Analysis
-
max time kernel
147s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
04/07/2024, 06:44
Static task
static1
Behavioral task
behavioral1
Sample
24fcee032e61e7e223caa7d9cd908640_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
24fcee032e61e7e223caa7d9cd908640_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
24fcee032e61e7e223caa7d9cd908640_JaffaCakes118.html
-
Size
2KB
-
MD5
24fcee032e61e7e223caa7d9cd908640
-
SHA1
c2fc304c622ae37e5bc8302025d3a9d3ba0dec2b
-
SHA256
fc79aa35af952a8c88d9f46f3ebe6c5eb46d7f0622ef6d03ede3d8b93ed3f896
-
SHA512
e0811a307f1a310e2ecda1472e02a5c24136ba0c2bb9d418a7d1e79cf19bf841e9871846546bfc1e322f84b4ff7bca82bc707956a492ac287c53895d263272ff
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E8D0EDD1-39D0-11EF-9EC9-FEBBC6272832} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb810000000002000000000010660000000100002000000028447c6c0c05f9b9c2a46bf8ba95c052660740726926308c46b92f7dc1dc6bbf000000000e8000000002000020000000303f4fb4ea64b88cbef61a795b1b800db43712948a2081f6294a0f585392986a90000000ffb3b3c0607d950fc566f620f6ff3bf0c90f5ce0b6595a0896bd59e8edcc9d2b3cb7c76951f5af363e26173b49ee642c1336319c26b5676b10a117ee3499708c896913a9e032ff4e66f29f685f176dc5279bf42d06888f8badd5f68417b1a0682b684223aaa6c6a94d83adeda894acf39d149a59e01a9bc0b1b5eb2c2c5ae6d29a0706adfb89ae2f06aebfcb1df34d8b40000000f78fa3638bddeffadf4bc1f13b4f5d83a3680f5cf637e2f3bbde9f664fb24e7e15e6735541b2b277c5ca7d365c1a90161ff055359f20af6d04c0d4c7f84bbaca iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb8100000000020000000000106600000001000020000000777aff5fc25cedf405a67b610977505e75eb9dd44de1bc05c91499ea9093a12e000000000e8000000002000020000000cb762c359472d088d68b95180a90bdf8cc016a89bc9849e2a616669563a2c289200000000f1e10a7af6ad2b7216a8b3378c332ef3b26ee134314eb69b95cae71d6253e024000000018501e00eb4dbb3d2e6e9edc8ebfe9ee1aa437e0b9735c08264489ad7e64adc56b4fca5d3c75701d1a701b45a30645e68fc8500b09e834ad4d6bc309155f439a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7000b8bdddcdda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426237357" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2244 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2244 iexplore.exe 2244 iexplore.exe 2880 IEXPLORE.EXE 2880 IEXPLORE.EXE 2880 IEXPLORE.EXE 2880 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2244 wrote to memory of 2880 2244 iexplore.exe 28 PID 2244 wrote to memory of 2880 2244 iexplore.exe 28 PID 2244 wrote to memory of 2880 2244 iexplore.exe 28 PID 2244 wrote to memory of 2880 2244 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\24fcee032e61e7e223caa7d9cd908640_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2244 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2880
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD539c2512699b03379c812744f541a9538
SHA147aa7eaa7ab32406827bd7aa2d7d17961a63c823
SHA256dfc576a9c6bea2915e1fb8d71564641d046e0c7d1fc509fd5cd3f36c6fc5f021
SHA512d6cf1edbe24f25433ef653dcaaa32e7d2b6af674a9c7f919158efdd8fb0e2ea51fa2d16553ec5d6a0ba9b795c7b13b2d17612e491d1d7645da77f09d3255031d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c365540772a94b85e5bc4f645b1074a6
SHA1bd7c26fb96c074ac9509184b690690301c71e1fa
SHA256d52e20cbfde0d16807475c6a2a573f5d2b3eadeb9e16a19e5984cb142e075856
SHA512c696ebb20a0a47e81857b906a3a899fae0cf86a1d68a586e665f8f5f596c70c612b289b029d4c473214c213d1d601fa17703bfee2bdc977bedc649142ec339ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5939847c79f7a476c4201614e6a17b032
SHA17e45bd0df03103fd2128055cc7dc46594d65d2d0
SHA256e55abc65cb57080e6a644623b2c11a549c61231a517a2cb336212fdba13fb27a
SHA512860bdf6c7d16d6c0b313c61431533f30373a790c3eedb71887820c91e55610de001f92bb1284a994cfe1b5c7c219a07728fc745910e94af58f19cc9240327546
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55c02229bec2007959b8afda3216430e8
SHA1298823410d474c95b0af07676285b07fa940ffc1
SHA2561ce89ea51b186e84ffdcce42201133d3c0251a3970bd8739e8e58fc710291b10
SHA5121c2291738c27c321e429f5edbf297960d851cef445750c9d0398dac4321ca57efc75f0a26801cc6ea9335175709f8890df717ed58bb5fae56781381ef059c0e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD532fc94eea90ec2ffcd0b008c2daa9d62
SHA14537cd44a4521fc1562a4a748dad8a00cfa85c91
SHA256d98a2aea48a8687d040b21227bb5a84a92a8c8dada26cb54118ddf5ad4f87fe3
SHA5121ba1d768e185b4f192b1bc989b04a368ff7e07434b3f5629f6ca4f174d9b0c7fe5cefafcb74480be3109a8c3571ba8b351c6a5d1ea953cdb53294828cd0b88c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5343b7061b24425f7b350495c8f2f58d9
SHA1a20a99fa6dedfd24883a353d7f7e1b3a0893b537
SHA256e5081b7e8d8c757a55808aa5d13b506d2cbf0ee1eb15befdb30e8672445512c4
SHA512844f5232fb20afb9d1616cb38899ed49fb918c800f58155ac02151af074dc3ac273bf37516aa637c86b055ef3b8795d98ed8337862d7df1d9622f7d574f9d38b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5379a9431e9375f275a33ccb44f6db47d
SHA1465dc9a76823ef70624608517fa70d2c801cf3e6
SHA25601452bf6e40010b08e5888b6fe24dba48616a525c5f78c8d4a590112f5450a00
SHA5121c9f5109d2bfdadbacdac691667a92ec7c23762e57437dfe5018943d82216b0936447af001e54c113f5423700bd41908df9de73623a5d0d4af6e0c16463bdb42
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58e0494e1e034781cd2472e0882a22459
SHA14607327f3fe467aaef265d304c278d23f94b572b
SHA25689162834ff283980b6c420186b639a28ca55fa13909dc35ba5be01ce14e51fe4
SHA512925c3e6ede8562f6473ab298b1cf7c68ccd51b4fcbc565b1d4caaa0b0bb557c0152f05ab4ad9b821bc9f2f67405086e8fa2dd3c594a371cc15f3d17d29796aaf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5817a8e3083f973619ecfb5eb2e650200
SHA14fa878f71446526878869420a4c937e1245753f9
SHA256de575581169e94cc3a05fdcad50a292d0a2e24cc3abc309f5499a63569276e05
SHA512f6d527bc9ddd9017bce5fe4f66435e9fc73e8254074661b6b76df661c9e36066ad486abef04698024f7055ba444ec8fe9068fc275d6e5b444e6fcc32e6b2da63
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bbcd84b4b21f8584579e8fe1f2c5a86b
SHA1d1104d5733741be1fb27b34bd341ab5494a5e06a
SHA2562f06d98b67698277d910e1b6c274dd90094af600e5cdf9e8de0ba92f5e6893bb
SHA512ed09a8059f31b8e7ebebe254da5c1a412dce604604d7e373cfda2d81ba7bdc49dfacabac26bc2ceca5efc79bc51096f10c93f0b50e1101d652ff6b132dc7cdd2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56e3819870f22385fa31c2dc4aa8afce5
SHA15294e4454c2235bf65f1479e9ff7c059d495f968
SHA256e0a99de6142a0e3d770c66999703754a1958332a1336604ecc4f62f66dd49195
SHA512f4c7b0d2aa8a06408352cd20a6c214fce20af6c76cdd1b55812eaa2c695032632a7d10967e355834bb748f0719f84291161f4a204ffac13b01694e6c67ab30cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f285b7cc98feffc4d83a5ef1b381e48b
SHA1992a1805c751cd9a959e59469ff431409f8cac68
SHA25640ad92ebadcc306bb4d7f37eb3c8629b11ff616f03976c99bdc434cb73a58f7a
SHA5127863724d83828aa6f79aa7643363482005c101a57e821dd5e767bca3478c80d8e61ae8b4d64a697889e77dc3a503664a3f845f0887070126ba0f704aec1f960f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57c03a6c005bd29ba7bf8073e49c2d33c
SHA14d3af61eb15a678e922018049832b09e46a7b39c
SHA256216c0a38b42ff63cfcc8dffbb318cfea16833e15d77f7d784ff2e6c886423f5f
SHA51283818a14bc1ee48ff63fe7661ff468cb6e90c471d69e2a06c13bb37632d5f80355dc34a2fda7d2b21c89ec49596ac3de013680b5a3df385a61aaf9d5df27cd4b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5383f1c3fb826baedd489b2e14907b2fa
SHA1c201e4ca7137dd6bdef18803aea0c4c9c80bb9cd
SHA25622dfd92174dd99e31a00399c19e895c7bc56df03cd96355323edab66d630eefc
SHA512a1e2263ac30c0ecc1518bff5412915106622fa5998dc491cb5d07fd3cf18d5cbfe2087d2b76a5f9e258a0a035d413740517f577b0595fb6cd7fa16891e3ef1d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d326754fe32892b224a95cfaa37711cb
SHA1c7485862654ada5e6c514d9709fdd892e72484ca
SHA256c591f3c9b744b2eb2ec25de1a86a4479054022423336cd3042d28ec2e8e17803
SHA512f4caf6d8b1f7588fb77319cab768b777bea567631c94bf7e5172e789d280f3ffe8f226358375e0c8e42a6031e5e6da8241c30dce2458a45200a6b4df7240f13b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5569f5b2c055c0f765ca1a47bf522b10a
SHA1e7eca6b42904c7bdeceae2320fd474e82a0cc4bd
SHA256ade21c8d75323365e7b6ec210a7b1b751804d09dc9d4bf3f56fa9999817a0d15
SHA51271e66b8e8d4c5db14b52348ad97d0f3f1c262397ba39df14bbc5d1033acaffda67efd8f2be00119e16c0ab0aedcfed2e507407c09910a676538a7547f4c3ad0c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57bb329de2d9bf828122e04460b0a0a79
SHA17b68e47701f9c46fcb4f9eeb8836a8af497f647a
SHA256de6febe61bd5d41f9c8d2c3e3a6e991ed4284bfc9919d0b256934eeb4f79d0db
SHA512a1614513e3a7ed97187b818db1958f5df0a3e112b1affd5799d1c1f066daefa11a34e5d4fbe37f02552290de31ded333f1d323122f65a03d4f8d21a4484e63fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56178a19d84039d5f1099800a9c3d7aff
SHA1b52bf8aa81fc5f8545aa12c5f2944281a4c305bf
SHA25609a8ce9b012a9542d35f2c30c960f5c44e226287e96e824b24142ed81cfe338d
SHA512d5ea634a041b3e7203e2e01c1a9a4a3a208810ad84471f663fa53f8b3601c75e25bd08edafae3374ccc29847d3bf0156d274273cdbc238bab5f461c2a7f2bc3d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fc680324818005d701f3aa8116116bf7
SHA1069d01335b7bc561f58f21ba9f45fbf3234bf534
SHA256c7f02ef07da225c73b92952c53967c68f7a6b5b67aeadd0e4b2998d6fa208199
SHA5124a4615ffc789589daf31f78e5a98607284693fac278c5ad7bcd23de90d3858a5d8256a8a8a6ccb87e8a8f624fcc3c1400574a8f936a2fe9664cc3e9d5439bf04
-
Filesize
67KB
MD52d3dcf90f6c99f47e7593ea250c9e749
SHA151be82be4a272669983313565b4940d4b1385237
SHA2568714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4
SHA5129c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5
-
Filesize
160KB
MD57186ad693b8ad9444401bd9bcd2217c2
SHA15c28ca10a650f6026b0df4737078fa4197f3bac1
SHA2569a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed
SHA512135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b