ec35919d9304761e939a8d43bb810cf2ac934beed681d163cdfbc2ace058aed816f5e5936b05f38491c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56812935424db1a88b94aa4ab08ee59ce
SHA1f1710feb4e73b6977fb30474743a93d9a0625c6f
SHA2563833c047ddb58b08a5f803fcfa03c8d491408db02963bb9a6368eccbcc08c604
SHA5120451c42161f66cf25181f12bae0682d000b4ed62f2749954ec118b80cb83cdbacde3d65429791446dc7f44333c6a4a48814fcf7469384c3943b5cf6311fe4199
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5176abe5fca050299cb659ad4b84d3a5e
SHA1f33b4523970ef524524e11b27c979aa532ae91b8
SHA2562f7dd4aec3584feb06e4978bf79474dc9f469612c8375cc2ba874928f310ff44
SHA5127eb1ff6bbf831dba729dd7f3bba9b6ed2edd17cab9f855482bb6b98a3c0d3da367dacf55840ffbe4fb140ebd76b52b5d63144ba343fa1b511d99cde0989a0fe8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f37e302b90178c6cf19b38d66c0aa594
SHA15ac7fcc2b7a194d6106b217727929264708dce09
SHA256197faea41872ebc4e436b44ed0b5130714b6dfef3674bb6f7cc22fa1cfef1b3e
SHA512e68ae79669f85ffb40123d6faa0cf59ded7a028fc9281a2ad78cfd92ad59713bb27bd49d2bee163cfa879e867fe9be62830a05065b51c5f22101c7008af8351f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fb6c9fb39d478b31f8ddb3315dfef13f
SHA1e6277ce6f0203110c358e3237f3ba830f5e9149e
SHA2569d6fe09a8b7241118825b4f6a60a1a30acb8c64108651b69e01c20de7dfeb6d0
SHA51210e80a891e58c5076ee2e99d0a5665de85cc7ebd922082de06cb5277c78138005fc7fa5a936892a83c16e8313e29a6abb7a484bad6a8fa1b938ff5f83e719560
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50ed9ade415438dd8f665657256b1e91d
SHA181397154656ccbc5cfd4fe9bb44df1d4748b8de1
SHA256dd4b060f04f18656062a77dc1379218ecc338f6b6a079e034e6bf1093c5b49b2
SHA5123a541491e01bfdc3a15ab85ceb2e324334caa494d79572f357427ab8b2f6c37b82c330aba0fff23a20de602cf8f3b0dbfb307b232dd931bef11eb08d01f0ad99
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fe46200fe76212231e64ab24bbcb7c84
SHA1e162dcd00755e44f4507cf7c13fbf798ff98139d
SHA256b05f38d3e1ecae3fb6213eaf8a54f7e5bfb0c39e90ddbf9f9c152a17ff49af23
SHA512333dedc8f2affb3e98867cfcd0d76772f8777c3fce6ebb6b94680516a0be692f6093058a51c1a67c3405f0d15fc5f06b722871bf56226b5e9d1ae98ed0f1357f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59b9677c39b5c8475fb9f44d7c1645e31
SHA18fadd69c77eff6319e6e409ac6ac2975c98f4cf1
SHA256dfd439022889842702b068511b347f59ca2e8a6cecc8e78c124e7a8d3270bc9f
SHA512f2eef3bd36805e49a2c0783d3861bf709c556c61c9492aedf4943bb5053f7ddfca850a87aa1bcb38c4a8b3b850d2206e65c8ff448b5457ec181f66a4e29cd7ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD527461fe9f6c54471983f0ac54b904ebe
SHA13295d9bf340b63997ef488e0da29b19d32eaca0c
SHA256a854afc926f6f68dfe4efe9d4de8dce51bfc75ef68b2b491485e9c9303adedb0
SHA512b18611b8731274c73443ad9d3c1e1c1efbf3cd823ee87e57252328e807456a732951055456930dc985c068d8caec8031e43c161864d4948b8d13c096015e7f13
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD550d5ee5cc210edefcf139596eba3f309
SHA1bcad83193b746d310a9f237685951bf992689c21
SHA2561cc7c6602860d980f4f41b6b10c795cec668f19e6e0fdfa58b54cdfc7e104930
SHA5129b1aaef2747bf83b58832669aae6ef8a1efbd67fcf2a3df6aa7af1508004c313a3e316c9b6493b97469411efc7870d07ff7e3b9f9129cf2b5eb16eb022b9453f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cfec551ac0a964ecf2cfc61f9967cc35
SHA1e304f92cec9627585d89b66e864173b0228c813c
SHA256db5d37d9f035828dfbf5b207d5b9e8142e1a8cb02e07bdc659f83fe6e0f01e5e
SHA51253b1fa8d65954dd82485ac3e4af6fbc9d7a52f6f0658ee482c775e46ffc4bba3252785601e86dc96cebea62eef888d96454908850ac4a1ffc78baa5b8448d1a5
-
Filesize
67KB
MD52d3dcf90f6c99f47e7593ea250c9e749
SHA151be82be4a272669983313565b4940d4b1385237
SHA2568714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4
SHA5129c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5
-
Filesize
160KB
MD57186ad693b8ad9444401bd9bcd2217c2
SHA15c28ca10a650f6026b0df4737078fa4197f3bac1
SHA2569a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed
SHA512135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b