Analysis
-
max time kernel
134s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08/07/2024, 02:09
Static task
static1
Behavioral task
behavioral1
Sample
2a9f12871411a9d6233dd555304f8827_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2a9f12871411a9d6233dd555304f8827_JaffaCakes118.html
Resource
win10v2004-20240704-en
General
-
Target
2a9f12871411a9d6233dd555304f8827_JaffaCakes118.html
-
Size
5KB
-
MD5
2a9f12871411a9d6233dd555304f8827
-
SHA1
fb1e2cfc9e6fd17c29f13d8b9b49c7a93ee715d7
-
SHA256
c67c5026b981e11c520c3360978177fd082529273160a663cbc31a1abe4d1e09
-
SHA512
d53b26bb905712c6ccff4b25acaebfccfc96aa005c1300c6e800205e0859942ee639f2531328c51d3b24c03e7e890f7495c5afafbe4116047f5bbcfd3b7b4c93
-
SSDEEP
96:wq3rTMmjMzMWld5jFqnHXFIWlPrMQxT2xN9zUBHXU76SPFW:47blPAnHhlP3izgk765
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e1e92d595f88774e9982bad890f3431800000000020000000000106600000001000020000000760dafc3ba67e15d99d2b08a9bf9288798277e10b2527789acd708c3e3a1c7e3000000000e80000000020000200000006c8a44eaea7dac4e5259483737a304e9cfb28fd3dded293b117754929f75972d90000000378f71b54f438d5b4014dc5b8fffbf1006ee4508ba1c992e026e600a6275d3d3e9b8e6f3ea177e03028005689d3311213ca74e668cbd7af6692e2cc29b536978f189b0ec963282b89ef56355c6c522a5278ba836b0170d2ecdebb32c514f06b4b2f95ed8a03a6dd0c73bb8abdc43b4e5dadab6de4ba506cbcb6c0342c6e5c844618d398fc2cdf913950649e5f1b7c57440000000b7a000a17214cf6396635d1ddfb9036ff5ea472a0acf743ff66f95688145a8ff277fe5f4b37cbc48527f85679de95d604d921f8550370cd2896e1b6c3682d3a8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20a71eab07d1da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D3C592B1-3CFA-11EF-B238-4AE872E97954} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e1e92d595f88774e9982bad890f3431800000000020000000000106600000001000020000000884939e706f542ff2d2331214cce17db1cad9049eb6641f3f69d5464121f01ad000000000e80000000020000200000005ac28928f1b4242c957d37590cca4923a9dfc431c4ad4b6657794ba6e9c33a52200000005d8ba28985848686d72fc920a5973428aadb6333fcd3b8690db0b0791f9eb3b9400000008e48f1ec0ba1117dda5b963242a3f96452b49c3f7764b26200597d0e0fc7ffdb06b6266a5f9984fe8b7d7191c731ae603b1a5db7fcd701533cc3f3e11cb45cbd iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426585214" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1040 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1040 iexplore.exe 1040 iexplore.exe 2936 IEXPLORE.EXE 2936 IEXPLORE.EXE 2936 IEXPLORE.EXE 2936 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1040 wrote to memory of 2936 1040 iexplore.exe 28 PID 1040 wrote to memory of 2936 1040 iexplore.exe 28 PID 1040 wrote to memory of 2936 1040 iexplore.exe 28 PID 1040 wrote to memory of 2936 1040 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2a9f12871411a9d6233dd555304f8827_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1040 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2936
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5983e6181a113acea684b6edbbfa1f930
SHA12fe3779a17053a48d37632a150b3d13c57962384
SHA256f2103d2443a9002d717923cf9b7a2ea3b55c053327c77c9fe348530435ae9170
SHA512794de537be3fb6ec3cc23f0c081a3d5ce616d784140473df90807ab6e0b15d5273d2d000fcac92607672bedc2901f2354cabcea71b9ab178baf929adcea12ddd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55a46567c9e7391906d4bdf40fecdd383
SHA13dcef20943a922284c9a52c32b8e9400d6d69f21
SHA256cec2c202fb05c541b917863fe48b3fd9da65a2050ebc8d9bb5d26866ec02cf02
SHA51207d0d85bf4c94a923fc3e0bf2379d15e36c8ad4d48db23d123fced1a01c569ab6aee43318fbfd015c014f115ab0921f9ea9e6548e0a8cda67b866ed5e168e1f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55f75b9efe737ccd4aa85378b88ea8903
SHA14d55fe158a02f5ca318f07d96827d6f1cef77c9f
SHA25684ce2367bbf6c6d40678e2eebd6623e8a349242202b758123d70b849bf066add
SHA5120c8a435e6709e89cd62ca35cc7d2f2bb2e941c6acf6c0e2692056e3199a49d2c50564d877b9f376d0ce29ff16eedbec746c8abf2f95d87b7674404a4e66fbd59
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cb9fd3b4191ed0441df151373226c616
SHA1a30c9f5d36107cf8a9769e1cb5217d34b1c421e8
SHA2562a8f49144db214aef610b66e2169fa562bb644880e144f27291b98486e7f7df7
SHA512d2630e607b1c06c549440a78a08914cb7db1fc63f868e5eca3db90d7b356a790222707acf9a19adf54074c824a42fb8cf938b658ad17fdcc6c6061c7d2005058
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5436952ceb26632b42accd210e0880375
SHA1fe1aea62953e7f4f831a7771e85d6976cfa06fdd
SHA256111fdb5401ac533fcd1f092664342d12a0f3d4259af23642928272655e9ad163
SHA512e5abaa98e3a37585f8082a6d4b9bfffcf1962b3686f7e4a01e25dbe915ea6f9426744f14f95d25ad27e707f90c337707e398d6180b455183cd96d634a4838475
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58d7a70cb231a7328f7c7ac1ab3527096
SHA18e54933a5634b38d933a61bda32747e399814eb3
SHA25643ec10d43bedf50e4465df2b42cf89c49759e658480d566f86c745af808b3046
SHA512b8033385324dcfa25aec2ad0d8ac8b2be77366e0a63c703dc42a81ec73f650824755eccb4d77e533c942767b7f965a6f32868895d7d6231eb4d33ab9781d4862
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b41cae15361fa294917cf69b30d64fac
SHA1501f1861a0212fb9c3694b5d6dccffa9966b9c34
SHA256c8cc8d779583ea04fbc5fec724266d4d030bf1c8c1aa8c466a007dff1b625d9a
SHA512b795331c23e7489baea0172a4563141169d9781e225648c0138257435f19060ea221f2a8c4b57877184e5ea89e265a8ef5c692a0ceb56664ee3f1ce94d995b0f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59879b5984b776995c247843f949dec2f
SHA173d22886e3132745a9ce09fddb04799644546cc9
SHA256e306edd966507a9a4b1df366be8a1e6b38db7bab8baab2054551fb4883d55488
SHA51228e7b84110ff34ed3d481ab31a06b96eee5eb182c4cd5867b2411dad9bb4934a3acc0edd70c1ae257308d2f690cbf201afc90fc8ad5be4e55599f9f2a3373fae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c165377e11dcbb3d388f83d7a67d82cb
SHA141b34635bd76df85b9939a75cb2889441ad67a3a
SHA25612be8641857ccf8686ba8e14f9d9e6d78eff11bf64bf27903074cf56ed02ffa7
SHA5122c90cfb740a1f79c480943089cc27e6738a3c6abdafa910c2622ca759d465a5f70e5094b326439c8c33634b3d4570d11355c5957a766c2ca0efd5aa252a7d3c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD504ef86cc01fc097af99451fe8835ca59
SHA17c76f05e8444813774e41afb02548fbdb7bfdfea
SHA25616e0be863650bdee47b99b905bf862ada1aab827efe998b0bb69f3bf0fe9fc1a
SHA512e76b691792b747064e283e4620c1f2f3f44e92bffe38d508f45c238dcf6155a8ea1a85d6e795af0dd9223017300398bea99fe2c7e9d508e3b00d21bf52cc83e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55870bbb3fd17c94c09b4083d86147ac4
SHA1058a7a01582f69f1ffb8e753fb08e030938e5a8f
SHA25667691908c1f9b001b740d94475644f4b9cf600bb320eea457c29e6c1194538df
SHA512495328481c03b3bc8d2f9dbdc6bc07f79dcacb4fd09d8bc29856262a79e031cfde9cb81a61f0cfc9a97f1458a795a6f0a04e5dfed0750f9bbdeabd5f4981592e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53539084a0c0f8905c7875aa5a81ea2d7
SHA1eeb5f239d5932cca2b3b206138181e48746e0939
SHA2567d93c540f6260d39b04e23abe4bdad88ca475b3297c7790d683ddd6dd00a9565
SHA512577db8150a06ad505bf5310afb7c4e519dd5293d4f363f94c926cba17bd1c68e3025d5f9dfb21b485ce0507f77ce7594861111e526b296ac3f02a4d3087fe0b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54bfbd84294ef3370c4ff0c18cc56f957
SHA1124ff0f53bbd0c1242c177e4ee0c2eac7e9caa7d
SHA2561d46ca1ffea7494b3a755a532e445b4de39b8964ac5cb6271fe7ccef34c88e2e
SHA512adced46e80e9fa7ce1a9d4cf8b484a8e9c3b59b4e45bedb59c8b1b5a0451fea3e329b3da12c76fe1c806fa5377fe748014dcddd5f5dc324dbe5a7fa8db2499c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c9feb28f97c467ae77c556ed8ca578b7
SHA1499fdf76e98b194c68d2c36ba165de2a9967a396
SHA2567bd3d7e9001a6145dea585d91de8775849b68e50b5b0f26dadd0ef7814544b99
SHA512a248b8f5cfa624f583beb305490f8866e01afa61e8e80d1f6355bac554008902361c20f7a86c8ab14249a03f6ff9e164b47083ade30d2e9c6e6be8d889cd529f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD591532bf5a0b14e439a2018271672b1b3
SHA1416431348de57eca0e151e86c7c6e752e9884a7d
SHA256226d3d64262f429977698dcc59bf220183dfdfb7761eeb7cb06ca42a672a49d9
SHA512e9b741945525a407be4bf4e406a77c10c16abe5d01bc6980a280a9811a9c6eb895e48598f4e25db259bb7b903c77de14c15760140fb9f155e5a171a24407cd69
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD514784f9f6e5a9af8970dfd2c8a585108
SHA135351488bb4a2f9e38f7fb3536bd0bbc61bc25b8
SHA2560ceec3a5eda92eb5ed6d6454bfc75fa673cb31bc9ec3ae547ade4adc48bb4b22
SHA5120ba9074ff673e9fb962d00f82bd6b60de87252b48fa2bda83e58785095eca99a63ac5ad771aacade20823b15798e0c8f4c5d15b336fe41910d472fd459e9eac7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5531ebd6d2645a4d5988fc324952b1426
SHA1a97810c0f75cb9e1569245f44c9b4f961a622046
SHA25689f4c499c0437372a1e51e3d2dd427cb678351218bbbf7da6f31e42e0fbf0a68
SHA512df3e42f7d84e95f4a9ff30c5c494e13c4a35e84727c023ae666707c888a387beae147fef1eec76eb9b802d795aa2751ea0335bcc57ee6ae023704604a46cbc21
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5af446175082294487926a56b97ed1ebd
SHA13a0b20fae4f70096994f41508f790e21102a5b8e
SHA256631197584f8ee5966d3e96571bba46b237db3ea1958233c7dc8ab7f0910338a7
SHA512ab8d007124f0fad37b8ff0f405051175d5a94a71e8af0e981f99c8977396d3dcabea1d8e01fd06e858bc517b6aab98849676958dd5021e32215c7a5903493a83
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b