Analysis
-
max time kernel
137s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
04/07/2024, 05:50
Static task
static1
Behavioral task
behavioral1
Sample
24d7998a26d6ea75abb2de3a207139fe_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
24d7998a26d6ea75abb2de3a207139fe_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
24d7998a26d6ea75abb2de3a207139fe_JaffaCakes118.html
-
Size
48KB
-
MD5
24d7998a26d6ea75abb2de3a207139fe
-
SHA1
144484f51847337a89282bd3aa20d68cbc3e02fd
-
SHA256
9309c3729b872dcae31e5d48851e94e04ac960701ec52742958e36a63587c99b
-
SHA512
4157f682c4a7e9d69b0f3a021573c549bae9ddf0e8899a4843657f3417064589b25d9a5236c826f8762c0a50d70666f35e7194b41ace727d2fa53ba6777cd364
-
SSDEEP
384:rLoOSKV3I6rtMtEJEdsraX3cueA3eSRNl/T4poA26w+yRIwm0je63q3BrLV+6YWK:rcOSKV46rtMtEJESraX34uS5jRr5fYz9
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{578C7031-39C9-11EF-9A64-5214A1CF35EA} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a80760000000002000000000010660000000100002000000039c3a087dd8144b8ed522bea1b5910bdc61e1bdf0768ae38e11d6b5fd3ca200b000000000e8000000002000020000000efcd13d1e7b9709c5ec6f83b71ae4593302619d68449d3a7915c9f9f84b3f5e22000000013682876f8acd4fa9ff565bf5af1a4b1b5b6e52871c791d3ad960c71e07ee8a640000000f81d6e6e685eda84d82c79efbf6c0e3ce44347cfda8efaa0b3d9efb8d0dc21bf7a834729ce25f8fec58f12c999f2863d7968fbaa5b3ea277de87a5fc9c6d61a2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000009733e5bfb2cb9cf507f876c712458606ab367fe006834b34c870495e6d97e0a8000000000e80000000020000200000006af5efa80a1776a2adf879270e713e6bc5502ebd13aa9595d66ec6aafaf0c9ee90000000e90068bcd3c544dff282e9e8bcb1ebe966abc1fd1d132ec163f514bea185c880c07fc61eac8a3a95a28a3b1c6c07947f0ff568ca8acaafd84730993cbe8ca0d929d540fd29f72fa3b2e2da260aed279409a4d55c3d7c0a0e46652317e24df9b2a1188b23c727b0425634a92b4280f3768d6a345647f364ce73b982ddc74de90e125846ee5ed46313cf97c279cd51a6e240000000a988a3a447a17e304963fe7c3501f9a09a51a1aecc8c00b09273f6cf3c5f9f0f808b4df78131395792fff3f9cac6f4017c7751edc62a7f257bb05497923a748f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426234109" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0b54b2ed6cdda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2404 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2404 iexplore.exe 2404 iexplore.exe 2424 IEXPLORE.EXE 2424 IEXPLORE.EXE 2424 IEXPLORE.EXE 2424 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2404 wrote to memory of 2424 2404 iexplore.exe 28 PID 2404 wrote to memory of 2424 2404 iexplore.exe 28 PID 2404 wrote to memory of 2424 2404 iexplore.exe 28 PID 2404 wrote to memory of 2424 2404 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\24d7998a26d6ea75abb2de3a207139fe_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2404 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2424
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5df3873bfcd594ba0109172b4ae1a58d9
SHA1620571b7e1907f355446753f4dc07697fb4d00c3
SHA256a368a08f11b106b4e777f3d3ddbc00cf91bf1394e691f3c9cf9981b2c0c1c1f5
SHA512ed680055c996dcbbf5592986d5b3c9d393dcbb67f9fbe8db94da286a1cbfb4401ac4125b7117de7c29fe246ff1a629f54de5521ddc648db00b796864d5a318bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c32145f1cecd8693ac6f0cc456b2c976
SHA1ce7bc9926aad3666b502fa88aa8ef67a09102888
SHA25676269e0f5dae98a5d9e7106791c69ffd3c841925d1de0c0b467cfce48c39d086
SHA512bf48c518997af2b06eb4c11a08884516908dfc71e3190daf389e6677bac8e59c67fad7364ac67efa4d0e5c35238f429e8a7dcb16b49cd8d87200edbf48d7c6c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55f94bf9ecb7e3b0a880109f0b078080d
SHA1fa57b7d7ed5e6a430dcd9fcd42f024ba62465c45
SHA256b9caf2ff5a53ebe143c096d2e17501463cdcbb33fa9330fc4842b62b16cf772a
SHA512532264e83679b959b094eead8136ad5380bbc36f6329ada5da78383eb452b0d1893fac371d82de41202c8dff5a5373155c4a38ac50a4ad210a8066337b51009d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ad5b60f603267ce52319463fba60fae5
SHA15aee303a62449a2c658f0570231fef6dd929d5c1
SHA256e832330205f9caad6366baba44fe3c28e4e4d4f9c803064b63b24a9107784d19
SHA512d597b5784fe91a5ae0ad2ec50c21c99b6d963cf9a37da5ca6ef83830ec40adf422543e3b66c5f0d292ac9c7a7962aac40bc7ee07880f4b2e3d6d0d6172c6b48c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55112e19d3fa7bb271525194d0473b055
SHA13a133a1ab9b36470c01ebcfbf13abde22af486ee
SHA2562e6af9faba083de107388ee38bda451f64695e4e0dbb6a2475f5e45e97be953f
SHA5126713f877318cf946ddac76110446d87b4daf29dd74517488bfa92da1702e0281065445466b2f0768ed3fd10be121d763c95028fb2d6b0f08f9edba54844fbcb0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d2c3be97900347bbeed0f03f737f2f2a
SHA12d5cea438fbf7b6856c669e6a525f4b75d8f1ba2
SHA256aff6b96c6b4fef15da1bc7b203305b618145824c2c293a125b88f6c6b315e85c
SHA512dd5ee4cb3ff08e3f8765a5301a5ffcf321e1367b478ef813ff1ead30d79cc49dc97ec73ba0c23d1d9b852216cb669bd9f67378f72fa645703544b09f1457f562
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53c0b4359bf81b9487c6752e32e3e3e68
SHA1a69c787082ad0e030ae13b8ea370aee6bff976ed
SHA25651adb3f849566726485904d7996e7bd6b5818c121ad797b3792526e950a4e482
SHA5125238c6719f63e8bfb93fb6edcec30d8eed78d68a1ab33c9734742b9524aefac5f8d6c85ca4341cd837620606dacb63037644275a6c692068526c91793d82150f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e97a9c34ebc2c7e6a415ab1e01424b0d
SHA10e60c23667f7a5da5c1bbb87044506b7496e8e82
SHA25690be93efa09c339011f40a3d5eb0b6e8a61e55fcb9fb5a6759021109fe9166b5
SHA51278aedb7859a93806882fa042f52794c668f0990f4f4626f1b6969f1083869dee2c9681ce89cfa473cb5f2e86e3ddcbf6097a00af03067d9bc00b36bd9a5bb65c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58145e385ea88083bbb072aaf727f0cad
SHA1e0de98c40d32c3d74b1be16a9cd341b0cba0b38d
SHA25611a3b4d5a37ec7346136d2f6181409d6deb683167629c6b3c447e56a71735ba2
SHA51258db5b0bb18b96e18ad06bd6ce8dbc5dba273bfdad4edf6e5fd2388d2820cf5a537615e024d125de645b397c7b3119f2febbd65a1e4335a7d51b5d2e3b4b0fb4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a8f6245943cc6273d85c67af784c5dc6
SHA1a05d208d10875239a2cc2d42880d57e59724a263
SHA256f4d3a46d72ecac6a6ec92926b9ee521c2a37fe9516a3a2ffba5d70942cc6773b
SHA512c43844105b3aeaba46907647521eb7453a34266727ee733264e461b2cec7b6c8b812d327f2ef6b7a84de48e6cf9f342466617b3968b7736b0450fc14bbfb97fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5020e57f143b32963e3821489cbf46903
SHA12b0bb9b654199206e4d5f6295a7265aadd83e778
SHA256c25e32facf9bef359bda72a151c878dd44eb37acde5fedb75926e404aa4b88b4
SHA512fe1ad11f94e515d41d200457b7a7c273e7ef2facdb2ea7c7db5a9f2fce6cb2132d30ff222bcf88d6f8cd01b264ada2df4bf620cef1ca1bd977d4f2a89dfb221c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5459f47ceb0ef7ebe8a85166824170e53
SHA1eadcfcb8dd3ce3dcdeb2c8eaedd5f3c4818ca0ab
SHA256e882b1595a1862f894f1b4924f410b2b3761cc203b584baa24f3454bb23143bd
SHA51239dac54a3528a07497f4c2c813bcdbe80831179e7fb3badc3a4fc464ef5756bde70f363f2351bebf01bc1b0bbfa6fb011cff80b9bb605235c8b3b112eb5e4b24
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5591b6a68a401872e7e5f924184a7b64c
SHA177909ccb3192961ecdf9720ded33561945051a9e
SHA256db301e320647cb3f973b0ed4d509b1e13723dbb99fc08471abcc8821c8bc006d
SHA5128079def68bc425c78b947814d34b0e4d33c1278d1a841397c708a46ec4837bbe5ff84ac44513417366b79a99e50a1fbdd72261c2e7cc2b5026584174b2158b3e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ac98531f9c00f84b4cef4c5a3e82021f
SHA1cb4b54a86804e2d7b221d80b58fe89cf13808056
SHA2565992274f2742f5bc777ec1f30ddd96db5266b95a8fe0e122640f0da095f0657e
SHA5122afa1a79df77e78564af8e1a6a78da42b62b695ccd37aec8cf11ff94ad9c66c9134d1976fc5e589fd6501a3e8fd29b79185fc552fa06bb381944160730f7c14b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aeee48768a2d0daf99cc432859a10f2d
SHA164f74821c2367195c0da9f3bde39913788832a9d
SHA25668cf943d40ad2165d607833477687eb9417dc265a194ee17bae31ac488de3c6c
SHA51299c4ffdf2c05ffd40ce5f485d578e2e34eee72e468acfd70a3a3cf69d5feed14ecdf0845373c625d15adeaf4e72b7b15100b80501d17f5dd6fe38cc94f138fc4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52316441d8dbd351507a9e7cd6d051fd8
SHA1540194da936a6dd2874158c2654cc5573ecf3f49
SHA2568af7b727ad929563385a22ba1a7912f3e889365eba1b49951c59b021855810d7
SHA512183bfba5eb72e003889eedd3055b34ad82e4a592c1a785644a29341a17e34ac850a5c80059f07295a673e807ddf0b143d89460127fda2225fa642bd7090c366a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5abc7058774fbca35eefc9a507761edf6
SHA1ac2dde0a0aae2bd6e28cab39eb8da2db8a53edd3
SHA25648ef0f7b6125d11bd544ee004b9b7208b32906cb1d92e5c5a9bf7a3e63f9bced
SHA512342cc0d77afceb433f7ead46933ae6dfefeab19758633dc76bff3d751665912726b2a0d08335becaa13154ab80fb8df0954761c1bc58d44dc2208849a6e73b96
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD546aa3322cb9f2b17fccc3c6bb6440dfd
SHA142e21bfc75593b8e1c51233d284938775545063d
SHA2563a5ce39ffb5656de7a6f94d0c816b4c1223b5c9e6067ad573f2a3cfb2a83cd98
SHA512c444cc526b680ae8dd29b7ded17aac06eff4689b23bdbc032a96022c986dcce73db051bbd9072df31e84c62bbe81df808f8dab987d3438e106ece5a058ae623b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53c88b68b993a4d3924e5b8755ab4c0a4
SHA1f8c21ca7670703453472e073e71ce5e00533fc38
SHA25679a9f0ef6d882ddc8cea060b3b8721c95d24db8b9d2a84e4d70037d39e97ada0
SHA5126a32144e89066e04d0d04aeb04a5e2571f032d6f09c41557df8fff48d0616fbdeadcf139ea8e717caa5634b9429b00ab35043cc792bd33f0c75058555a4da15a
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b