Analysis
-
max time kernel
141s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
05/07/2024, 12:36
Static task
static1
Behavioral task
behavioral1
Sample
26ead76e38729fb92c2bae0169f93773_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
26ead76e38729fb92c2bae0169f93773_JaffaCakes118.html
Resource
win10v2004-20240704-en
General
-
Target
26ead76e38729fb92c2bae0169f93773_JaffaCakes118.html
-
Size
28KB
-
MD5
26ead76e38729fb92c2bae0169f93773
-
SHA1
1500185db6595a309a60c252f8b836741a645917
-
SHA256
4031c2251032030ebe121cc78167306562fbab4a42a60b5d3774fe3a0498d767
-
SHA512
e50ae0854157b660463329bd3e8968d35c552a639d9da21ee9bd50c90a81b14a620d23f6863ebf6dced2f1472362a6fb104f1dfe82a233b1d59833cef6f38507
-
SSDEEP
768:Zcd9QZBC7mOdMMdpC5I9nC4dwAwXwjVPd:gQZBCCOdZ0IxCowAwXwjVPd
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{245541D1-3ACB-11EF-B0EB-7699BFC84B14} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d01517fdd7ceda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000440d4a9920183ab3e7046866170c5edaa897bec8b796bf1bd06af6a4b9d6ff22000000000e80000000020000200000007eab9e5479af722256423e1df72a68a06965b92c7ae4f57c3b6ee8393411ac69900000002ba7d873444ec77e9b9f8533127da3e8b87acdd1ca52686a1dc5e5ef21c794512b48e599c5167619cde741a20f68e7d271f0d2867726fb35f40cd52785b69d54d0cc81651e896a5ddc0539a1a19c5e13269d6a5aacbd19567e434e0b0b5a77429514a55db6750790f4494a426214c88206b8dfbe92db66dae7c4c4e7a0ede5e5672ecea18b774df3c4c7bf23e2c787b140000000e9506067fecb28f6a9afabd6e49cb8d66a9c618e147fc5ce995142d380d3f53e035cf02aa6c5ede8d3ecfd77fbad35d8ee2a62b5963fb28fb1d96f3fe811ab60 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426344831" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f035510000000002000000000010660000000100002000000037fb204ab2cb7363c99da7d545327b3ba671f7955b96fa2d81234b503d400167000000000e8000000002000020000000ddd4fea501b539a28a58d4b953cfdcc9c2578c8e61cb6257e50462251b9c5d91200000004dd79761d5cbd004eba20cfed2884f4f9320de327650bec145f0ca3c1ed0601e40000000c212cb5151a4ba62fe9481034f6f30019e49191b57e409159418ce0f3c40808584a03d1d0451f1920b6ee0a5d41b6ab09b22facd9767d6e1e400d5eec2475b55 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2248 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2248 iexplore.exe 2248 iexplore.exe 1936 IEXPLORE.EXE 1936 IEXPLORE.EXE 1936 IEXPLORE.EXE 1936 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2248 wrote to memory of 1936 2248 iexplore.exe 28 PID 2248 wrote to memory of 1936 2248 iexplore.exe 28 PID 2248 wrote to memory of 1936 2248 iexplore.exe 28 PID 2248 wrote to memory of 1936 2248 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\26ead76e38729fb92c2bae0169f93773_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2248 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1936
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50755a04ff604d576ebd99634e9400946
SHA1905a44d04ded18e2be4f4ccb0f4597b2944e1eb3
SHA256c4355161eb1ec3f7e809e4ae78ac95c5e33368f545c2d9a5e5a619d2e31cffb3
SHA512386155f632ec4ac5f2ba1362971f50434e26fbd1190a6c475b057a5bb38d004e4eea16274f4c19ce0155ecbf1e998c43926492411db25e3005d785b37601440c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5295991bc7b6ca8656b45b076013da22f
SHA1fb3632fc5444d7f444cac5a8b495db5b86193535
SHA2569206328340f2b93ce170434760566ea18193b7e5ffd32bc424546aa459456c79
SHA512ac6d19d281dadf99a0dce4ed8c8eb90d14647479090007651120b87affadf0995565909150189f2fbd7b072a22aac323fcf92c33b875a5a2bb2710f81e3cc7b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fbd4e740f6855689faf971da8323a871
SHA1477a69a30abba7df19fcf857988b16f4826fbdc9
SHA256d11d56e01fb5c6bc6fabddddb5a171a3de9d86c27691886df0757dfe98f29971
SHA5124468e0b18e9f687f7697feed3108dd74e49f77f31d59ac6318091d19919162dfb67c1364a8dc12bd1bd46ea8132c72373939ab8d99a4c35b12e2a3f4b370a229
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f114d9c009f1f354856c605582e89a6d
SHA1e83c1f594178bd58ca6470d336c1096a308f87cf
SHA256e422e614caa6073752c5cfe55539cdbf5d137927067789fe9bf45ce176eefc73
SHA512986a543e95932a47e4f299207f8785e4a6d31f1eab4b0a0e7348b9125b0e2c76389244e802000b35abcbf56f8a659ea7a22641df880463d58fe7879bbfdd584e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e40d4ed458f337f96251d24c7a353ea9
SHA1568127b3f8ce69825b227513fcae40c9b6bc7fd2
SHA25671252c6cb310cfcdb50930abcb6fa982ccb7fb9a45285ca9146b319c1dc377a2
SHA51288d139c080d2ed40b1864ebfea99f4950cc028f83e532b94a21c97633aad2c4099ea02bcabab69f66edb8cd4fd39c18d4f065adf8242a509a78f5e80dbc184e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5784bfc096e1d3f463fcf06739432984b
SHA10170c78070c4e40fa48b01b6a92df67700b9e89f
SHA25600445625df2763d0e98121979a5c353c6221c458135af2ca397cc844e8dca9e9
SHA5120d63bbb56f035dd865d286a4172c72b4909cc568edb94e8a4596197a514f253453eb204ca5fde3e36c495af49c9ae8e601678b95604060168172cb873feaa1a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5720f16f243fd14b6aa96f35e6158d0bf
SHA10831a52b25449e5ebd355cb00f2cd6e613370113
SHA25645417840ee4626c1980023335d8987e1626b0e75073ed54bad20e3d2d7213319
SHA512065d42193b20f87aa94725f532cef8fc569c9a3ec7d9b37e13d4874f8e3c2fa989091a99d1469e12c14fefb66f6da9db8542eb98d20af57fcaf6423e5f7c93c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aa59d5b8630d91f4df4f680296cf8dbc
SHA193ae7d613e87d8e17264e8e05d4d5aae8d0c61fb
SHA25654318401e2d47671d655317dca97cf606e808606b69bc11f6f557a1212d8f050
SHA5129c659eaa81504e8dadeae2b82183b44cf9110b1a8c30fe87ecb9fc712937ebfd99d89005b853a104e6393c5eed7ecca1d6a41e893860debdd25cafe3be0f40b7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e290a020ce8d2db33c911676be22263a
SHA17a1a18556616a76fc8c33b67548d8a763d369bea
SHA256dbbe84493d041d3e51e24165d5665488bee2aaf9657d123a3db06c18ca754a8a
SHA5127f3726f0eede0a683ed3a13b066ddf0765ede9757f0e45e4168eb11379d66aa8f1722ce87523832e2d7835e124939c83bc7777c2f8020bf0095c2df4b1a95aa7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fea2e0d4c90b0fcbf855acfa80925dc5
SHA19f934aaa69b09d446434ed645ad59936afad4db7
SHA256aca157b9430e687b63cdf34202fe164662e48ee6919b29918163df041346af67
SHA5129d091eee2ed1b86ab669e0fda3d479b690fa26444914748b81e60455c964a3afc5bde33112b24d545a64bb3850cae207def190ca7310e65158cc276f6e4da114
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55fd166963cb1bf1857c0d58ba4ff02e2
SHA155a435993a66a1e3cd524fee1d85d934e46daba3
SHA256936d61c92b62bac9a76e74ae7a6c9b8d61033eee0874f171ffccfc0c961727eb
SHA512dcbfb61a25b191cdf3bb88365beb1873b41250acb42249c281782b896dd38a7aa30cd3b6578bf057d6d35314e3588171ecebe3ac736c31c1d881985f69752a06
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c39269435d9722e7623149fe28aa44a4
SHA1c41e42d3a5ddba6db9573c515fa170052430f839
SHA256be125d7503c873b8b9f02f624a0e9ec5c44f21a1dd76c04fd24e1d5b1d39c24d
SHA512c862c7a0e23750cdafc1d570d96e516197abbbc55b727b587d04898c0d6310d7fbe2aefb9a004092159bf9722d46ec17d3177092be49a3e74af2febfa8efb684
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58114f72769b9ed017c58259e63048b47
SHA155bc879ff4b3d92f7ae80ffdae4f411e468aa08d
SHA2565560dbaef5658c1bdcd136789b766cb7d6d5560815f6d5e4024e42393adc0d25
SHA5125b39308a1b441791ebade656bff33c576af8ef060dfde022fc01bf588afa498c9dd387e4e99f6ee6eb9ae623875caa3f5722ebd6ff8222caf6d84aa08b1809eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b4ce4addd9ac333061d285d82bf1167d
SHA1dcd23672dfbebca0249facf82ca041fd0a7b22dd
SHA256cfaa9c93cfc042bb72817170d3b774e0de8fc855478ecbfde5dcd8c944cc18d5
SHA5126713e4438cdfb5ca15c9eef33c245d1b5aa634a3e77f0e6e87a98555760edac254ce23e3d3bf0394e17371ba53457c481295347e6db163c81edb4f09258f09f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fba54cd1580f4d0601f6f780d68bac67
SHA1e9be3b739f1f97f151d0156f5574498a56a2ead8
SHA2562b9e81d069c7a92f6003671f02403abb16a8e37d30f958cd0824b18dcf6cafd8
SHA51237a182c62ef3f38fa3dff33059b52bc5f475efba606861538554fa64aff20305be0d6462ce7d93b1f6a5ea52198c2630162b5ec6e3e868d13c4ffa7de71ff9f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59a783261b18848587c443ef63fa1502e
SHA1e0de89efca073d85a286986215226953ee8fe432
SHA25627e77f3b0d9a71b50dd7f43e9fb885690fd6c52dc9a88f5e54f6de6cd6a6ae6e
SHA51283721b5bb3ebb2223977a4adc41edebe94e9f07ec7abc9c810e426d14fd8cb81ab65a7b059263d8dffd8844b1abce4a3f61136547ce734eefd370518b53d687c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50f5ed00a580d3398756dbf7188923b91
SHA11379b3c9f9c5d34fcec1a8c7b3887569c4400fcd
SHA25681e2341765a475acb95b9f91b396fb098b88e6fac17ac7f4103c4bff072333ea
SHA5120e47e1627be905403683f4fa92aee49a0dbf6bfa71123e7aa410d78e22c4177a97cc90d466078f81a2bac828c2d30dcf9ec4e5d1b46c6eef6607792c3863326a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD542becb0cf533c71b4a47d46442440b15
SHA11c3e9a3779a8526a399c488256a1d7a53ebb94cb
SHA256814386f8b2575d1ac8cb3a569aee5589bc3c839b06fffc1bc09c08ccfff164fc
SHA512aba86b5da25953101992018c89e86c3499587d22272b660c3ca9592f7bca242efcca95ee8ec91180d45a00b71a76a711b6eced5b8dc86ad166650f0f87ee5dc4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f48cb5f7095a8084b53ff2a0ea053573
SHA135bbef024455d736965ab2f18feeb22a7d9f4c8c
SHA2562bba03743fb560014f50d6b4dd50940e4bca1dd15284e2887b877321cab9ec39
SHA512fad1d01c93a116d65e95a863562d771cfdaa6eaf3397db2ecfb2a5e0adf0e4794d2e7bdd80868713a63f185be4f7c379d06960cd4a11494691fff059c6db56d9
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b