Analysis
-
max time kernel
141s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
08-07-2024 03:32
Static task
static1
Behavioral task
behavioral1
Sample
2ad68bd051f37eab8d44f2e0c5dbb804_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2ad68bd051f37eab8d44f2e0c5dbb804_JaffaCakes118.html
Resource
win10v2004-20240704-en
General
-
Target
2ad68bd051f37eab8d44f2e0c5dbb804_JaffaCakes118.html
-
Size
1KB
-
MD5
2ad68bd051f37eab8d44f2e0c5dbb804
-
SHA1
2313f4b2db8c40441dd03f134187288aacc61807
-
SHA256
50689aa7848a6763f31cdaa824d661820dd6bc31059923a4928ab040a5fb7b8f
-
SHA512
bfc939a2ebab6f8b4241eb7c15cc06df3b3b692d0288812656105ccd4068e1f7d171e0cbfb013b8e758bfc64b6998e9dcac85b762ccaa49fbc9522b5b20dce5e
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BEF61271-3D12-11EF-A14F-CEBD2182E735} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000403b86ee669dbb58548db6721ad95bf73a66283dc2228e7df7c0578c6a365832000000000e800000000200002000000001708cbcd8ea071ff8882ad344b83a6677680433d90f1746b8b0ecfb5d80ccaf200000003c1f78bd053239693fed93a61f987a64a55fb76890b0365a3df768bac1fb9ee440000000ed28a5e44233b77ad3b90ebbd217339f25d9d77890be3a358e8db332ad7d5f218b56980b6e40c046d2b78883768318532d10eadaa11bc0741697a4c218c8a008 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f035510000000002000000000010660000000100002000000088322cbe0b4bceff7494a9d0c458425d1bc6e57286c51ed2dd3e7eb050fa19b5000000000e800000000200002000000073d94df9b9451683bfb15dc5efd18e518d7ba2bfeacfe8a3167044b11624180e90000000eef7d5383683fd36073299088f0846770b39bcc5e527d38888a0a88416e5b828732b329ac1f96a9a812e66520234955b1e7d3ecb29e212806b5da97edcb9e17bb28382b632719054e16cf5fe9bf8e8904192ff7d94cc186d714d63609a2ab867d76a4f6fe3bfa8088dff7d8cb30b0760286e88c63dc77ede2f21dc9a7da57e150c8847780f9d474c1a8c482a1ada76374000000054e84c2c491c6c529e56ea93601321f4469329008a2c4b26a22c46547ec8cdbf5b255959f3e1f688387f82596fe1dc32cd9f4e86870acb378711db88075aa6a2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0ec65941fd1da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426595487" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2756 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2756 iexplore.exe 2756 iexplore.exe 2424 IEXPLORE.EXE 2424 IEXPLORE.EXE 2424 IEXPLORE.EXE 2424 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2756 wrote to memory of 2424 2756 iexplore.exe 30 PID 2756 wrote to memory of 2424 2756 iexplore.exe 30 PID 2756 wrote to memory of 2424 2756 iexplore.exe 30 PID 2756 wrote to memory of 2424 2756 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2ad68bd051f37eab8d44f2e0c5dbb804_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2756 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2424
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD516029c7c6de5138b51e13df6a259b888
SHA1d6198c68b8aefc6398ecd73a5f9161b838994fc0
SHA2562d3019d6818d7689296923e06e122c94efff7b333b38a75646abdc3981e8cf81
SHA5124c3131e8bd024308572f41d589bf7d663cc5bcd7074ebe047b8e7a865fc3e529b52fee934006dfec2db46e1224b3858c35ec6e48d9b52f8621748ae02a736add
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57085de8428fdd77eb8414669c2a87ee4
SHA11a9775eb3b3973355e9100ac3e2a6f88569d72e3
SHA25635ca2d9f8481407777e5297e4d4bc312669277ad69213a5ae41fae25900605a3
SHA5123df3fe0470ba10b7e413ae106d33e64076db1da0aa9627a417f4c647beaef5e86b026255639fafe97c5fbd27690dde6ca4a86e679f11db4637a20fb7de638655
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b64bdeed469d77e8ade296fc8fbe865f
SHA10f0d29c000d9e316818e35737ebd50eb9789e319
SHA2569701d897f307086e25315bcbe5a74bcb23894a032b06d5c49f906658a5e0a468
SHA512fa3b78852ee04b2d765481aa1ddfa4dde412eeaa2f46d154f84c7214dd6d80cb2a85e0ebb037b746d5daadd125f47891af1670b77a7d98ef9a56024ecd558846
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ba158b0996414e85b9c8b0f879ba4b8a
SHA139f2468e32f6a0c65b182cb19b020bc64f4b9858
SHA256106959192b8d441866abc83ca7096c172d5f8d9e4c2a1acbd0bff80ed5d918bc
SHA512d6b304a00395b65b6f32a004cc66bd3bc323b036d325b634921bebc99c7ec39c4b3cb5d5091339a3ce6f7252c95c83565cbfa084095dddbcef0196fce96bd763
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51979e6f1891cb119a701d0595f93541a
SHA108ed188d33228f10960c0f68a03a2b350f982ad9
SHA256320dbd411598219a403d3c9cd63d4ffaa55a60d6a38eead1ce7de63a3081b09d
SHA5125df21feaa418106e5491a0fbd66be0d62b2752b7922b6e1e43d1989f65309694b5c60e90ae8cfe794d1a0dda3987c1d282b2d843b594eb4738da0e26daaf4400
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50d4f09aaea043f2bcc363c0d84888694
SHA1b1e2d20573eb0d0ad74df5bf7461154140497eac
SHA2565fdc4e661ddc1821eb5a78128223922037bdd7d3085bce920c06c855d2bb33d0
SHA512d53a205a9c65f7d78ac5504e0fa8a5669477a1122a98edd128dd669dc77d002eecc36d3270c7bd88f8687f34e318da7f0170a6fc96ad81d6b962509caf6d9396
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53eed9929b5f10536baaba51637f52937
SHA115d53413dc110a9565e99220071b03c82e9227d5
SHA256baea7bd5b43372d2953e603f50fed08cb8d462e67b716d79e87cc214c9f4a1b2
SHA5121b721f24235c0daf98a6509e97a384a2b8cb5307df9bc4f4d388233a00ca8a145ee96c3f10326521aa165ebaf1e89e963f2245040d3d1cf590c9f62bceb227f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD599bdea7d4b066cd7acd977085f1aeb10
SHA15b17575827b0d348e811e6f9774cd92b9ff47715
SHA25666e4b3c8e64d0f8e6aa1d84a05e73c0742f6b99020b84d09981160565d5a549e
SHA512736c0ab1e76140fef64c036e96d2daa9eb0a6c0ec1a4384f88d0f778d2eaf4fb7599342aeb3242aa5a53a93c987a3953b64b4e961c2ccf9038b1264d06822f0b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c8ba4210b553fbd1039710acbf3aebcd
SHA1527630d9c2c241629cad1b05e8a5410a58c108d3
SHA25638c852cf8404af8e6cc6ab35b844c6173bc2c23420789bdea2c06193200dafb5
SHA512094c0deeb29f79dcf51421848e93ac0943e3977f4a9b5b8a09afe6315eddb77d42825e28ee650060cd145f2807432efbc475a84cb7877244745049e6d996d819
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c1c22919651807c5a1e6e4bd9014c3e9
SHA1803ffb517dab034a8a74d834e29029575e2679df
SHA2569a63442afe57eb4c252a7d88719f8aae2412e028c5b6d3aac8b8c6a1e155da61
SHA512cfc4c200bfb6220fd33aede1423af58f767a2cab85e907ddf74a595553617c6391a16e8208fea199dd492caf699be4e84a664cb08741c69b39bd024d0f74d733
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cb812c30d48670954e18c03eb956617f
SHA115de81499fc28364adc01d98b0e122a88b2988f7
SHA256da003fc52cb5edcfa830a26a0b608f1084d4cc8a9b50e754abb5ee47fcbe6e21
SHA51259cca19f3a985c2f6e41b6b8ccd2fb62533d370dca97549802d1888b552520f6d8b97cad19fc85e1f628b97b50e164caaa750539ea595512720158ed5784532e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d190439cf8e213b923ebefaf63eae1e6
SHA155de1fd701e058644a4fea40e9ad5007c6891a2b
SHA2568dd990d6f3ccd268329ebfa9d5f07df0a8d5686e8abbb7f7446dc30140a0c842
SHA512e49348f00cdf1f743d64391757c650081f6baabfabde4656dea8b06fc72c69ba1c0f287958c4472cf65a6842f8ab817167feadedba866a4d2e68700ffdc12bd3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b20d340aa8cc054caa5d5ea18c9639c5
SHA17d10ef631c41e82b86ba7bd801dd60c849e3ecdd
SHA2568c51f52bc72354f979e77d0816e9fb8b1d61ef934b3835375f621607dc6e01fb
SHA51212f238201733cbd9176bf830c81563ce69e2cc08839463d82e6ddadf86daee076c2a6efd80040f62682dd078a60de4aa981380ed9ddff6d4aad1e44a05602d84
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53d7a7e6c8e8274915e784fd9b2fc5dd9
SHA1682cefe29431b23cda7e7c8ad15aac0d84563e20
SHA25602e9cdb5e177669162344505c00c914e4335a4c5590c57eeebc1525a00c38113
SHA5121fe62f33dd2ed924405c89273156cf723dd0e006770b6ce982e896ab0380b053c6c687432bc32d4fb3516ee17b7fc1c34131dde07a992002d38fa7191ab544a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59c22baf3bdeadf45df3434ebb086e632
SHA19aa2b2c83d6b1b52e276029d1a5fffd0e82c4e38
SHA2565ae867e2dfe4a1b6f9d6797a763e133840768b1758ce60a8f01cdc0b060a3c9c
SHA5122d0ab6dd01593ff1cc8c5e25e946582cb0b1bdce2cd985ab170785ffa48c45f17a71d3ed9bdfecb35a3c8b21754b09daa9dfff7d8e6aaed0a509742ccf32de73
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5427273d7bec32f16af857d3667d061cd
SHA17b45a8358e2d83c4498081b8a1b3fd3d3c26646b
SHA256208c58fe8300db7ffb5f589c8fe383303506c10ae499e8d4e36608069a08012e
SHA512fd4cf582d1d2983999a19c7a0cef6da955d191e36ef0605e3454d0b82df8fd546607d4f360b8e5c1ee1355f5b151cc5b870d2919dc12853e68f5e5462d53fa70
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f3f027e1144515f98fafb1f4b3fab67b
SHA19fd583a3dbc838d63075910070a8ab507a288a7e
SHA25602476960ca20cd731acf4d4532cb4d28def35e47679bcaec611a85b77a2930a6
SHA5128d645f014183c254ac9d9412d2162772e5d3121b70da098de1eeb5873183e9cf375e87c8df9d2269198b55c87b85940939c05023fa352a5e432380904620392a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f50c394a7baab675b737d0c62934bd9f
SHA198bb34739f3441a5f17dce08a8a3f59130dfaa9b
SHA256dddf9cee0ab2d41e3977bf143935c852970b090d7108fcc23ac3e3a6f4c041ae
SHA512b2e4c117c369dca6755ec30081b3a18fc2e248dfff2511afd7757557aba0c3a6d1a5d2beae999f8d981c50f3f95634de738853185090031e0178db93489a1e12
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5465a700051861e3fa70d26e5f2c8c7de
SHA16c16043446da3603542a3b9a63dfd8c9816d9dbb
SHA2569c1d7fb9ec52e39c0258793e114a3c16f9d3e9e46a74a1366fd32087bcacbd32
SHA51248751bf8e6d4a1be0f3503b918bd3323d2586e5c5d8abcafcd1f40c63a296282e00f73a3a6c535f53f86bf5e635239c39613582d0dd08db950020e513b895563
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b