Analysis
-
max time kernel
121s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
08-07-2024 08:02
Static task
static1
Behavioral task
behavioral1
Sample
2b93542d2c918960ecf659a6f1bde532_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2b93542d2c918960ecf659a6f1bde532_JaffaCakes118.html
Resource
win10v2004-20240704-en
General
-
Target
2b93542d2c918960ecf659a6f1bde532_JaffaCakes118.html
-
Size
9KB
-
MD5
2b93542d2c918960ecf659a6f1bde532
-
SHA1
8404ada4c3e67fc34f12ffc123f13b643a957a10
-
SHA256
d376cbc703e63edbee36142cd9832bc3811cbae41ad0a9124e84dae8e625ac2b
-
SHA512
7eee290b80a5705ad3faff4cfa68064642bc128738ab84cf8fbd8f0e0a27b78d22b95abfc77610e81e2daa2173a468b601a87d8dcdf0ce2e5b3dd086eb8e5fcb
-
SSDEEP
192:S5jkTsZ3cX1pyyt799bjEONzBeeVcJv7J7J4ApKNXImIHjq:S5xRcX1pyyt7Pbjbfee843XF6jq
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426607337" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b016df2a3bd1da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c00000000020000000000106600000001000020000000d212ec2a60621cf1616641a7db50ade73728fbeb39e281c28831297c75f4d92b000000000e8000000002000020000000855c9104752d0eee3447d07364f189be42ad42a9db85776805d6c15d36028d13200000008b813cd91b990a9aa399b7a946c8e8b065a4c8f57a5d96fbe5817fc413053dbe40000000dbaa3713e1a74b719b54faf09a491032ab660630fdae687b1d579c4ae76cecddc38284ebb0b2566daae67b40e103e0eb1e4b639ebb32af9a228ce9d7be9f1021 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5616CEE1-3D2E-11EF-ACB8-4605CC5911A3} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c00000000020000000000106600000001000020000000b4752e859424ffc924232a0c4f28ef670064cd310d6b476698458be613092693000000000e80000000020000200000008e3c280bf419c101674cf5423c4301cf8b10569a2a4874030cd0048f80ec86e990000000147dc3bbf0ae06d14c777f684a7b7f40f313f83084e549262ff56405d24b49318ad3f8b6c8ace6981d00eba1ef494e45849cebef6eacc60e794180122fc8a6b95c9e7f4a0efb9d7ef930859057934d1de9f277233c5704945f435cc602ffe36bcab6ca51e6f8e4b9675b56a8ffcdf6fed6a1f0173a54576b70d3ab37a40fa9c59603a350c3a1f9b462cb49dcf6e5c05e40000000aaffe4490638a11ddf0a8c9f3ccd5e2ad0310681e1f5e35c5b23494ae3456f3d3f01ee82af1cd67eaca1a71fa355f418e0cf29728b5bbb01da9c765f6c5d58d6 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1620 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1620 iexplore.exe 1620 iexplore.exe 2816 IEXPLORE.EXE 2816 IEXPLORE.EXE 2816 IEXPLORE.EXE 2816 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1620 wrote to memory of 2816 1620 iexplore.exe 30 PID 1620 wrote to memory of 2816 1620 iexplore.exe 30 PID 1620 wrote to memory of 2816 1620 iexplore.exe 30 PID 1620 wrote to memory of 2816 1620 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2b93542d2c918960ecf659a6f1bde532_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1620 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2816
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD52683e2e82e322dd23f6ab2330c90626c
SHA1ff5ef8e821b5ee7c885b3c055d2bd38c307dff93
SHA25643ef60619845ae512c175b6c057d165245c97e4c2b907b0fbcb6f0dac227409f
SHA5121f2ca0ad9d3d8326c3d4861624dc2884e9d15aa6bae29308517f578c863d81db6e99f2e960229699894d43fdceaa9112422332d0a7ee4ff5a7867b3a6c54c83a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD58a69dfee78ee23dbeb4276c0b7f39917
SHA1e2a3889655ba2998e0d70657c64b6f30ca8b1d09
SHA2565ab67230cbdd67682ed6b27aa25c005f9da8e61a2b3345dc6971d262b9dfa4eb
SHA512039523f6b1c744598af15f95ab5817ce262c1bb99c47c4b80f7f8a819c3eef1af416729132381642dc85af9797acfc53f3323a19d40113179bc9a2ffab03b664
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD52c078773c66bc00ba1a45c8785d0071e
SHA1ea699bd3485f0fd3e2c3566bf7da266356618b40
SHA2563cd46c6abd5b8d28b2262a045c7e27f7ce953dade79f4c72b35cc4adb4ff5ef2
SHA5120447cfbe02251de56033c93999b490286916b78eba934562467db8c7da91ece3ec2bb14cf437e9de42442cdd1365b38aaa9784890c31155d92604a09a26bf39e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5a0d1b570fc75883586b2aa844c545864
SHA19307656fef87a1231ed59d619407ed2ae7bb1131
SHA25663aaf578d676cb2067b619010560cda0690b796c50615601dd8e949f76e9fa35
SHA512879705b7188c3b3d2ae046daa93772fe11c5ecd9cd0aa2d223a5cc2d1d4a089beb50369386249b389eb9c75488096dbcfb91e5bc5e554cd63a217939c0a2949f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD55a108e8506f0a2eebbb1dca7963a9925
SHA1c1ef6def6ffafb9900c9aa8a9d56841dc24f985b
SHA2561e92f472801b111261bf2d06921356921db7037c49993c988e6c682d8e3a1c0d
SHA512cddd016142874f67973078e1ea977c90a1dee1b6cfea0d33dc09d4bdb8ceec2e76f903273154090583a2cb56613e1ed0939f27a95ebe66355230ac2ee6f638bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5274ca4672f467ff83bcbd37635ea9251
SHA152f6b402bc9f2cfb57a1d2f7e4cc4d4e1cdb4bde
SHA256d0374c5137254660599392b7c593e08fdde83dec61f1d8b0d4f44be38f24a5a2
SHA51273bcef63393d84b229cf13721c5706309cb4131f5d7b2b74fb086c8358f42d3b17da77fffa6490d67761675cbcce5e8e8400f9aee3944fa450bb076870375b1f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD59874187d98c6c4c2fe0f0bded783fc41
SHA1116001f65705adb4e2d38853760889239a859184
SHA256fa74a7454927cfe5832d2dbe6f8159c7de51a9a5ba1fa5a17eff869261f0b754
SHA512c27a6ec5223f65c4d745e68246fac35e80558fb3b04d89c60bc8708b5d43fc754877717acdf370dd981289e5fa26dde8fff27de4931e07dbf452e02f4a3a83c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD56498b1af06456650ead16584a688d2ae
SHA133a33a051e2df89fb0e96d973dbeed9ae3415f7d
SHA256d688138c47dc54d1a9eb77c1276e75697067f5f81e2e9aa00f902ad243d1c5bb
SHA512bbf8040e30ccea2c5194701f2093c38eed6b6c838bcde4e2a68af82a5b40967c144ebbdbb9708df34cc4c800647a426cfd76032f3e2fac6318063df3857bb0c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5a1e4cb510f73c8729c7d1bda41ca8aa9
SHA1eb11eea8a73463544d9f0d55808205e9d1467980
SHA25652d9a6e1d5a2bdfe6a54dc3c99f8e593aa06b0ab1d3518cb0b5eadb93f51bd79
SHA512febce3789aea4da30e770107b4639c1c6029828c6319286b2cfdfaff9679dfe1e6f64117d30ffe2c0b2a0f6f867f3f004517ea45c9054acb58d58bb5625e39d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5e5651168601212f4332fd8c0cd394ef7
SHA11d4034a1e52f50b283957280f42eb9f5a55ffe44
SHA256385288dc1a81071d3eca29211bbd170765fc18c3ca167690ffd473248c392969
SHA51256411b8e1acb2f504dbeac9af26657477899a414b0eb4a4016b5174eddaf9e0d1cecf93f961b5391c39fa244220b9e9cc39e884f6d819317720fa512986bdfa7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD55d6f96ff0f6d739866a4a714ceab3aaa
SHA11d6da91f8cf60a6802cc7ef51a62fff5a380de2f
SHA256669b4e20768bda0f18efb17739371468937d2b85ad03cec03a9eb47e0114ed59
SHA512d2f612fee60f4af42d0e47608872d986d8898009553591267d7224f9633605dd52265bc43206fe2c3442a587349b3afcfa3accc51113501e3493d16d56698d9f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD56da518a56a7eb14865e2fa594bc5c0bc
SHA11ebe3f1bd32bace2d89f0452538cf4fedb8c5300
SHA2560613c580286f8ac11005a7571e145a67cd08d1ed8762312ef4c2912e126cd93b
SHA512d31e887fb4bdce2ea34727b120b94e545c013af01d6b84d96dbf2a9671b7eed42dd648070b8869c328ecd1471eec8d6e189f9cd8fd8a06e1ccce843b793674c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5effc4c25baa6b6e605dd9a08f06fe59b
SHA1475396b6e55b6cfeea770692c823f830904d8cbb
SHA256fd559dd9f2b71d7a95e9ce88e1c0b24c4f49c3fcb79547a5d0b41ccb07aa3e40
SHA512e55bc77afd4d447f0363f7d6fd74ddca7d13e9eff65d61f6f9d531ba2e725ac6dd000665695af32fc68515454909b244921685f8eefff0bf68b6bca7bd5e2eec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD539c4d4af2ecb2b4ce3984f2ca5610c54
SHA1fa0ab2fa3ed51de88fe68756897751023684670b
SHA2563523fbad56c3ce8e1fa282ad3ce374acacd892fbeebc4555c76debea870912ef
SHA512e2c2f7ba95008747a32daf104d871cec9936463fd6ae1f9a2e505cc60ba99baf096f4142c46fd5c75296af810ae5d4682ec6126cbd83d330a0aa610f7f8f819a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5ba25c86d5d192ee8b4e3b95bb9612819
SHA1d0b48ff7fb549727ea2506a1c93abf4210d54b68
SHA25628ec57c34325a3d9c05c974255143685eb21853926d1cd754e724dbf813787c9
SHA51295123c6e0b4322c127dce4de2447e0da5a09c2298357a81b587dcf2a80e69968c77a812a31b080c99d9470749a8b5501dc2e35a1da74ca84c8c3290a83b44a3f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD53745e413553344cca1396e1800c2c5de
SHA1885e12ce58ff6532bfee3403a383782f6e73edff
SHA256ebc3398593a64243cbc70b2855618d7202de3651fd1972e2a54807fb0e3b09c4
SHA512f4070f3a16706be5405e25208dfd3183174807483f180e3fa9ba8d307a3ee5c9d09c586b3017db49513dcda805aaffe2be87b723aa6209ad357e5f85f3b807ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5b6b175299a9e8b00186be2794f2704c6
SHA1c48489c7fbc7265fff8c07f255791bf689b0efe0
SHA256ef6ad20e0d31be6a53fafc02af7a66006375e7cba39b3b3951f07b945558b6a3
SHA512460b924d828b28bfd537b7bdc2ca706fdfb2a2c09e6f92b1c492e9611fc38bd84d1b2ccfb12b39edcfd14536cf557131720c8472718afcae0d9823fa525791c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD51ffcdd09d94de7a126a3bc49c408c663
SHA1d4c0b9580bf33df603fc73c22e5dcab645b5f6eb
SHA256e66084bd740010beba14bb6a09c6cd240bdedef7698ee22c4a4432064ecfe3f4
SHA512382e87e7440857891aaf96d44d9bd456bb575dd0a8537aebbf29c3ceab4dd29445271233716f3b5d608193274afa0a8ad648f2b0f7c642a95c08315c120115d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD514c0ed489bad03bc6e5b91487f35f1d7
SHA154e42df71ea976c7261b2b07723138bd9c4d552b
SHA2567f3a3263949f998db12874d0ec1549579bd1ff0f0dd2e9ef317b7178ff6625f0
SHA51224f77d007a6cda58c1788a74a6d8034f15357bded955465d2cb76b3b239003b266bec790cfba7ec6089ae786d23b1e9d106e207b39e94a24265ca098be50ad5c
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b