Analysis
-
max time kernel
121s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
07/07/2024, 03:42
Static task
static1
Behavioral task
behavioral1
Sample
29b596bafba2572ab92b84c31bb89f58_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
29b596bafba2572ab92b84c31bb89f58_JaffaCakes118.html
Resource
win10v2004-20240704-en
General
-
Target
29b596bafba2572ab92b84c31bb89f58_JaffaCakes118.html
-
Size
63KB
-
MD5
29b596bafba2572ab92b84c31bb89f58
-
SHA1
b92011b7a2245128e424ed4c7060d44d91e213d1
-
SHA256
1dd77bc650475695309f1df7fb9496a1034e6c8da7fa5cc62f1a3fc801fdad6f
-
SHA512
3e0ec37ec1e5c69e91cd4fd1a13cce3624f06cf58bf7c5990900241aacee682e0e0b2f485ca32ef2fa3220892dbfbef22fb8097ac9f402087df815516efb8931
-
SSDEEP
768:ENG7t6P6pYbcMDV3UP21SIdOuaFJeqg8X:3CDV3UP2a9X
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80dcb5b724d0da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f03551000000000200000000001066000000010000200000009ee1635b6ed42f5e9bbc9b129ca9dbdf36595661c777a0785d4b6d385559a8f7000000000e80000000020000200000001ca908e687487d2dbad90c17c7f6d44be54acd1aeb2539946fa582a99df2192a900000006c94502cd20fa0653b62b6a36a03380be1d4670e8158940b78abc65cc74b564ffe702eac1281dcafce2027af405d34044b137f168700d1fbd5894731b5800b7e0a7069e2c51700b68ad24c68b63cbc6850a356e4e2b1aff59a8a6bc28b7ca5c39143f96956766bbf92140284476e04877c02c664e1d950ed748417dc33d1b1b54b530a3a21cb8f45d7278d6ae1dd6a57400000000eac6f0a613ee75e1e00091642d86f7168edc6a082a54e216d661f5650458be357feb6ecb700618a3cb9bf6302708b336b47526056737b4a22aa4ea1df0a3c8c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f03551000000000200000000001066000000010000200000009841897beb64d1f26867e58d5cd733eb76a3677d2de410492619ae4a7cf6f3b1000000000e800000000200002000000000b75d5e2708d415da6d3b2b5ff4ffeb762302ee1d2357f5b8007f83a923480720000000a4893acaf6875e8dfea5e362ce412f34612637b1b45f751c60b551313be444ce400000008536388168ef117f4eb5fdff58d0dc0f25d711d8fc4cca3a058aaa8a5bb4399bf04930be288c7611f23fd0532ebc21371c3deeb5179963b99cb5014fbd5c2a22 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E3198E81-3C17-11EF-B0EB-7699BFC84B14} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426487744" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2232 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2232 iexplore.exe 2232 iexplore.exe 1652 IEXPLORE.EXE 1652 IEXPLORE.EXE 1652 IEXPLORE.EXE 1652 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2232 wrote to memory of 1652 2232 iexplore.exe 28 PID 2232 wrote to memory of 1652 2232 iexplore.exe 28 PID 2232 wrote to memory of 1652 2232 iexplore.exe 28 PID 2232 wrote to memory of 1652 2232 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\29b596bafba2572ab92b84c31bb89f58_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2232 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1652
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD537442a1dbe59c234d6366e90857d133d
SHA174f0f436f09fe960817d518e5a5ed0253ad2b4ee
SHA256381e2d34b9c553d7989a62f4218413a12cb872970ce312d4c08b7ba456dece25
SHA51291386f062a95d3bfb8fd6703ab12670063d6ea5689b2e84067a0e56d1b27dd7d83f69dda9963818bd7806996b2fd3156ad75b8d71121cf866eacae35465bfe66
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ec9f7b329eb54e266e57f26cd903b738
SHA1747e517d957b45a949b00266090b37fb59476f03
SHA25684f144df605b02c2acc55116f2441894821fec9a65fdd222510518dac4dafdb2
SHA512ac70434f3651699f7b41d83f6eb8af3158870d6762353573c8c0feb43ef994611c64352ea0519dc577f7015bee502d82325b5bc3fff41f1a09c53b2be6a31cc9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54d4c70c95d083ef8b7cb9ac18923cfb3
SHA16b4454aabc71e7a29eb87e672cb818d291ea43b9
SHA256dfb6146a7668d516d475b3bb27920ae006b309ebc56a4aa45bdedc9989fdd428
SHA51206d326b155e6599cf1e269b1259bcea236d226275b8f8ddc9775ef3f86fdd7454b271ee9dd2857230ba71133f6b3145bd103ee16e5a3db906658ed746fd8b10a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51ddf7eb1b0f92f2c68627908f3f6720c
SHA108b1703c00ecd6e1f8e6405a4183874fc11b6436
SHA256b1e969ca625005ca4718364bed579ca336137a3b9f2cdcd6f0993af1f0dc845a
SHA5128356a577df2f417810c1a39804adbf1124a0022dffcc3bf454cbca4d36fdfe91c1a657e2531dce7263f4431da67e68bff94793e4fae918afd856cbb71d812e0d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD562d212b8891e9daa6bf44a9199b98cac
SHA12dc08258abf301e2e1bed646bbafa5a969ae7fd3
SHA2568baa4c6ac0af1c0d0dec9b133deef70a03f40548eadc2aa536f8ec1bb0cc7f01
SHA5120ae2b7f7b22befbe1ab9cbc5f1eab8bb9999217b97303249dbd4038ba94f2c1500151ebd03b6a09e95b45eb6ec0cb1f0e73405bc0ae9c57bb90b9a72671eab27
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f03a79f990bc8c3dea908fd0f886e493
SHA17374b9d1efb00742975c3176075fd49615a342a4
SHA2567a75cbe0cad3a91fd22c7f0890a94a3b7a9c8e16b2a8f4b7d5e6e6ca5e18f2e6
SHA512339c8112818501e2a1e3c94e6fb662b2ef54c2331c712191b2ee780cd8c85e4118791774f5cf86d44357d352fad0a53e95d3660a14e2a6c11525c66bd2af3c1a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f5e8943d7dae2ce13558274b8b0cbc8a
SHA16397ce6a1a07a63eddf8c0011255427590fe7229
SHA2563b2ad70d2483e6104daca88c792befbcedf5372694fe258563ea7f6db3166075
SHA512f10874f0b418d2762e9a8481aa4097e4a1a9285cda5359222ea9654da51748b8f7a4ca0ee3465db41e579215e899b138f5033f966388317593e1734c1c044f2c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59cc30787b0b445e8713cd59ae7688f07
SHA16c215c3d595ed0a68eda52c288edbdf7a7d3a626
SHA256e270af63cdc04f4ecc81a06a8ea2a4cae5359906add161eda80c1c429ed246be
SHA512353e742ee4090a2c303697098e1c1e24e3b767043043aa7aa8b2709880677ddb21d89a0c631ae04ab2211e4bd999391eeebb15ec68d7f89bad8ec8d4f9345134
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54e272ef4647f8a2461722e5e1cf2b383
SHA114ce1d53b5c88967e2b08e6e334b29ecbb15ebbe
SHA2567d452a252d00aa0f40f161140b24547848bdb67e3a980a9c3abbbbce6681b40d
SHA512afa764c3e38590134fd56e014c9eab0ee2bf7a92c2bf0c6709a711e0f2663a00f2c3955338e662030d297f53318c8677cbe1c5a455dc64ded0eadeb1a08ca652
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55a308639c675518b62ebab33fcb461f8
SHA156d29f2d74608995c3f783f85550a1bd6fff3ea6
SHA256a4cb0473e5e0dc554821801551d97591f0027a4914088d20a3079be6bec629cb
SHA5126ad47ddc70425852a145a81a1795fb56918457cc8e9690ed58addb655cfb349e778038497da992006ab0e0d140992d80ab415957144a7b1a87ae0676a37ea258
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ff0016d30a84198295aaa092f6f903e9
SHA13691bd39395b191220be3b5c1549f433eddd25f9
SHA2562f5c37646db92d9685e58ec9275828c1ffb1a22c367a96c871efe0613905d17f
SHA512e34b324607a060ffb279922099928c066dc408f04a17a2933f7d5b081e6790cc4e513714e300dad1a86413a4adec165b4c88457ba21a660da265afe4f95e90ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD557186874141eecddfa2ecbc559c29b70
SHA15184a79b67a88c4edf7dafd7396f3d6697ae4f23
SHA256bbe87e9bbf1c4db35a7b32e48beda18c75ae23f90f2fd69916179cf4094803aa
SHA512caa4c59986e55780243c47baa4bca5e5357f5ad1620dd5a90dbfa85e356b8a8467f20de47de64d77bbc2df523b30a4c9b262397cc952fd35ff6950bf80d75cfc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e358f4454dfe0da4c403377e1311f47a
SHA16cf51707e090b734b56c0dba57994555ee84219e
SHA256d9e67f5b40e3a3defeeb2ac168e4b0de2aafc8d503e0ba165bdb97f18ee70822
SHA5122bb38f981bbde8a12387ed46a9a5309c5891aa7f876012f594cfc0f047cdfdfbca3b63943d0634e733a9da0d206bcc90658b000137dedeec6f34490078419496
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53454609ce3ee260b2cd454db9618a3c2
SHA115a0b8d650020eab314f8a2c8e43c6614f238259
SHA256e252f4a0ab811b2a261c3ac138f34ec5afbaba2b12ac3994e0ede29534934a24
SHA51249211fe43aa779140bdc3da7e9c648ed958751184c608a44112126ff91c1bef194c1ab4663924d649435503402c9653d6c56051cb63051e100943cb895f08651
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c4d2e53df712eb77056101a20a4090d8
SHA124307ded60386a327b680f6fa0200bf3148e51f0
SHA2563ac9e81f3ed4ae405ad95b3083551c206e0051b26e369d0256f3637fd3614d5d
SHA51204cbe7b75f4174dfe3fd9ff5be920bb68f8d77172b0300d74f097dd871398977f00ed54d048fe32bb9a7eb4e9a7070d3dcf51fe75fcc0c81a4a802c9a1b044e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5440dbcc72c4534d129f4973c06a86103
SHA1ee6d7cd289114f46748342b839f172ac0b8a9baf
SHA256804d2a64e309902b02b0fecea70799b353cc34556722e27a84dc78cc3e2d484d
SHA512f87a8cdf5ec5d7e3ab56c18847d4bc7b204cfd6601181cc6b7c273052c0db4c314fd519c9408eef6e54b9b2b39bd68a2b9c024de4c6c4ea2675a5d9c2608391e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD516d047827f13cc733e17bde88f461827
SHA1b8874503b363342264277663b099703940324565
SHA256339c812b67300b959f6bb4bb459e16235a49380b81ceeec2d8ae7c7a60559860
SHA512752941a97909349b3db934d971e75ae285a5986ed5dce3b5a7edab083df08884c99aa7289aa7e10dbf3f1ca48cacf4baaaec5868a7d1c6f2061f0e77b94906ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5170f1b85421bbf715c7cfe8a393bb9df
SHA1a6f2d77758a7da3c197e9cd23b4e1b0743a0c403
SHA2563f5b51bbfd11f064d0c649f6aa5936c013dbe5b1dc6b73b0e01171100d5bdcea
SHA512d83cdc0bd6dffdec85ad241234f9f81a09b3d3d991e6284c367ef7ca603dabc583eb997d07d39510ed981130272d36bb914d81187d29ba1ace7f0be1ce0aa6fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD531e8ed8fb5859b4aed8788529ad3785a
SHA1b1be78053b776bf2ef637ab17f1c088815fb5780
SHA256c5d50b24185510412706b777534c5f8cda8e771f2de4875aa22bdaeb2df12358
SHA51239b6d74f499fa593a2707d13e1fb2683aa235852da1b8685a0bfbfa76d2e73489c5a894959f49b9680310bb582342a654f6ddd90374ee94bca8a82bacb9f5bdc
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b