Analysis
-
max time kernel
134s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
08-07-2024 06:51
Static task
static1
Behavioral task
behavioral1
Sample
2b5ecae5ceb8db352e8168bfdc455772_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2b5ecae5ceb8db352e8168bfdc455772_JaffaCakes118.html
Resource
win10v2004-20240704-en
General
-
Target
2b5ecae5ceb8db352e8168bfdc455772_JaffaCakes118.html
-
Size
6KB
-
MD5
2b5ecae5ceb8db352e8168bfdc455772
-
SHA1
640768817fce13dd20f756a33393ebe0203fe8be
-
SHA256
796451409f03c9aede81dc35bb8a85ac8074da29113e4d1ea5dc2a77528d327d
-
SHA512
2f437a745644066915c480aac9ef52f12810d1f1cde2321d2afc639340196e4dac5e3e17aae6a4ff90951575deea6ea659f8d8696fb6f702b62b4face4c0e88b
-
SSDEEP
96:uzVs+ux7zjLLY1k9o84d12ef7CSTU/McEZ7ru7f:csz7zjAYS/3b76f
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f0000000002000000000010660000000100002000000096a9869326c8f37c895b7eaaaf9e7f30d41bb9f5aeb67d0f2df149c532161a54000000000e800000000200002000000027772b53af2c791b948edda97d2f960d0ea4faa3458399f0296fcc71a3be40649000000002a6c12a08e26db45f435e12d5a2b27113f2070f9d1d088dfa9805c438acbe6c4f77627ffa3934c71ace87f540900fa9ecad07340f315884177e3ad2d5c835704ec92cadddb30e630f005e2027ae1ebe7605c8f39b3d5b6de3d2df1a063dcd938f75bc6962c64d29a007ef7fdfe81156fc83ae2221a358ca9e87680bd03f166a1b33ed2f22fd9504a629287035230a454000000039a18d5668ced5673049eb8003e4d04258486998d7d81a4bfbea472fa51d64fbac1226f834c52c42ed7c5298b6838305e82e0f056577435ab45d652aaad47184 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000757bda8c1ea7f0c26654adbc34de39d34cf26d147721d453c578e11a38fd6f88000000000e800000000200002000000077d4c2cdd647edd3709a7f943bb93cd91ad3db901d9ade895dab16a4cfae6824200000001504e37df33316d558475f7bee77d9e09ae379edb917e277d3356a2bdbaa62fd40000000e661d90fb1838146d2043222065b1f2d6d70f59460d26dab8542718d7aab16fe29df61feb19d95766657dc0691687b5ce71a68a048eb16f1c3c849cd6dc41b7d iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0a1858832d1da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426603625" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B1944031-3D25-11EF-A372-5E92D6109A20} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2096 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2096 iexplore.exe 2096 iexplore.exe 2560 IEXPLORE.EXE 2560 IEXPLORE.EXE 2560 IEXPLORE.EXE 2560 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2096 wrote to memory of 2560 2096 iexplore.exe 30 PID 2096 wrote to memory of 2560 2096 iexplore.exe 30 PID 2096 wrote to memory of 2560 2096 iexplore.exe 30 PID 2096 wrote to memory of 2560 2096 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2b5ecae5ceb8db352e8168bfdc455772_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2096 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2560
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD564d878d52fe5e64a5806243a5b39d9f7
SHA193da789571c0a5eced6ccf2a98f39860bb6e6868
SHA2565277c5b3c08f9aa05f5aa7fe02d3acc2112747d1af03db9e35e735127244a321
SHA51297ab1b9453da1ef665d66510ad0a4151305fafbd1efe1189a08ef5e2d38a328f7db7ef6d6b7fdb669ad3aa60121227a85d2e9018e88ddaeb81cfce3c337635d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55e9a11cfe38ec79c0cceba26cbde5d6f
SHA19ab378e2989b8aefae75bd2dc49d9a30665330a4
SHA2566e24293a3f23bf27a6066241bf1d8a90e54d11a2b045791c2666d3c3c76d3623
SHA512a64e8010616c7cc413add1ab121ba9dbb75817786e207dadc996755d3fca6e6acfaee36bef2f08bd513c219c9920e2a9e5be981d37bd91b2695de3eddb4cfb4e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55d963b23a7aa5d47aad45c61794a8e1e
SHA17898500ec4b7a7392788fb1da58421177e4234d1
SHA25645801929d4e22a7067f5a608f70b0c6fadccb20be6c4d3218b63aa2c5323bb85
SHA512f4d308f90b31157c8d1ad99dcc1d4132d77814cf6ba1a2bf2cd3c2042556c1b8bbcea078cdbab949d40a0e694c8f9c42e3054d7539c6400f0ea424c15d143433
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54b6aac7e6490afa9df086857ad04df9d
SHA181116bed4cbb7f40b24df3acf1abb79324a9d138
SHA2560f751265dd6aaabf789eeb89ba6d2e4824fe2ed3124782eaf0e35b896b944b2c
SHA512319fc34ddf791749845fa4fd6cedf923212d9bc1f1201c9299e3a210516d8800774cd1408eace2712ea537c547a52693938b8c8f6954c5081a38e91ca7b121bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bd910a531bf2b1fedf8e63fbffd63404
SHA1f86a273d9a4216bdee276d97a361d4f22b1f942c
SHA2564909ee82f6fc4e6241591f22b57b4b9a963e694840dd36794349fbff74e3b812
SHA5125e81280af3acd2844d96b58d1c560a480ef257548aba339266e80058928e0f5cc9815c57d3d26e015139496ee30adda09048acf5e3a74d555ba6801566733f9b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59dde306d1bedb8379de522bb0bdbd35f
SHA1230fe11d69ab2607cb1e3b1bf8e3dfe2bb61fdb1
SHA256dfef6b2a26d58625ddefb855239272b04743016ce80e25f6ce8a942fa5fba809
SHA512edf101c4208c114998bbe02b3511282d645bf94d4a1ed2bd80162a9c67d2613fb390f205610e7ede4d9a61cbe5a89dc5917b2ec3922ecab90802531d689a8fcb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cefca25bbd06de37785cc50bf1d12a35
SHA1877aefd4fc09b3eca7a7fe6107ccefe88be6872a
SHA256e1c4b049717a70c5419b360321a1846be84db4e8c68b4d234b8d3a6c7d6a3798
SHA5124ac3f0ab8bd3294a101a7f395f86a062323fe9fc001a3037113609cc883c273662c5bf38c578a97355f33f73eb054927cb3dbb6928a3a3e5c1c5f0b4732b004d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5962117c550ed5aafaa01115ba0d3ad48
SHA12cce06977e91481b7f2d112c9db473aba2a77a7c
SHA2565c223d9afcaed6d31b6e46c61f9df905b783984be4d2224673b46d4c6b9705e6
SHA5124888fa94fe72b62a1f4e9298cb6f86496629c4a41edb91faa4bab7f962f57768d5451531c1a4de17d7944478201de998f1e09ed801a2b3f343234d77742fea06
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD527b15436b67f68e0d648aeed881d9b88
SHA16b569c8990c5f05cc622a778a47cc2fe379b48fb
SHA256fc521cb0d6d8b39066a35cb83e32073f476511795f7235d42fd539a446eec0cb
SHA5122b5634b9e722d1e7606eeeabdc6f904ab27e19275cfbe8edd6274c2fb612df0781e25479fe8d25a2eb8cda6e3b456893927568b490120400a3c1d179bba5a0c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54db909d018dbb1408453882ea2cf869e
SHA15e988c9ec22cc59e3b35ae14de77e43690b9269d
SHA256c40ac0104cb8b6111ca0cda0ca08d78abb4bc7a7e447094488167d26f001d082
SHA512fe45138b043fdc26e2a16e9b04e5b113652fa376008cf4c9a433ddd8066691c44c2c23a2f629d1945ff619a5b1591dd4080d59c71ada59ebb5713f05778dd81c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e90f39367641d1095947c396903288d5
SHA1d193bca03e2a80a028aac568442fd769d9529602
SHA25660295601abb55607678fc8502f08beebad0352be96e7c22012045ae5c317883d
SHA51279fb57122873be2f1c64e7abe121c3f692abf40a6c68572dda0aed4ad7c3d427113fcd442aae0d4dd2139954d0e077b28f5f44bd1a0d3cf4b8fc0ef10bed949a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54b77a28f5118aa8b0c64a64e657abcba
SHA1c225a34fd13f16433bdeed1df5ded1c3e5b57cf1
SHA256c2326f173fa6a6c1456ae784ec05c26b4cc7453ec6b8bab40c233ad74134a540
SHA512b29114d412e6d73bdb1531dc69e2459bca0cd4a6a8a135bc3ea55e6095ff6e6eded78a5ce31132c36a3101cd5fab4a6e9b810505ddb9f9a436221824d3bd02c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57938b43df2041c702e981c34208deda8
SHA1b373a702f40d884db5367383c453031e4c8c692a
SHA256d2e5552c08b5b69516f210f08dbe30250af6eebcd29ba77a7b764742aaf2fa8d
SHA51200938e74d10b0979461112e76c003775915aa5368da43c578c85e94c8762b53955886582d431b968f4ba310c74862f7f1c8cfdaffcd91a882b88d82a95773262
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD501afe638ec304b669404a6df160d4ac1
SHA1484a19cead701670c363815d8a1e99b38db59873
SHA256624465dc71be5ceb8ba31fc00c634525f25e60b1080e27ad09878a743a29f942
SHA512c63ffe83f93511af33f3e0e72ce6b3114ca7d63137cb3f9c109cd5dbae3b2aa8063bfe35dfaffbab762e1057ff81cf7bc3fcd94aec3fc4433974c8efdcbfd1c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5398bd7a6c4946e01bd8b6c477f1d7331
SHA1e945f8a9593e4e4919298a0bd8d507254ac2a207
SHA25699233a61e508dc6995efc16fd607c6a0ef80d8b7135422925031298824d9d86e
SHA5127dd18afb829919ab3ffa9f4d2d1d241ad2b75709b08707dec853e196d62278769ac1ecd6131ac8fd3d4214c7150d3788906d7e95c92b146e89b99f02672e71a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a54dd89680ec3e627c8e4074a2dc2849
SHA1f770d83bf726b481c65c4a987ece78ecb4aef2c9
SHA25614d66fa131475af07517fe1345149114ecf890db471789ed4a860f3feb5c4abe
SHA51290b27d34c6708592e0da4499102529e59e5c7f488b756877d9cb31d0b7607285dbbbfa27ba792993f9a3a0719ce5da4526275b1b177bd4560dd7133c7afa52b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD547857cd300d94698ec1c65da9fbbd703
SHA1009f39e38c7480ab3734b0513d5a323014cd5c95
SHA2562b0511ec7418471ca735fb183be80c8dcdc8ba031de25e8dadc36fcc1bff6293
SHA512a04759f9c81623063b2f03c429e3e4f9bb5216e8a37f6e6658639d9eb54544f319dd24080f6e6c5b77884de6d58012960cc25c33532f2e651e35e3189f01daec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e5a1d4125c4c23dcc86fe39db6948658
SHA107dc9e4c61a4af888a91f0f320501ede6a9c1e59
SHA2560278203854542b2aa7b1472154e50ed993bf01acd750afc1900c716e68496073
SHA512365100a0e6b03bfaf423a6b2b3eb140287dab6484bcafbafbd85e3e9c60caeb6df3204b2e278018474b51b264a4b38174093c6d7a0deb4cff6d93533e514983f
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b