Analysis
-
max time kernel
138s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
08/07/2024, 02:22
Static task
static1
Behavioral task
behavioral1
Sample
2aa7551dd7229bf1cd74782c572f538e_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2aa7551dd7229bf1cd74782c572f538e_JaffaCakes118.html
Resource
win10v2004-20240704-en
General
-
Target
2aa7551dd7229bf1cd74782c572f538e_JaffaCakes118.html
-
Size
77KB
-
MD5
2aa7551dd7229bf1cd74782c572f538e
-
SHA1
965b1d25d09221db2ccce6918bee604dee09d1f5
-
SHA256
c461be6694c644f045ae1136df78be20c346ca002f2ab97d6582a865c14d50cf
-
SHA512
81ecf4abf720303d5f5bfddb4059ffafea99b5ff832529c21ab5267955da8f693645b7359f2926c669b2dfbaa0e72b64733b4820d0382b4bd528e6354cf74038
-
SSDEEP
768:Zcd9QZBC7mOdMs/pC5I9nC4Si7NCc2G3Pd:gQZBCCOdz0IxCK+G3Pd
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000ad37631ae9a47cf7be87931b514369970d9ebf2c8fb617fffaf92081544b37a7000000000e80000000020000200000003469178e95771e01e2b0765fa373b3672c0b05354d1d8859f067a523893d75ad900000003e926df51c05fd167a12eabca4f9a8a6dfa0503a345e74933c54de615670330d18a7c70dccb9fbd022a4fb81c28148baa1b4b6b06bcad676bcaf64c76c7349a8d7b065aad055cd6efa6f3d154056fb51102b22be31c758de61b7a3f19062bdf84f1ca5c1ebaa487c1fd07544f96a6f2f0e0a985a48871df86c1231af78640a6d60d3020b1d0d6f4ab7bb5f93a5533211400000006e6d4d09381da41a30284b24cb6e1c54b2acfec05c5aa9f99856285c62b45ec4757fb755b0387626425e6da4c7ff4db424b30ddf6c2e9d2e830245d4be4b5995 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426585639" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000e881f3a8cd3d03b3ced12110b18e689e51a678d1950aaa449c8e0619b6f5bcbe000000000e8000000002000020000000ae11de6ff9b66c61a4e0564ea3f7caf41b4fabf9730d62342f6833824a5fd27a2000000013cfc1dcbd71e8195dba9b77d44ae20442d1ab06c924328a0b76d19af1db5e504000000014bf8bf63011e9a057d7fc4891f3fcff1098bbe9a5cf24e3622a2cf8ed76c1be829fc2103cf9dcfb335f248f07ed77198b7301301f4e38b6716351545ffad6a6 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D1C46671-3CFB-11EF-A1BB-725FF0DF1EEB} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50bf60a708d1da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3032 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3032 iexplore.exe 3032 iexplore.exe 2688 IEXPLORE.EXE 2688 IEXPLORE.EXE 2688 IEXPLORE.EXE 2688 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3032 wrote to memory of 2688 3032 iexplore.exe 30 PID 3032 wrote to memory of 2688 3032 iexplore.exe 30 PID 3032 wrote to memory of 2688 3032 iexplore.exe 30 PID 3032 wrote to memory of 2688 3032 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2aa7551dd7229bf1cd74782c572f538e_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3032 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2688
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ab3f458a0242a43d6da23318502e687d
SHA1fd670bd6383f715a724446995b3734c6347d3212
SHA256f632b8800dd5085c7525d17326b4a48673d96c4acc2bb72ff3bcd16217a94841
SHA5121832b14c39cc15713e19e616623e7ed3a663c02bd7e06bd4d3f6415241bdb4a6bf5be1ebce36b85a6d7fa5fc9e814eb223d63e6322baa999d72a559318b52182
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53e05998fda3d4cc63cc55542b0558af2
SHA13594737da440ca2bb36b78939ceda2a4b776afd5
SHA256b99a032a1ddad5e1df5b04899830d7c15decd52fc85fa1c967c5ebb61b700fb9
SHA512c61413c3de141fee0bfdb688a8ddaf61ee27d8cf4842c25d624db7dd2e69d0821262718bae043ae7884faff5a43756eb39c0c70c6246018a77c8aae4c4998df2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f192d09bf11d70674b19bd41dee96163
SHA1dedf4dbb7b58ed779c66b2df3674d0082a4ca049
SHA2564980c57a7f8c83136230741cc16bb61be37701a8d15a3d6447fbe944e2b8c96c
SHA512ffa52dcff10f59f78858372541c46898d3cffde567300dc75d452f8e871fdaaaf8f89342888c4bdfc267e39b9f38e7d4ebe435133dcaa978f072bdc77d8dc879
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD563c0bd9257786f052894e4ab13bf4c46
SHA1f50730371c28390ddb653be1f13672e0ccdd75e3
SHA2568cae779d20a18b5385d52919f4aac7d0fa38d0fc7a1fdecc91bc7d0db0208902
SHA5120c977e6acdf256b2fd2d2563470a20b769a02ed84f0b55d3053a3ae2c7d63b2e6da997cc8de5058ed187ffd424a7e7493eaa3fbc09bf27dc65e2241ab660051e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5116237790c0876081e1160ed4dbb1db7
SHA12f9ac4e283159d13b1e9645099f72d00f0644fb1
SHA256367854fad5b0565310b8b1fa6b405c6db3e0968d03a7202e1301926ae536c538
SHA5128f884c1e6d8d6ec97b5051ba60348a7d37fc24ea8df9937dbe843ffb41739f4d19ed11503b0a5ebab5706db766bcce82e6a1ef210bdc741799c1dfa4336c0558
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ebfb74a9c5055f6ef00855abccc80f3f
SHA11a99bcdf5031653bcf7d5bcc774022a08b55bef0
SHA2563079d352c3173a34d70a806e9b709bcd7b31d1c9a70e18d93bae6f62b2362839
SHA5126132410c46aa49e4be62165113fa0347463e8903e308817bd486ac38a42bdae4fd80036d155362536a0f176d8cd785b24b9d708c5909fb4c549990d7a99e4aaf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ffd377e0de130f89b2a04c8319a9eae2
SHA1fae0453e144b441345a40cc66f9161243355d6a5
SHA256e9e15283eb8ae2b882f960d6db88be553409f307788d04a723c5b353f31e9737
SHA512f09eb6a235cd96c804ada22ad02f0c5910a850ce4b489852a9935c3c6f43f670121dbb2582df00fe7000c1e9a2c8c5749e1d56af5604d4ce4e800590d97d587e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53392934d72d60e9d4b585f8833b6e860
SHA197387e4299e9670582b303693458a732e6bf64a6
SHA2567455123599a6ea010e7b469462c09f549774b4c25eafcdea4c37f28806168e09
SHA51265a2073d946a09be02d4a79357ba30519255db1b612de3c0c571547096eccf5ade18344af7da410433ffb76d7b82f930dede8408a12bcccbf3ea56fe6834cdd6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b5af2ee21c3e9bb7b0e06de8f641e818
SHA1b21cf7e50a7d51c6f07d8d865ae802354fd9bb13
SHA25637383d4762c78c4ebc2eadf78ace6412dcff9b60e637152bd504de768e11da2a
SHA5129c7d970f4ae22339709ac720bd2933acdb937cbb7af5f4cc6874b08e7e168ff0b55edcc28a5801403a478351e4f4e8d88c345a7b354d378ef2b180e386e6a6d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58c8f2fa86b581e4388c7c518883330b6
SHA181a87bc993dfa18874e09fb69db6deb714c00f9f
SHA2560764cb2676cc7be561ca6a285bfa57603c8cf981d21f09359bbb7e329bc61bd2
SHA512486b70e5da208de743c5a744ee1ab739375db8086db7492dbae4a5184be9f462ed08df3bc55ea0e6116cb71a548b93fa45828a1f7e3fd72272baf283bbeb3d8a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57fed5f9a792e08a04f4a1322c0b81e12
SHA1a04bd099f7bd8daf87120350aad9f970ebcfb3ef
SHA256e6225064f8a99482eb17c0fe4e00754cff22149b632eb56d254c9b68248c6ecd
SHA51274480a38eb4a046b8f1bf2514ecdafda662194c6504f5cb70c76336e653c7d3e556391a2384ea7d0646d6941fcc7ccfbf52e6a133b1c80f54b8c678cab012c18
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5afd6672ee83c978e0e9dcb96814ec291
SHA154fcc1d5ef9a9bb17141439f7e172e261660a9ad
SHA256b1cf7cb904a0e46f9d6cc138bfa435a6b0d1be29346e33300eaa10a6612a8c1b
SHA51260e3b342d3b818878f644cc52d6a0a98de05562f294947e245e65b67fcb2fb1c2e2d717359a3b0c2f6259020e5702243eb6306228fbec801497d4b94edac2838
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59f18d97f37db79ae6acea099e253c72f
SHA1d5a8ab753b781f48c11c2b4210d5b63f59ac17e2
SHA2566cd54d1dc044a31ea22d1d0ab1a4c4d72b12b39f48b2dd1b92bd73357a842a73
SHA5124efb5f083b55932a72306f461b67475048641cc59d51569e3c1fe38cf07c3be397def6a0d1f306b10b49ae6636e71eea7ed4995f5c78e4e9f1812d99160e5a9e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57f4acb608582b5486f7612968ddc951a
SHA1bfd8743e11aa12e1eeb593317acb99bb6c1e4ad5
SHA2567c7d90a8cb5f7cab819f5781db65abf0a7dfdf404a17fddafd814c31a81e4613
SHA5128fb1ba468e5e6b6c72e4bdc22b0de5d8f4954914efa83ed5719e75e60c5aec13f5302561f7e7b27da43c013cc863fd0891d83558f957663d15cab8bc5c5c30bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50dde106a255d766eb0240713a050f063
SHA1a83237a3a455b917e92eac569211ab8cecf5f3dc
SHA256836657a5cdf85a67f980c31daa1e63508b581b9670eb21a41e99fedbcd78a4db
SHA5121b46dfc394c93fd2964a240c03a5dba955cbeeb7c3aa471476f0327cd74e04a88bf8dfc944fb2cb34d4e7bbf417aac7a2320860bebaac8775d9c0f2de012a7eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50e8e71e0323c26284a32621e0fd29cc6
SHA1e6cf7ec18d57a1d4f0a38907cac5b02874d80c3e
SHA2562d0952602486dcf5d11b8341ab128647d1368f4a75800315d63830427f93dcb1
SHA512291c18f6e83f7e6d380c373f1c82c16c8617a481a658aedffc069fe2b1d7aed0a0ed3c0e6d4c2bb330bea46f7ba3a797feb7dc75473de9d30177ad606aeadc78
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD556f0ffc36787d55a27b027d35ce55294
SHA101c714eaef4a5d102abe4e80bf58fc0708c2d252
SHA256cc7fbe7b2716f10e12eff1569abffb9744ee22e7d45e04958fee0bd9b9a949d6
SHA512ac309573de677aea86456b175c0239853c2f2c7569be6e52f97119a747fd7f28d1e401621277c84c08729f0b40e097f67dbc4d192226716b5bdf016732034954
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d27bf456964905b6d6b730b451880e9d
SHA173cdf71b8792a92ee0d5d587eae5e45df11ac7f0
SHA256e218e5eef42f9cb7f6cb3450ec2434ca8e36c063dfd9d84c0ca0ea44d6e1e13c
SHA512ef8606200de749637234db339dc5f3f6f114fcc10b8a307dfbf044c28afeffa5a0627cfd8354f14ae5357b9d55896ca457671e4b8e78c537b05ff955b35d0b18
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b