Analysis
-
max time kernel
120s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
04/07/2024, 17:33
Static task
static1
Behavioral task
behavioral1
Sample
25a2bd8b3efb90f7f37df3ef117e6a39_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
25a2bd8b3efb90f7f37df3ef117e6a39_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
25a2bd8b3efb90f7f37df3ef117e6a39_JaffaCakes118.html
-
Size
183KB
-
MD5
25a2bd8b3efb90f7f37df3ef117e6a39
-
SHA1
0508daa8b7e1a95143c009f33b95689f8b900f68
-
SHA256
62b079cc1905fd783c522f9d6308030a5906baada26730eb2281406adc6ba962
-
SHA512
a9473e245257d3908dfad3734f3ef921503f961c1aa746779fd467161d46bc61ca60d5b5e28b5aab9c7ad6ef9970895671dce92e84e9986d31c14c90e363533b
-
SSDEEP
3072:QHyfkMY+BES09JXAnyrZalI+Y6XXI6EyA8:QSsMYod+X3oI+YS1tA8
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426276318" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9EC063A1-3A2B-11EF-8144-CE80800B5EC6} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 903ce67338ceda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000e7088cfe1483edd3659c65872080e2eaba27e746ace803c5f4342b233e5a80ba000000000e800000000200002000000039694454eedc0141202f04ddfcc27024bd09777a8e2b4c9e3a59be6f502b1eea90000000a184e049004c9f133e30088de60e768ed9989462b4caebff2811b6729527586cd96057433be09d5ddf7c071fe8e09de7db3d011511d784ac9d49dc2227af12e1513704835206da7622198738c1bab66c0f93be1d09f9decaae074060d28f4e5c3bdb73a96a01c5ee6253f8cd4ad01aa33162d510b30d6f55d63caa21ac3a4a5caa60ee44ad07f5870dd9e072226b5ae6400000003c5b1a2d46d7475dd4c1856d8d10e621712103df2bbf0ce841bfd9c9e5326f79e6bd90fcbf4197659eea8a916b98b8e32c7609fe1c2d4c594b10cb1c965c6cd9 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a80760000000002000000000010660000000100002000000010d053c2f6e87f5166f066a32304f381347b26d3a6a0d532146fdf06d4da96f1000000000e8000000002000020000000021cf19ee2dfc019753891489e7151e9abc42c7ef20e0e76711a08d849d1b61920000000a4b1c8f9bb44dd19ebe11410d8aa830633dd304477dc8a447be645fd71fb468f40000000f18ed59990b5edd7bca11d7d38edd64069bd704a7de40a9f4cce5cb56ef62b932d32f7d22e21da574a6dd920adb05ca7c7f1f9125ec31b9d6dbb6120cd3312d8 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1252 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1252 iexplore.exe 1252 iexplore.exe 2632 IEXPLORE.EXE 2632 IEXPLORE.EXE 2632 IEXPLORE.EXE 2632 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1252 wrote to memory of 2632 1252 iexplore.exe 28 PID 1252 wrote to memory of 2632 1252 iexplore.exe 28 PID 1252 wrote to memory of 2632 1252 iexplore.exe 28 PID 1252 wrote to memory of 2632 1252 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\25a2bd8b3efb90f7f37df3ef117e6a39_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1252 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2632
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5260956882b04b199ace51c6ffaa1f382
SHA17a725429c9232f94997babae7eacac8ac7eb7e28
SHA25654ab8864b0011b37e355303673af48720dea03433d5de94de0a176fbc2263f79
SHA5127793c0008410584fd28b4145b449d002ab2042bcce398b4d90f8bc8a8b61b7ce8a4d8748c2bd9d87cdcea18a6d82565e067512b98adee63663c3f8a13163e114
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ffdd1afd1182cf5a505f0d07651df59b
SHA16b321e10b1d9a8023a0fa5440ffb7fa6c5582881
SHA256af43924aad7ba7b4a40281bdcc2cd3574cab08e09d82ac687ca111eda8fc1e34
SHA51284a9eda35e13cd23c46406d86ba079ebc320f71fbffde1861c0d3268aef2dfdf4cb91a263418608eb15639b78af9ae3b4c19b99561a226681b761aa3302b69aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ed256e16037562c8ab687d2e9dbbc57f
SHA101e4e5cbab5819db9556c14c53941cf60eb8f542
SHA2567669102c4336ec6202c6b50a7d73f1a1d70ac96470e8e880ffcfd454d3ec960f
SHA512f3bf4f43a1107e25aa64a1b88f38a4316cc37f6b590f64fdf800839600ac6a0d42c396ddcbc963d755d1e8b2d3b2805a70381c8180fdee95967b008c2697b789
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5693f7e1196eead3a0db7ede7ed514309
SHA172ff0f382d29eb0ecca35b5291c9d7d1288b3f74
SHA256dcb31d06028be7d70cc435e70474625ca04edbc39c9d352fa3db0e970ecd76b2
SHA5126d28a1fc8ee633687a238606a578a7fe6561a7a36354fdef5d2da0b7d3b1e2f78a0a70f2c7e18a551f203e086a7a2558ee21a049714f1d9839022134879b04db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c81c29fb27b00361591eef4e866e423a
SHA1c59c7f6fffb03ef6407db2f3293ae754b5991494
SHA25639a8091dc6fb5dfbaafe8ede8c2992666e81ea6b252958a554959f1ec5759919
SHA5121fd224fb563e90611709e2bf96dad3d5dbd78c9e62d459610c542ea43fbd1ee659875cbe8b124b28c678dee675560c9fe885caeb9cf839e174741ce833ea7c6c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD576ae075080a5a8fe0ccc8d2dd6e0315c
SHA1f61ad03c9258b800f59fc86eac4603ab54843158
SHA25696a6130f446895f201420b827fba43098aa2bf9dfdea89e368d370f8f78a5732
SHA512d1f544be6d497b8fa93506897c95565c225bbf0d2728fc773e23e1a3af5fcfeddd2586a40f6d6c51b668abdd8d892663e882b798ac9ad42c7d3ccdeed278f4e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52596054977a6df945fad01dd0755d698
SHA12d0e50d4362bc5d6c5d63dbd8a8cdaff1bae1253
SHA2568a014b5e019da62ecb664b28bb4e2c7aaf3399bb3d8605e3a60d6b04b62e5c26
SHA512119b59aa41dfbc03119ec718699359b12df292c6afe8c03502a9418de47e0bd55b02da8905ca6591b48daca2a44acf3550adda9f4e598c2be0f36b5c811ecf4e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5231ef859b3bd2347aa6b84fc246ad486
SHA18de9a726a727b6a2bd6e0b87960599b5e274fb67
SHA2568e5b8b83c0db248b1dbfeade0d241dc5cb0a04ffa7e2d84120a2dabee60ab95a
SHA512c85b2e76cf416948f7029c5851a0616f37a83819222dc2870d88390954840db598f8fcb0ab757cee0ec359228d4fba815f925ed944996c0a099ab768b90d569d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51af248e69fd20dcd7cc36829463af367
SHA191f1ca2851db9db6839576a441b4512e6a250be8
SHA256e3d5d2284de0324e08d2b439e10c8c6cdd23b243e235982aa0d2c59384cd9752
SHA5127133aa9203c803b0f03777a15bf0f4547c09cf6b3df9e022cf8c12d7d99a3edc6abc3384eb81d5b879600dfaab75239c79426f92ea15d56e0d4182142da312f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c99eeb291d703dc31b11977705f73089
SHA13b3a294f3fa50c33e20bf93be08b510ad863dc39
SHA25639341913e4ff83ef929cf68bb7aecd683cb3f82aa2c6195af3af503f710abc20
SHA512aaa8b087fb9d1a3e9e301e9e4b98f94af60fd31a0394f75149c7dcb25cccb764bafa25074e23c64948826dcb256f2dd45b19c4366825649cb0af8b9324d978eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56646ad1c2077367d924d1b1f1fbff30a
SHA16efbcafdabadfb622bf6bad84a094adf37700c53
SHA256ccb4f26131db5090fe0a5d6609fdc703344cccd178719b57445cec27afaf50ab
SHA512a7b3fc0cb02c8ebcad57b711b39b0efaba52f040928f2ccb628c4819510971aaa905d1306ba58133dbb14b3cf98fa7541d873d92ca1cde9389d551fa7fb9b0d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD530169e58535a4a238165f6c59be49304
SHA1e3d7efba744189de77f8ddda53009a6d3bac4d35
SHA256db4a62cdf815a87f5ff2589d7c153b8537b873ad646ba1dd06df6eeb0c3f610c
SHA512eacb770492008bc276f0a57d1d96777b82f9915a49c9ec89ce17293c9f8cfccb6ddc6c4b2cbbeac9d612c92f8a3495384dc1fbc8f3d60f6e9e1bfe5b93a8e304
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD581b600c141ee65c7484d255d1d9ee045
SHA1ead22eb120134c5d86d73f02ed00e7235ff20016
SHA256df023c76c87e221cdfe5d9654977928ba2ccce634f5b834e39d556d6e08964ce
SHA512bfa9e12ed8ac71b2e9f8437f82f72e1a926cedbf3c6811f1100db84fddd6cfbda88b819ab22ab46e846f6bd2f06f79df9175d107c731e7aa64153ba16c35cdc9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD557d16eed8f3c2e783a92ac2f7126b697
SHA19545ac1b08c222d0bb99916ddd67fdd45d39c6f1
SHA2568f82a5532380749d58d783cae300cf25e4e7cb80d969e1625323a8fecdcf36b7
SHA512527ed6c164343f9e59d7f5aa24227756ea73d6c0cdb9a97aa1bd80a52b88755957a6313b9eaf5791dc154eb559e46fbe3e88b6be993ab19354c8cd416bfefa3f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bead9d5cdd2e428502d7008708ca8f11
SHA1b7658ebfc99a9fbc8e35935560026f56381a4815
SHA256037fb9294b31d13cd435899f7cfa7b41b45cd5bf291654ce207faccc27c87de4
SHA5129927b3d5bfa02246c617a3e922b57b20e35ce8436a6c3ea720f8d9e6944111f8e6c8d1f6bebd6e4e27c29ce1a9785084b4e631f8765a4e307aeefb25a26a8bd1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52d0ae921dddcd8a7aedc928534af0779
SHA137ab830719b5a5bb0a097ca3a3f256fef23219b6
SHA25610a110202b639dd0a347c67bb307e1581b6427e400916c5e590b86678e6f32a7
SHA512c36d2044ee14caddbaff04868d5256b38134f591a774b795ad8c85c37cdca5f1c5978927b17ef454b22cb0b1b984c6cb145e46b2270ec297f12297bba89e7644
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cc1334a7ec21c0e0aaf53e04dd257c6a
SHA175afd3dad506e28f3d853846af0aa173508b83f8
SHA256b977efbeb2384500319cc6215fbd0dd12c57da76e2d659fc67e713644ce5ad7f
SHA512de5796dfd75391ea09cfc25bc148528ee1f302dcc00180ec86f8b2a2a43b7c912758b54e170ad32f19df2e41f495bc5e6db9e83a99aca07dd53d303fd2f60da0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59fe98b00b6a772bd9e3d431a8ec49aa2
SHA1ea66d5b05178ed0d2986ee93c5721e5cd2ee2e57
SHA256d0421a50c9d8a8ddb77ce3bc806ed5ab1e937eff50fa2252a880a9a3b92be0ad
SHA512c7e2eed46718d014275ff9306544d7d0afa00eda4a1cdf95c476e9b065b82a4ded38762aa2cf2c9c45bfc04e2410aba14fd2e09d6e2af3d13ac5ed723eac60b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5895b85ad456e40f10e0990b2326c3693
SHA14b64bd2641e7a0d1c5ff037cf1368231d9239486
SHA256a4e830fda2444804223dd693fff0613941e353c81055f44f7f412dd5b9e35e7e
SHA512f7f8f21d1b7d5877567dbe1d507108aa20a45ffc20dcc367a7d957d3b8e7b9471f41f3a9b1ecf97001276872b0319ac725187cad4ed0a949476e308ad2d20028
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b