Analysis
-
max time kernel
73s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
07-07-2024 23:18
Static task
static1
Behavioral task
behavioral1
Sample
2a23297672c71375741f0f96103d9da3_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2a23297672c71375741f0f96103d9da3_JaffaCakes118.html
Resource
win10v2004-20240704-en
General
-
Target
2a23297672c71375741f0f96103d9da3_JaffaCakes118.html
-
Size
6KB
-
MD5
2a23297672c71375741f0f96103d9da3
-
SHA1
f4be29a514a08618e1b59d54a9bea4d86d5b1d0f
-
SHA256
d9887cb822b9b6fb460a5a6775c3b110574f84d41730da2d507b693f0d426b4e
-
SHA512
304fb19532ffdfdaf9f985a3eb57286040bff7c58436755f97518dd24d048f550b9ee74a173cb51047c6c590f3edaa90dd7594d15a37802c91626aeceb625fb0
-
SSDEEP
96:uzVs+ux7QvLLY1k9o84d12ef7CSTUJn/6/NcEZ7ru7f:csz7QvAYS/i4Nb76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000007c16a5e726988dded518f82469f9c7961ed8cd1a079e65ae8f462f2698e4c8c9000000000e800000000200002000000078c53083e406e312635e7b162eade0c53a8027e0f24f9d767e9d0723511ffe332000000023aee82c87c3a1eb34ebe9d09ae5779de34bef49700a305a1a33b24e9ba1d9fd400000004c6b0e10f11f99a656cde22c5fd0a878c9ce4f69afba355849d943759a6e69dcad2e3353adf5f5e66ae77a8f234a0d61c71d70dbc5621ac53dfc8df9929825b4 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30f1cc9cd1d0da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AEE7DBF1-3CC4-11EF-880F-D61F2295B977} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000f69077fcb40e750431960ba71c99290d0a25d6b15973e6a234ae7a2a68e8db74000000000e800000000200002000000034b7bb34b8c8e1d743d33fc5da5096ccbab8e31ef664ccdf664b71e36674540a90000000f070bc4116a17bc30231237b1efa1674a85e9673fa235c2b9484c9349d3fdec2e164d2bdbca0ca624449af19b12085fb754f1331eae0480c0d4b8538ae72bc32f0db597994b7a72ecfb87a9674664769be49dff371dafa97b522b283e781a9b1904580233304ca0d1f6f555118f8f6e2bc7bd52802a774dd69da0164c4ea7b1e2594e5500e5c0a251a6ccf971922171c40000000605a66decc92cbfbc77383449f479c6bdcbb452ca1f27a795b3e0cb673e193c725ba093d98eb2476eb07d447b3f2a95e86926c3e0ef4419d2f26999f7ffe05c1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426561960" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1848 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1848 iexplore.exe 1848 iexplore.exe 1248 IEXPLORE.EXE 1248 IEXPLORE.EXE 1248 IEXPLORE.EXE 1248 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1848 wrote to memory of 1248 1848 iexplore.exe 30 PID 1848 wrote to memory of 1248 1848 iexplore.exe 30 PID 1848 wrote to memory of 1248 1848 iexplore.exe 30 PID 1848 wrote to memory of 1248 1848 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2a23297672c71375741f0f96103d9da3_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1848 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1248
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f0be1bd8427944ce61cb4529f7c0b3b1
SHA1d90fbb321f76a07fa28540fd53794e025b625805
SHA25619e78e729c3673595b1bc4f0f3dce08001e050ecff897681f4bea4fdff28c2b7
SHA512173867578b82e1118ad1a6183465941a774711c3ba245707955e25f73dd4f5a3a8e8e2c0b0208d06dfce811cefb7e359d8a3af35d1b5dbe1c814597d1f92793e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5135dbfe0bfca4f732f0e2a405ffa1ecb
SHA1f7274f71bc1a3860411710e0eedd31e16aedf3ff
SHA256d1e36101b8b32966218f9fc2518fb889225d7e1ce32a2043c585384616b602a3
SHA5129254fd0952659e9933d30daec0e998a828ac2c0569d550b84f9da5d389f5c958be62e69161705f4fe3d5413cdcf553a5d2e15faf5d143b4c515c42429068771e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD573b2bcd4000838a85cefe57def2758db
SHA12310c25a63a0d9224ef2994138030c5ef6e4ca02
SHA25602cb522e6002ea9dfd3950c53e155fa74fbf810026274f3b9f78ea31fc40bd11
SHA5124b1554fb37ea9cb1ad0abcdd2ead6e42b2731477dc47685f98d771e949d8c5ae083ef680f7a58db1b4652ef6b5484a5ef3cc3a9f738e78209bee6998251a47a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5de840470551da7e8846c09f50aff1c49
SHA1ec31159519cacef0e26e2ffb1b59b3e49c165fd3
SHA2565502cd45a92b9c9061e36a11537663ed46ca52d076deecec283d4a19ebc0dfd2
SHA5129a401e98683673907e305cad2fef1834d30206a7719cfaa15b82cc5a2e6d4ac4bf2c7473aa67b4c4696d35bb2143af913b323ec869955913a4207f1ff5272afc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5826cccb681b7d249bc15adbd11202ba7
SHA19f66814435bbc6eda9adc33f1b5fac8a88242a9d
SHA256507b7f9f8cd8e2fc41812ade0fd0d1cd930a05d7f10c2593c9d5944222ac525f
SHA512b456cf3829d25cadc61dbecc4c7d6f063e8050703b765f95b2affc082f3c9111d01b9556401d47783330c1dcdd2c1aac2cb33224e47986bdb6670b74a964beba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58b7bcac4ee868b2a7f1be623771769ea
SHA1d4ca11c4130f0598efae4ff3f20b3c6faf691010
SHA25602fe1bc4932db4ac312ba9b243634fd1631d564262d0117890f68276d2910f1f
SHA512735d85dea6092d32684719829f332d60867efac10c10bcc02fb4e738afd3fc3791c023be2cc60e36c986a9fcef0b74d791d49af010a9c6c04704ea851dbdc79c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD559302d1f6395e5b189d414be689564a2
SHA101934f575b3d5cd571f331971c80437889753655
SHA256ed0c4d75f467badaee10dbfb437bf8ae66f2514bb74d01314ed73abe08534ce2
SHA51219c4e64d5c26487e33937cd5305b3d26a88d3634bc14cef3fb69aa7db83bd035006f1ecd6fec04f16aea89cd42d5b1d03ffedfe8af82211bceb294476787b28a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f4887682764c17c5fd9aa4903b1b438a
SHA1c7ca58095a0083d8dbe5280373765bb52f9015e0
SHA256ed0b347c4f4b0d3a38ccd5725d3f8bb09b3c9180e7841f031ab8e6398eef8e0f
SHA512243867c3cbfaf6579825b0ca5686592d5f82f2788fa0c33f1614c1d789ccad4ed15aa30eff3298b766a0ea7205d22ae3e1a12039a9fb1507587ad2e14115f875
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d3b9e7ef549ac41672733652d4f2961b
SHA1b21b8156e6598a5892f11077c89b5501bc035735
SHA256588af3ae0714cd54dee353225f18ba73e868e56ff72d204af06e0084411f9eaf
SHA512f536f695a296abb48639dbea6a73a8144a7acad6223579e7d5e9d2a9a3c70d516afb8e1c22721eb5a89defb019ba61e2ba832d600344eab5c7012f95ab66b971
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5629d19ce685f6ab4c385f1801ad70fca
SHA15295a1fa4eb4279337d82f906ae7825a68c92619
SHA2561f412d35e9cf2b32e06147299de89aec34da01021ab193d9b08ea4285bcc3d78
SHA5129347f850ee0581f5c9e4f21413db80cdd00d7a35ef65ed14a936dabde3bb768032812abcb27a6bb3f992d28439885991d57e8340f51733b6ed48e253182edae8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57b81c65db4a9bb99108e639a7ae162d2
SHA1680d6d17eb96e006b3a0c0391f999ac4b1a1e439
SHA2565e5bd55ef07c50665f9df87193dcfeb3c474d3344ce315431ed5c724fb5c0942
SHA512538087b9687d6960452b1c1fc85313ac31344d144c76f00e18950cbc7fe8d072e9c48f950c700263ab152bd0a4ffd838cc8a8c90caa355f977cffa8163ef2544
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56ece66dfb0448dce48db0c0a9129a20a
SHA116e038835ed0041027153292278d894f78a227bd
SHA2564569a0e68c0156c0bde521ccbdf261baf3fb5a489e7ecde1c63faefcef1db969
SHA512f950cb4e5ea04293ed60590897606c1d3db2dd0cbdc9d7619bce65b1f999ffae96c184fa41d028c57415b1bb373646a800a37ffc34b6e7bd34556b2ab4e4fc1c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD543ea449f83fc12c5527c4d527d861601
SHA1ea5344f6d5b486bce31ff417111e291650efea43
SHA2564381e614d1cbe5b0f406333db8df86966d601c1839c0701fd3a2756629576574
SHA512a811a073862235b1ab1333622a5ae3f23cd8b24a75b2dfeeacf4afa976f2fddf5b10f76568a23eb0a5d96e02f189a055ef111a89a75e907dba1d2f8bd85018a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5487a2aa790a202aacfc7549029b4ff43
SHA181179c723c8b85a94529abc7b4b420656a2deac8
SHA256cecc8daa6aea67447320f0f3cd0da38ea203718c9aa3a4e62989c411356ba842
SHA512acbcee9971d68cc0cb2334a1886dbfc6c72a9a2b32a22360706d0d1f1a12683a2224fee490c0c998f39bcedd465342bed14bd17c8b7c4bd5ee207e3d1eceabc2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD595f72e6fbe086b21506741b665d11c21
SHA18d0bb74f6ccffdaf847ec5b8d0691e777a4532d4
SHA25601c769a43f2c8c2ea952f3d57188d91792455603ebdcc9be57b691d2e5c94442
SHA512cc3bbee2cd80bfacd3bb2ef598ec9ea0b26eac006c51488de77d52a29774cc3299839547a84622a1c64ac848630c3b02d4847dd23a25f6d34d7461ef9c245ce9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53826168ede77e71288280c679a1a622e
SHA14ca2d0c5121429f8c0e45471856767f7ace8acb6
SHA25677ce4b33294f792d8300357faea97de4384f74b9f8012644988193d67e0fb9fb
SHA5122324d22005734a1a8d38035da2641b63a456454dac2a03d0c795aceb1a52e6575a52b291e20f233479dfa5db3b83827c89afc3de2af9b27db0cd7523e43903ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e65a37ac725f03441a699b08e8e8e95f
SHA10390dfaf3efe2784b1a7fa25dd3665d524eda000
SHA25651dfaa996cf7861bf308223f4e32af29d1e690232ba3013ea78e47dc3e0b4d04
SHA5124dab6c2b4eac5ac84a651a9652476f91b4b4d9109bc5988bacf7b1a95096debc3354e29ebc3681b3b2d2a6f4a6b68207f069975d3c5eb267e9ad912fe37afb89
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5564c483f82e4b9774a7e8ad3214dafb3
SHA1fd35a49c9662212bad7679c25d8e41f37f110fcc
SHA2569ed3f57ed400262907c9b17ad5301aa358e3badb0ac62efde6b278f7af780351
SHA512f321d7fcbd47bc4a7e47f99714915e11c80fc982ec45e18b2a78d1c788a5803008076975d5f1ea44fe3bb98e13ad3bc7ab48ae07d0e58ba1bb74e5a311edc8a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52ddd0a8badde94f283f81c32a120bb67
SHA14a74a43869703494c0f1c80f8d2d1b7584301e69
SHA2563fc9e4fd48064dfd1b0c8c717118aefaa82f7b07f1f0cfe6ef6f076d0960aac1
SHA51292604265eacbdb121bf71822cbb8841f9e858220962b752ab800338236d087965a863ef72ff9e126b8055a609419b7dc163b05a70dd8f2381ab542ff86e40861
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b