Analysis
-
max time kernel
134s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
07/07/2024, 08:43
Static task
static1
Behavioral task
behavioral1
Sample
29dd1216fcf9627f0f84b1369a086e97_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
29dd1216fcf9627f0f84b1369a086e97_JaffaCakes118.html
Resource
win10v2004-20240704-en
General
-
Target
29dd1216fcf9627f0f84b1369a086e97_JaffaCakes118.html
-
Size
6KB
-
MD5
29dd1216fcf9627f0f84b1369a086e97
-
SHA1
91f51df49b9906b3b710d5c3c2d13d7a8d2eaa70
-
SHA256
27f2e8be541aef563e4287ae3e2158eca494047eaa7a640e1be478e8b26e4089
-
SHA512
3159b7526ca9951d2682c9c91729e827e69d88b779093b3af3be5c084f8f59585cd6e1c81f363b414b6c09091d520d907ce66efe18df9f49317ceed845b9148a
-
SSDEEP
96:uzVs+ux71VHLLY1k9o84d12ef7CSTU3wScEZ7ru7f:csz7jHAYS/uvb76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f035510000000002000000000010660000000100002000000031d0352fb53aca5b00a46f0a147ed571a8d74c2da78ff2a7a78b6eb404d77bc5000000000e80000000020000200000009482e8e015b0050f09fde3b567a749a7bcba580302154ad5afeb2173601212982000000033a1c5832762e046d1115961083a0822405f00a4c06372f25c20ff6f284ba6ab40000000b883b8533916e4da53bd5be1ed896b1855518e432731147cdb8fd7163aa0fb137f25502fe854fb56c21d238de09d497dc760b833a74d3a48b1f75d2355c2749c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426544842" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D4380AB1-3C9C-11EF-97BF-72D30ED4C808} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0f65fa9a9d0da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f03551000000000200000000001066000000010000200000006f75ec8e33b786a550126eac2671bd981bd61d1aab4053a585cffb29ae87b684000000000e800000000200002000000023bbb8af121dd0075512e4e6ff04854f7f5067d7bbdd3bb69bac8063215d1c8290000000898c6768a4d8b1f0dd3acc8c838aca6c03c9a7644f8bba5c1e15aa60e3c39e1c46e57824c042831e918d8c617f974551f45b4d73c73c288fe79e9d515dd0965c743fb008757f650b998fff656b18a4d5d1fe72a535712359342e9019dcf735cb2c0736b2be93e0bf1f751edc88e66e1bb3e7bd73a01af72a36ed4b8299d816b904ed3cced93a0189639ba158f889487940000000fd3eaf077b3553751d3cb23bb60e9ebb4ae342f35bf777569cf03dcfe92c077d6c714a013e41648672433d9f82b2e94313774efc400d5e2d8d0a5da6b6b00ee0 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2876 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2876 iexplore.exe 2876 iexplore.exe 2316 IEXPLORE.EXE 2316 IEXPLORE.EXE 2316 IEXPLORE.EXE 2316 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2876 wrote to memory of 2316 2876 iexplore.exe 30 PID 2876 wrote to memory of 2316 2876 iexplore.exe 30 PID 2876 wrote to memory of 2316 2876 iexplore.exe 30 PID 2876 wrote to memory of 2316 2876 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\29dd1216fcf9627f0f84b1369a086e97_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2876 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2316
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5291665b5afaf89c0018fd79eadee382b
SHA12a3254698f3ded0d96d4573dd105cea67bf42679
SHA2564870a5bc4773fb3fcacdafb4fa232cc00b1e2ed2ba9029077e2fa67106eda3cb
SHA51283c853f83c0a9377234a4ee7db4b3ef841dcd3847c72a358da36be428661897346bed65a737e6fa72e6f35fe875d074b7cdfbcd10edf64c387acbd5b3d73c3d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b83e8261ed748b6148c6e742f4ca83ff
SHA1336388165945deaf3d307bb3f4c881c350b90c5f
SHA2568154025c3cad8568ff91f1fb57661d9e7012be6912347a4ede05c71db4aef7bb
SHA512cefd8819f3d2c9c1072ace63f7b3c8b68d29aa0ec916a9deeacbe6b931ac990de8c4388b65c1a8fcea828c1ca06df93961cc3eebc9f305446367240849d04bb9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5381b2ff8ec0ac8b9df8d07412b25f894
SHA1e54de4147e6df1674daa12db562543b608cfed83
SHA256b13a5678b1360a2ce43955774485e082e86b001cb60226ff8f7179b85dba3e06
SHA5123dbe77151795f2f94bfe12bdb5dd6581b53c526d2736f4a084c66ef59053e9ee7cf8731232b0dd55cc9131fe79482b00738349d377899b9b2cc52e79d4d3d834
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD509434d38c1ba1cf43f36a178980829e0
SHA1da39c88938b8ac0d33bce0865c28522960b945e4
SHA2561e275d849feb5ef14b14462fad8fe5cb47c26aa8dd3a5e6b840a9be2a5b021b8
SHA5120353e768579a4ab1b6fdf4eaf4e87d12c6c2ff35d6af783ac7d9a44ee14470c2193f5c02d325f74a35c25958f9c0b67ebeed91b6325673eec8dcec98d6038feb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56b6743b9b051855f16b51dc3e169a492
SHA14bb4ef3f7193300a65f005066de78538208646af
SHA256052d2954a57d988a89fd1628bebeca624ea5e1eaa2aa552289d5cd8d5b5f5d71
SHA512045f1fe12acd5cdd71195130ea8532ec27d7e4b36a23d9cb3c9998f9872d1b6f6f86bf20994a08433e84a630f2b737e0305224d4ae2ab76149631e259e0ceaaa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c9bae14066cc55dcfba3e6891ea5e693
SHA1ffb93f52edbe16121bdf5880f8c716f936cfec7d
SHA25646f14550d5254a9cd708a38977fae8ef61acaf0a63504f47f91fc73049fe3232
SHA5124a1b9b00defdb03b9b41f1c05e66627c521d21ba2250f9bb37efd039de30415c11b115e41bde6bca7255d95ceb17e84dc439855d104f8d0b68bd409bde95607c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ae30188e88ea559f51a32f9067c28fdf
SHA1e1d1c69e39ab09795b6e62318dcfb50b5783fc9a
SHA2563d4444eb84c1d533035c87a3fe70de89f098f389d60a4546fcdd670d0984fe39
SHA512408f72d69813eb418445b2a4b4c05de15a7739c6e74f8460a48500007d278d98f09bde7eed964057370eeef5a84e52d03787d82eb188ed34e4c48674a1c8368a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5080682f14a6619f64b1dd52ab7a4e137
SHA18e45ca835a42d9a212923b76110bcc6d85695401
SHA25669b846fc2f84ce8cd31f88857c2f430195a3bd9e2c012e334147dfabd938edce
SHA5120c787a2e30787aa7ae0bd6726d4058610e69c488bfb7965e95769bcaa7f80b22b8f304e20bf2488c45020ce6b6f8de566d489d61f887dcc1adc93cd0d9c4b991
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5053dc35e98924b38b880a04bc6c6de53
SHA1a339348215d1e3130089dc75924e2392c6cb9142
SHA2560a1d4d67948d1b21238005839b561198710ecb2a6de327883af1c174a799b22d
SHA51205ccfd593662d90566573a7d79d0e4ea8a5ed2cd95602d059a6c130e468bae67b2abfee158a4f6b9b69691fd183af77d278714d29e4d5744bfd2bc6e6617d646
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e4867e2852c6ef66360fca061baca12a
SHA1b6978c7b93db1d1d1f709a4795f0c9e255e86a09
SHA256ac984c1d5e9008fbdb28f21a40fdcdb333c965d210e26da04834848dd93c62ed
SHA512dac4f5d86118f0ba107cfd7143d2d48f015f046394fe413923bd661bbe3c9ce3e5bbc13d186110283c038935daa8ca3219f7e95ee2785c58e7106608c0d41034
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52e933fa2215cd62afd9133af9e0e7e07
SHA12c1bfc591a19834d9111beab48fd492a72b2b3a9
SHA256e337cd2feb09fdc894aa29a5ef0b9afaf61de4dc5a90f6ef9f27879c7d166442
SHA51243354ad4af62c2637f7f92a064c1f4c505382cf925a1b011565db4e75fa51960acb3c4aeb791e9a8b539c82577017357b7396e1bcca84665ff403e842ada731c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54a86058b40ca2ed82af30865fa0048dd
SHA1f13166a82e380d5276d1dddf8d2096fae63e5619
SHA2562e3dae5f447e9ae9b0645289ca4ff399a431eabb94d71c45b2aedd43f99e0829
SHA5122ce8977b7efcafc4ea0213b987234a6e8d0ab7da3b7227dea59f42a56dd857a38d3e5fe729d4351ffdfb0f6d7ba801708bfca8868b3674acbaf9bc241947f020
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a6ea7b92ede478afc7395edfb3d50644
SHA1a0a20104f8493f3b48015d8866149bbbd944903b
SHA2565ab2c57bc2a18587692e52c2f5cc7ace884541368ae238ecc045a247815dc8bc
SHA51217502cd9cb12dcd84258243535dec93a706d17484231a4c264fe9c664091a4b5689c44f573fa54724544bdb7f90a34c1fe39af35fffc50fb6426e94e6f99c338
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ccd333c0c8af8b82039253e0af329e67
SHA14b5343ebefd9e26d02bd7fe62cd958ca9ca8f271
SHA2561ba6f181258ed798a2d146c9f0cc58d51c548c0e048c862ab134b130ef105746
SHA512ce4d91f4b1ec0534fad8bf57a183b1d439776f2d2d47e104913aaec574150ec2b32b98210db9a73b9d1de672b8683954a9c950015b23d7a5918d9fbde7d4007d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD535d08cc6a7a8a299cd0620056cabcbb5
SHA146f64aad19a3ba7061adb63944a107f46441984c
SHA2563ffd884f984b698ef1a1850a63c4d76c86ea8564ea8a33a67bf0dc5e3388af83
SHA512b26176d7c950d149c906826c82252e3777fa26dc3122c19cce12cb46f48910e592cb05c9359e5ded9d774a4bf32ec7b821fce6a5d8c01d9d483c82b898382133
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD519aa83b3deb80f992776f9713ca341c5
SHA19944c2d3bb91df2581be9b15e4d92832abcdf672
SHA25686795183375a101422db882cbd37662096be6526720f5e20345865e897541366
SHA512e609d1d744ea332c8ddcc8598b3350f914b21f2785b7cd16066c3deecdaaa2cd12a10ee6b7c5aeaa17df2625b3f6ca99745f0d81f3b6af623b37d073fbc3b4b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD588dcbff2bf9000fd187be6dd4b9c7814
SHA173cbc93a4c9f5c3ea3bb4d00175c7d70f0c52c9e
SHA256c94e94391c4a6a30bb0ab5bb8fdcabd96a4d78cc6ed7263c34a11a83300a3db3
SHA5129a6c22b02c6a20e8044cf345d5e83e4e2b530f2c76456d1d9a1cf3cad83eef62ae81c655d4b9057682886ca916e1eb8ec01ae8f379643d24fc10221a2c193a39
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ed84fa1b6704eb757113fe14e33e21b0
SHA15e6d2e21829bf5db34188948e514ac636b23088b
SHA25621a409f2f2fc34f446ec6a378d7f07957f2a89093b49566aa7223505ae9ee8d1
SHA512ddd5fdf57dabb901a5e485c4e3b0a62f2a4e8f35fdccb5e7995b6378838b69b8f346d6f827f416efdac22b812c7ae41f131c6e21383231cddd4637f198993a6c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e1064b501a77cd891896c16f347e6738
SHA10ad7fde922e8ca6b99d5cd35d558ecf93843f2c9
SHA2560694b300afc4c19007c7f7695ab79da81728d4fefccf9f1b1604090caa23ea8c
SHA5128be7f6cf9c675f6bc94cb36aaaad0c1385827414191c19b9f492bb1567597fc21d2c2173a72be2750880c84b273700f6f87a3b32994449d158a13ba6b06b3d3c
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b