Analysis
-
max time kernel
119s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
06-07-2024 06:39
Static task
static1
Behavioral task
behavioral1
Sample
2795e38d95abc2702714ac9321326ca0_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2795e38d95abc2702714ac9321326ca0_JaffaCakes118.html
Resource
win10v2004-20240704-en
General
-
Target
2795e38d95abc2702714ac9321326ca0_JaffaCakes118.html
-
Size
6KB
-
MD5
2795e38d95abc2702714ac9321326ca0
-
SHA1
b1631523acd0c91b2ce17d7719560418f0692021
-
SHA256
cf77655629408d5eb0aea6703f1253055ce01c95c562277943b573c22b93819e
-
SHA512
ac9475cb1447e8eea96f00fff6b0045b26074a0f826d60740db8d05ceb8689ac3fbadf0229329e6a809b169ef48ef0acdd64d467ff2e877f7d3b5241a2ee7011
-
SSDEEP
96:uzVs+ux7vbLLY1k9o84d12ef7CSTUnZcEZ7ru7f:csz7vbAYS/+b76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c000000000200000000001066000000010000200000008dbb38b3f4b928c89521bac4b4d3e119ab4914a7cfda79a358adbc443b7a1662000000000e80000000020000200000001a070e4ba6ce971ce90581e862599157d825a82eebad7dd53b24375aefafb50f90000000adfa48d3ea64d396866a50288d1025638cd2d05e35ac57e7fbe0517a6e0b7f47c0d1bb16036e919274a5912c68997f2ddbeb0143b803600deed727c011116a5097cc2c979a0a92e26bc2fea7a99735a8adb3abf267c62e7ccaa3eae39ea8669fe15d34a72dffbec58f54ebdc2dbfdadf8161cade2c238a219356bab1710057c88a0493704146a3cc379356d34995bf944000000012c912532e6973ba633746e0792274d1ce1e6907b274e23ec7bd77749a3effae8c7b394bc24403f6e72e652d8c15d0c7fb129f077e24f09d5e782f9686f7ff02 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426409811" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6F5A7E11-3B62-11EF-9CD8-667598992E52} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1019f3456fcfda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c00000000020000000000106600000001000020000000412a7f22da95c546502913991d91c8d0c0eba240bfab8b713410033e66627df9000000000e80000000020000200000004aa5b5ace9192f1bcd9e397feba75c1156782041e037c9e76453f3c9d0362c5920000000b8ac73e965f6ca642f9e6b93a97f991f626d4d30d14eff100a1840933ac306f5400000003a5162cba3955e15da8cb7148a07e0f53c321a948571d121540b4a76291e4bf92f20fab14426da4ae1f56c84edea1feeacd1550581c71d7085f543de8a059118 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1488 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1488 iexplore.exe 1488 iexplore.exe 2720 IEXPLORE.EXE 2720 IEXPLORE.EXE 2720 IEXPLORE.EXE 2720 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1488 wrote to memory of 2720 1488 iexplore.exe 30 PID 1488 wrote to memory of 2720 1488 iexplore.exe 30 PID 1488 wrote to memory of 2720 1488 iexplore.exe 30 PID 1488 wrote to memory of 2720 1488 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2795e38d95abc2702714ac9321326ca0_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1488 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2720
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5fa8d4754f36c56fc20b4354f69524760
SHA14037d8accdc5ef18bc949f40ade527dc6398c748
SHA25625ca6670fe9303764defec3e8d97afce890d245347bf47d95ca9b0d03cf0f8a5
SHA5123f1245094a763a759bfd03686559d04cc86d030791461549758f381606bb2cea963d5179e97ed52a2497cb8e5275baac7383f8e3917dbf7c160eb135da70b724
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD57d03c0d57ebe7b1c8f50adab3707d86a
SHA13433b9b5e25db98ec6439128e4fbd246dd1a5e87
SHA2563139dc5f6d98d31e3b23d490d42ec6e22b43e6120be66f2a92a64d1ead0e9c1c
SHA5126348ebc567af67d479405d92e8a78e74d73c1c958f9e8e9a677514ddb10df11e8d389bb22e2b5d77e26a0fb187193599d874addef7fbf2bc98187d95c281eaaa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD564a7dd0ed4a6e133be01c40c411d67dc
SHA1304e7de635e5cf9758a591c2abdf7ee1c1a3541f
SHA2561fdaddbb84581bc45abae5c7a17a1ebb230fc49ed5ae93feb6ce509bde555771
SHA512337ab5171a72c5b2721b58241d3735109ae75c1f091dd106705ac659b2d002c8ec20135c4bb0a944124f5bf537bd8c20a9c51caf7b1060f8c046d393a320cb31
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD585e5ae49d5d6a6ccb9eb2986b9eff279
SHA1e7e5bf4ed5797ed7c9aa2e66297bf21c9b04c334
SHA25602b3f74e03c9bea876ae784c02cb4b2e9d5cdb3cdd5fd4d2669261980c7267ed
SHA512e9648a0740da2d10e9095d11128f2103402a8a2a107cbe0507f343f2454973364f0a9d38fd4d396261ca4bd43eba67aad1cafa47d71f998705af941c045fc939
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5b6f7281329dc8e65a9e515e7bc4e3664
SHA16599dd12df6a83b72e9b81be3d296570c9354045
SHA256de5adcfa4906fcb86c56fde4710948aaa29f0c23782a8f762a63777c90979cb1
SHA512dc19d5a0d8a5d408e3875a664c787bcd717296e20318b43ac808d85e5f33b408c3f2671883885bc7aa3c6f55b81778aa5410e7f6850ab5074b4632e4a6fa87ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD52575226ab3ccf9e45a3de57630b5a5de
SHA19573bb98ba392e57403d697e2fdedbbb83880e6e
SHA256c14529624aa66d6a66a55c5e4522d91c69161c5ffb32fb626e290fb16cfc1ded
SHA512eac8e3b3b10dc6c20881195e98f4f72611371603041e36042439c6193a8a7e743dae51289998cac086ba1ee70b46b38d31789a14f1851b09fc7bba034d06b8c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD511e724d58a9289b65926531dee492141
SHA1bb9924af3c5823460a14797ac263aeedfa1ca6ab
SHA2560b33f6a555a1d7d2a4275f99c1f880e9efe15969dc97e5bb256640e10b19ecb9
SHA5125004aa520e543b766257ace9ab53647d5b60e2ba17a9a0c2f6d8ccdedf7b212d6089af88a130c8cf64b4799bfbe0660521cab54eb0b40893e83d8cc536f022c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5267c2e8ff91b2d3b125fb6be888a727e
SHA1a5368dfa40333c4dba25cbd5ac22d460b1e2c9e9
SHA25664359d62b25c780c07feb7bb6f89544e19f2602d90c72e855021b156a3c9d749
SHA5123a686b81ab0965f3de4480a5f6e3bc0a0027b2fdc95c259af5abcbe2cf417ab142d8a8431c2928cc10c001bc699eb43c626f009085d58f727ef2942c42899d33
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD52c8c6c7bdc5657ec075a7e459708bd7c
SHA1a627c486d667417559f0933f40767b0bfcebf414
SHA25637ea59f0fe3cc1f0461fb39e08b464aca783de856aa739e0fcd59114b3ac5960
SHA51278685dca16af6c76a840142a2bafd739da61a45969ef399de16537d52e6bd4694c555abe991effb0ce05b93618bba8b9f1259a01b951e7a13009c869cc0968ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD55c8ea167f63e608859ec3573a43fabb9
SHA13fe9d3c1b5019621a8a743fb29ab68b8d24fc63c
SHA256b8b42470adaf5b5eff12c5aa7ee82357959c79c57a44919587949a1fd385683b
SHA51262fcecc72472858905cdc6654102f61184b6d3c4b2fa3617b92b6ff659b62b01ac7e70965e04d3e636388e9d51c1ac574b64e6ea3226c1a5ab4be3b54b041b18
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD561e6797f8401041513893608dc163043
SHA1410510df09511b67ad8db8b8a1378239755735d7
SHA25639bd7e350ee31c5abdd628f9c2b8bf90a3bbb3dfaae9b848bc689bb4a9a5710c
SHA512be9bc0183ed793fd7b26e67a8678fcea2a07d382b845f291f311f570ae29066c1a360f2a742d5e4f09501123ae40bd11d42c18f2c8ff372169d89e065bba6a88
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD511284bfafa3d6dcfc3a9e58ef5d316ff
SHA13999036b1659ca4a6b0a83f0882fad437367f75d
SHA2563e7c3357b2ab578d6337975ec98a2c2cdbfd06e4acb449c09da5f346a0709e53
SHA512d92e835e257d83d32eff977d2f7b3a96aa03f18c260038c893b3eff6a20a5dcfc0739f4313893ac96feccf7e1b986fa655cce61602edab6f265862048a55a4fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5ccc3ba11c2fde157c1f8b532beb86856
SHA11ded2d2dadc5e387bfdfeebac4f83542b3206180
SHA256d9b5b6299b1441a698d0b45e8306ee41e6b7fac2b21bcc33babba9d08516c54d
SHA512d9c603a7ec3cdccea501d1baf36ac9a16b40685bd95b76077ce54eb498788598d86bbf815dbc97c726adff95ae874763b80d4be17000f171a6985c6a40fcbb68
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD53893da787756b7017fe963e5e941fac4
SHA1017144ab0fa82053b0684400cae2d77799f6f3fa
SHA2563ea55e1bc398d9b86aaaf12931f01dd25f3ee03b2f3128705121623e94fb00d7
SHA512cadc68bfecc8b4c5e62fcc6a1b1179c9e54439abb4a7c76bc25980f265b988d344f02ae2ee22ce511a8ffc80de0a5e8111d619e93c2e4a027cb0b759119361c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD54f132cf91fc59949f62268cfb221a834
SHA1847db8d77360c873d72d70cef9e1ef33f02ba84a
SHA25675de2448667543e818b5321da37d38bd0a30fde789d780e1c2313a19641473c1
SHA512f10d40234af8885ec5f49487a5f78d4fcb8985b3bc0e24aa0000f0b34ece34c4cf36007265744ad336efc0eeedd3c8f3939cab88c04ccef2f3456e815a2f995b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD59c8eaf78385d10d48f3d9dc849101461
SHA1f547ea291db6b73818e10bf45814d87a05adc81b
SHA256d832907fd3ebe63ea4d96076ea4c638529821b77cabd3a22d672f81e821f0dba
SHA51287d22c157dda5b2f642bb19654a6f2c75ffe4597b8516ab4eec47aeb35433b90d631de6510aa64de92ce3c3c87b8c85c12f111590492ede94f921c34eb5f0f3b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD51b57530da4f4573eb3953511dc6e10d1
SHA1b916b2d087c3721386f730c926a719181ab60005
SHA256b9abc33612e24efd9000698ff22582e37cc08543712bea965dfcf987fe254d81
SHA512d1686f7654e571a7f79caa1cc1e50eb46fedb2c41b8f80f92e9b107b778c2a0472c21f35bb07dec99eb9cbc168ae3e6c18c9498c3275604bd7cc26b660c61445
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5948e03bb209353d09fb7574c9e341593
SHA1438867b8da21b16d080fb9dfb063aee4a003f3a9
SHA256e3e7ecf1b327935db81050abbe2762aaa3e6e1ef8b957db48b84ba9cac7ef0e1
SHA5128e7a5756b56ccccdc012ea4572c27e558d39746152ead2590f18ef836885ccb010c0f69eb95ea8e3d056326256e8a1c334ebf5fad4e2a0212682d0fd9eae0acc
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b