Analysis
-
max time kernel
119s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
05/07/2024, 12:48
Static task
static1
Behavioral task
behavioral1
Sample
26ec6898af1683f3b6a5e3c956d8fd17_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
26ec6898af1683f3b6a5e3c956d8fd17_JaffaCakes118.html
Resource
win10v2004-20240704-en
General
-
Target
26ec6898af1683f3b6a5e3c956d8fd17_JaffaCakes118.html
-
Size
6KB
-
MD5
26ec6898af1683f3b6a5e3c956d8fd17
-
SHA1
e5a57f7d1282fa5b8b6f4776d4ff450442bf17f7
-
SHA256
97a3eddb5118e4349dd57e7895a4f741ed5ba96ea246a575985a8c1d33900eda
-
SHA512
97a2596f0253736996611749c9be51b6f9de2923fa452ae9c6b815740e10059244ce5a8c9718ea9d913743023956d51944676f2ea765de33641a0817eff52af6
-
SSDEEP
96:uzVs+ux7YVULLY1k9o84d12ef7CSTUnocEZ7ru7f:csz7YVUAYS/7b76f
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000297f5346511144f3f2972bf9e24b8323f2c4fca3d5d9e55eed233893162c4f19000000000e8000000002000020000000bfc051f5e1b21f5c4743a61c85803eac3c132678612c790cd884b7b41124384c900000005bdfb7ea06076203436532e1599a95d31c5117ccefeb27c492ff3455c66810ac57aea5a70ec3658a37c3f8d56999211f8af98af4f080689b9acf92f6ebd75d395a6263f597cfb22992a4f9f0d69d429ce9ca202170cf578096748ed129a5a2e869f5b7af0d3f8a136bf62570b7e75865fab8edbfb2490bd9c4906b1b551117ef9bfb46028a11fbe7e3fcea075af2809340000000fd85d49a000de3f254fdeac93c4614c71c5abe496fe97209d3d3c73caa21009bf216fc139f0f9297bfc634df78c4d3e1bc77aafcd78ae5687263d2c85cdb6b1b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a068e7add9ceda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f000000000200000000001066000000010000200000002c4e9b4a57a631aae57dfa1d9817e7ec167aee45418260a345d64184db57c4c9000000000e80000000020000200000007aeb662a26f0537d67b47789aa4b988ec9ad5adc10850dffdded039d2e3adab02000000091d9d6e82fee6b9c97fa07eefa27a27c4e5ddf6b88eae6ac72922d4c3e105c0a400000008e296575b2a5e6c7d7d83829a21b2a17aa5b73da94ae62e91e53d9ba3a8fa1c52cf0e734f428dd5d09b141d06b20a6604e6f55564b59400c3a569c358b6640b8 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426345561" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D75FDCD1-3ACC-11EF-BF62-DA960850E1DF} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2036 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2036 iexplore.exe 2036 iexplore.exe 2128 IEXPLORE.EXE 2128 IEXPLORE.EXE 2128 IEXPLORE.EXE 2128 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2036 wrote to memory of 2128 2036 iexplore.exe 30 PID 2036 wrote to memory of 2128 2036 iexplore.exe 30 PID 2036 wrote to memory of 2128 2036 iexplore.exe 30 PID 2036 wrote to memory of 2128 2036 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\26ec6898af1683f3b6a5e3c956d8fd17_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2036 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2128
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD586c156456576093fe4227eaaa27e73bc
SHA1394e0ee58915e56b607217a343c6a7a50a3636f8
SHA256472323f99c73696315f5f3369177810bf51920be05c209d7956cd820a849623d
SHA51259293fe5630f8e0d9022a6801ae4f576e0eb814a0e67eb4eb4550f1cf80fce0056b66a81b6958f48aa48e3dfa6413c52cbe0a59d430154dd6773a1488c9a3181
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b94ed150e7a13bed7adb130f26a06fc7
SHA1df56c230a5fda58f9a3456c175114cfe7231f72c
SHA2564c21670594b1667786c770543a5d23b9a7eb3079ca12ef44f44c250e3cc5c83d
SHA512c152b1de59176098e79cacdb25d7c9658fc27c637fdcf3e511e24f14a104782e72803a59ada082a6f732e6cb59069856665b90519a7040d44cad0d16d9014906
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b2071207211e1f6d4ef93dcdef8572d4
SHA12323c79738173de44ff314d7a16f32c6432baba6
SHA256ca3f2251231cb7861b53258da6e19d3e6964c73132fee196101c1872b41adcc9
SHA512e92dd668794cdd4bd1def9228d814a1721b7b4da60a5eff6a08d0ae529cdac605f69a9a49d9bb076d965c2259e7a74b38407a09c1979dbf15c29ad8faf324699
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56c7e7119cce2cb52331918f02054fd81
SHA1cbf051d8879a1cf8f3f1d43de57dd006231fad0e
SHA2564f284629385096d9084b6b808c37bc4807e964dca503dfe99537427cb3e14b9c
SHA5122ee3cdf29cac35809a0e831c4d6c8feda7302ef5f2213034f7d24349ba696687ecce29acf4f01cc1439a85b12794fc4099bf7e97c1551418fe25e81c83ea6868
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cbb36ccc29b227b9a2c368d1bf59f1b2
SHA1b50fa8b41126fd10cf6165bf42c177bd003ce3bc
SHA256607bfa8db47c7900e290c62191e822d1903e51a84339dcc08fa3e85c00bd57db
SHA512f3eb6f6fed8bd65feb85e90900db00e2f5f11ef6803b5cffaf587873a7976843667cd415063b57f4047826268288ef22091d2d3d17da27d444e0c883e0fc6a50
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59a9e80e192dc7e339bb9c39ce0754461
SHA1a3a3dee31644cbca002d819364c0a3d2a0a22ab7
SHA2565b5b113dded8cc6ac0e8b6839c0a65672702d781acb0c0bf16d6f7770e05fcf9
SHA512873e1d808510d977cdcc86c5c95745b9fb4fecba71756a658eae9c6198689ab5dc87369af8271cc35382f6467d3569a79cea4a99256c38553f43b78edc8c6dda
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD521419e01a69b2100b05816c4f430e6e7
SHA1965ad5bd85332dc156ff0623f109fc95e09592cb
SHA2566056bfd14cd5d42f1521142a98e73a0b8521a2e0008486414e8c7d0af18fbe9a
SHA512ca075206e0331b6477aef3af97307715fc4fffb4fc204100bbbee0fe3e0a4162f141c1963226c7e6878225b44d74c1fb7426ff2504fcc3a4616aeac06c424e82
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54bce2b62853674090c088d6d613ab0d9
SHA105b24a322bbaeb7968e4af473328ea482c12f4e3
SHA256af014a561afca11cb78849fcf17be3734a98e436351838747bb885659dc07c63
SHA5121ac79815c415dfaded6b1bc5e3834744911531bd27b4bcb5b9764d1c1cf6897c0dbc276c87647f0fabb8bba31c2056936041ea594a28574274d9b5b048f3d4e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53385d53dffba95cd1cf103d1f7cab929
SHA17f23402fa75db7734a81213cd6a314696752cc7e
SHA256316c7b2b699053a1940816657472f408bb42c78ee08a41b20cf52d8070fa178d
SHA51295fa874a7e6b864a93090144f8fd8f40ab2ff12faedc3d43d22ddbbc9cdc714a067998cddf12b39e11444eb324ead51bbca9b91452e32daad2379d6240a0288a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5241880f37ae5415cc24de16d6c79e40a
SHA15db59f8fb4b9b2404d1f84b38f208c96e6f2078b
SHA256ff9cc30e83859676265bfdb6074d90f38a733cf8587fd40602f507e0a6104587
SHA512195b4c9be026c6586ad62f8f7f0df8bf04b071669d61451583f9b38ad34fdddcfa573988d9b3b1cd6ffc84817b7c720bb80b22dd1daeb5a8ed496cdcae5d6390
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5af1dbf1f6a45360df95051d0627126d0
SHA10349969ccb348f543ff11c2cf6c780f299f7b38a
SHA256ac5193b7057d391c7aa43420d6ff93492e233b8ebb5aa131cc53ba299ab3d00e
SHA5120f93390a1fb60cab9f67d4707fb3ae85c99ea041d77cb75353f0fb72f7ef6f9b3ecd865c71512c5e17c2ef2e30c8f3a9036077e850d80ebac31321dafc1e4616
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5698278c46e2cb92fd60e6368a915b7e1
SHA12d7eb20c400103d6e4f50b320bf044004ace9439
SHA256798e3a58130c906a2216095cfec83caf4492483e0114425e8adb762cada661c6
SHA512998b314a28d640edcf42bc7f3a240da907398850a508faa6b38c9fe9b2f7433da1ab670283ef4c73a07ea5e9685723bdebdeb66ce935e646995d15c548cbef38
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50dfab0d134f5e9a7a5319de407f3ea32
SHA17b35a82333f1c53bbbaa375f2da64564626a4131
SHA2564a0902a0e1b10b35b632c18e4ef18aae16c3db2e3c58d39b571a6efb5608996a
SHA512dbfceb9792c31b53ad4a75ed1308a08ec0bdf24913e9f53236e781b04fc13885148d2cb3ae79d49e78119c9e5b32dd154ba5e8483b5a43026d960552ac14e4c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5da58c74d4f3db29aad5c7c5175d1a6df
SHA19e5070d7fcf1750bcf241d37739237bcc700470c
SHA256b30256eb2f74ebdee107763b4633d0af7f76ad4a308574fe5dfd88bad99643dd
SHA5123c156c47d56cd2cc07a0adb9b94ffcb1b630aad346755d61d004ffb148c68fcb6e0aadf0b238bfc7bd8073c72c13c415511d4ce6689ef0fb39fda724633548e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f8b82f7fd5bb18982e1f1d51b2cbdbb2
SHA11521532284f6f40e852bcd8c71a403db57c77534
SHA256f99106e78b03c74963976f032ad716bdb5d071bb68c19aa20e19bf5014965216
SHA512ee8de50bfbedc13ee2d949d69c2501f4c0c6002d8a32c43e6027e17872b0d320b6cda02c0fb96afd00821f444da373e9ad53e771fb9ef484667187c1cff905b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51070f55720ee5f82f060fee81120bd97
SHA1656ddc8a14f6252e39e02eb03be8a7589adb2b84
SHA256febbba9d787008969376d8cc55d58ed260190f9107b5e3c243790acfb7bd031e
SHA51236bc2003b3d3b98b215d40d4539730fb1d14e4e3b64476fd0e11e98e082f7fec4d0b3ce54f4a734aebc4547df8a24df7351bc069b36b2231d782c7e8eff1ab4b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD588cdd827c1d3236ce3bf8dd18fead67e
SHA145f626664e7022fee5a0d09983dedac21188121b
SHA25672d8de7b77816f4f122782c2c154d650003079e78c275cf542b0fb8d9a99ecc7
SHA5122219ce0ee7aa400c3a95ebfe227be0136aebad1d2b739e3732af6991ad42b353d850585d6e2a33bbb2dfc7dee6eb230fdb7ed3e2a041db5ba9f6ff49ceac88ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD571e1051b775bce2cfb46c73501b5075b
SHA1f7988929517501e9e08fdccb0a7ff7e363c8f46e
SHA25638f60b3a948a213398ddf2c879a5c20b88e87286299de2f4e1935ed8ff35478b
SHA512c56fcf945290cc77083101b54ac654cc2f700ade51e43438dc413281e928f8aa60c9f5c90a69a32442fb007e8afd32d38388b5e316749a912ede261cf3a81bc6
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b