Analysis
-
max time kernel
134s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
08/07/2024, 09:38
Static task
static1
Behavioral task
behavioral1
Sample
2bd854b8363b2d8a7e0f3c9a01d73ed5_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2bd854b8363b2d8a7e0f3c9a01d73ed5_JaffaCakes118.html
Resource
win10v2004-20240704-en
General
-
Target
2bd854b8363b2d8a7e0f3c9a01d73ed5_JaffaCakes118.html
-
Size
6KB
-
MD5
2bd854b8363b2d8a7e0f3c9a01d73ed5
-
SHA1
13ed4815c84aff3165224e73d8a216edb954d60f
-
SHA256
9300ec725b74e9ec677c55c72b6cd4547471ee792f3f094df716719245fcd9e4
-
SHA512
9b2717f78eab97a1102e1c1c4a39487d3e9bd98cd3f350349f749890f3cbb7c2a8d02fc5f8d161114c62fd35dcf1374b2a97fe3dc84c969a169e124373fd2d8f
-
SSDEEP
96:uzVs+ux7NrLLY1k9o84d12ef7CSTUTZcEZ7ru7f:csz7NrAYS/Wb76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426616066" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A90BCF11-3D42-11EF-91F6-D6EBA8958965} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f035510000000002000000000010660000000100002000000006924e8f5a8567fa62ca7f96a84242b22101fdd8ef23b96e170d84899e1339a0000000000e8000000002000020000000560005a1ed4149bb1c44409cffd8abcb23f8912968c38911cffc1978927310fa90000000bafedad4848685417618d002bdf091c85996f34bd3d265989adc2085bc418619f7f6a07f9e40a435642715a418b33472aa3f30940ee06d675c9fe37a464b751129b797c611a7c0f7f5ef69b5ffcf15bdda66169c00eed1bfcd274ac72e519bee70f7cc6d9c3e1f7a983bd28f256a1a9280726a84d16e20c7aca1f55a1e3a067aae9513254647abf5f97543a4c2b480d7400000007e7921f7c64e58d7a51e426e6e67c38b49d4dc9086597741207ac9ea0f8a9dade372b428b6529a21f365da4b21f14ed69df759a887271aaef63a7265d96987c3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000a43b88ff39878efe6f0728d8e92a18221def6c8cdeded6e763fa74800a70743f000000000e8000000002000020000000b6a0e0d6a505c1b7821bf7a0f5af4fc58089ae3804869e8c2c528f85907c625d200000008ce67e158909ceca59f28cf6bf400802ac41d865703aec417bcae1c8d7652c9940000000b57250ab44255641748f5f3836166864836fd6ddabf33288ab2cd5561bb4502731df8a88e55498e2b8b86b4e570910331020b71f3883f3122828c890214c119c iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f091437e4fd1da01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2512 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2512 iexplore.exe 2512 iexplore.exe 2628 IEXPLORE.EXE 2628 IEXPLORE.EXE 2628 IEXPLORE.EXE 2628 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2512 wrote to memory of 2628 2512 iexplore.exe 30 PID 2512 wrote to memory of 2628 2512 iexplore.exe 30 PID 2512 wrote to memory of 2628 2512 iexplore.exe 30 PID 2512 wrote to memory of 2628 2512 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2bd854b8363b2d8a7e0f3c9a01d73ed5_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2512 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2628
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53948d9f5e68e5da99a6e635c5b2c6a31
SHA1cc71f5328ec1ab0358623792765aac43a8e19364
SHA2564ce50a02133da2098f50d9854b6dbc255ef5c0b6117611bb39938f71f57f5371
SHA5120d9325b814b18e65dddd798a33d0a97d69c2534f9ea0e728cd8f2571eb46729a79f87d359f1f2a14b8144376fc3da3de9b937a3a9d92e93e72d77da2e6aded00
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD503155584e34499dedbce5a62ef4a8e5e
SHA1e6e6ec5c8805cbf6ac26e3a8f1fff995040453b2
SHA256d53d05056e94514ba825d2a721ee1e76f383672f30a266ef8c56d606fb56230a
SHA51278eaea778ed24b96c7dee5b3ffc7cec6484cebfc5ac27f9603e316020a182e902b5c4acf6617838c4f7771ebe8fb588aa6600694b217f85adc4a8cf4f7716da5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57b8b7afe1ff85185bc726d35b72faf20
SHA1e3ed0fbcfc32ebc70a841473f4c5c22f6a3e3319
SHA256053b6a277fdfbf0356437b5c6cdb86fd2d2134241d7c4cf33340738de1fe16c9
SHA5128cfac163e888870d5e28b5c3620a5ac49826626465f5972bae571bb5aedb5d264e0b67b973238366de8c6e18915ba36a731777dc073893ebd4dc23fdb3795603
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fde7d57d6604d88b941b38ca14b605ab
SHA18e4881a8d7534640a2483634feda2d08d10323e0
SHA256c7b9a4090141904934de0228b43b404e95cd3cb02e2e4c7635881b506c527ece
SHA5121434719b6a35ded07a8a62aadfcf3bbcc5c1dbcd6401bf3dd6bad4b99f68545749ff4666260467d5a5f8a3e63611e40783aa20c8b407f2f473c1f95b93305c10
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5233aa16b4d6d940dc232d010969cf734
SHA15d94c069eb84fbd4b2bd3f78864768c69a397e78
SHA256bb6b92d4cd955701802b623472460135b644ac4dec73d4e6bee37bdc033a5efa
SHA512e053b0e6ac340c131a8048cd744a627a06aca18964b3c315ba78ae6651808bf1171f2074c5593150eb9d14ea0289259a5c2df37bc3a76b85fd890c73f92226f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b4337937fc148542ddcf902426f1bd79
SHA15d23e243d250455b505640af1944d998db770b6a
SHA2566554fac69025afc4ffad89194164e9ef9e68e4a0a98cac8244fc87b62cf0b6b2
SHA5126375d89b1481731d51108234ed3d340ddb949d22468ce7bce3e27b853ba35dcdc2b84be48536fc3dd11792250e3252b0dbbbd5bd42e7816b618197644333bd1c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52ae5247128032c90d92754d477b09541
SHA13bc4d037aaa8ad17db5ee7cc333a0e27fc746f69
SHA25690f3750008be52a42681c27e8a4262fbbb7ff42bb04e17448d720119f5e34dc3
SHA512f4e2718cd5ee0b8203b9338850ae8a5c1462707842749e006668c4b397099e9a5570dbdc8df2e4ba0f9877137f7f0ba7a7dc6685328e24b291a3fc3eab445558
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD575722a43f0ec7cc64983dd72b4f0d976
SHA1d50f9270b7b9a8bdae165408bd275b28ae8b337c
SHA25613a911269387c14eea846e1a7d59848c567c769a82059941225fcb2c4f15473a
SHA51272357204e56f7a6d44bdaeb1921f7634bf61bc7c6dd3ba437b4cb3b9e4d1ecf5b00e2a62ab58fda1bc8fae28fec8f3ad6e710efb46def79899c47ddebfbf03fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD564799021b3266f342af8d24d64ba3baa
SHA172ce300febf23b6c44ea9ff9294b5b11636c6b09
SHA25699d0373c198795dc441230b7337abe966e610184c87951ae985744da8e269dc5
SHA5120ef00171db76d7e6c06a73fce541ebaddac0c834bff2db352808f277c84f476c26f97056a68a3f292d860b7855a1f7ff5fd0d8300fcc733e144f27cf5872b837
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53abd839416f6df54c4fc58a376763ada
SHA1f52f2dc3acaac76ca6117d7a6c10829a3cc9fc23
SHA256f67b107698e4ce389366b4ffd8c0bb9a674e0936a39151448d2da68a1cd0fb0b
SHA5126a6f194a3e225df23be3e394b9f06e06da789ea824b3bdc030bd83a84f05de7190e2f2256c2f9059596e3f2dfef3aed34f844e258fc80d2038c8b1ddeb62a0b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD595bf00a69560ddfe912d03e95b4fc772
SHA1efcb6e9331b7d44498a36bc6e8e4b3935c20608c
SHA256454aa044498203c2410bdbb8e3d47e4f1aec2c8c42b9656dca557606f16ae2b1
SHA5121750844ca7b90d5da33ee5518d7748bd818c600c46653c478d39b89488d5cfa68b30e80d54fd305d9847478a271a41f33720824a5f45319a1f3b473cd1bf9b78
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d1c7f9a2b9931634283bb003445c46c7
SHA18677c4da59007ebf992308fa2072281ef2f2145c
SHA2560de3fd905a952df071dcf526cd2d02489c9283d21247824738ec9d391c9193ad
SHA5121577ce85d6f11b2d85709951d55821078172e192b5d6829ddccb68ff3b85a6bff0e72773b2b3d3fd9fb33248cf3a7f555be8f706f8edaa50726fbd91e5c8e82f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50794c21bd947d77f8abf5f913219e40e
SHA14b7ca5dafb4d08422dc588b6b4af08b950670c9b
SHA256b08730051571312e38dfe478c286b053a65f7acf290460eff59236f9780d156a
SHA51230c330f45be5844a81ae49019398be8952d8b00219d999bcbb2d8fd27a5817953db1d40c892ef35500199f9abe7d6ef135c48eeb9fc4b522b4b7964cfc9c3a24
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50da148cf23685f798bace5857d4dd18b
SHA117c48f3c0f76620753c0574ff799ba2f41cd2db3
SHA2561485b3c42175a58ce994d2a42211b8b0b2dba6fef6f4dde7a0bde72cb9a3ed99
SHA5123c955953d3e9af31fcc0651bc5075bc3353aa62ccd37ea97882c1cfd86d5871b643ca1c7cb0dd91659cb2e597b37c6802ea17fce79dea4ef46bd9f7d65558609
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58779930e88a152d6d1107b1830b1f1c8
SHA1fc0738d6c19a95a5ddd7b9df59c7c4124f25f39d
SHA256b3de3ae0d5df49df37b33512d468e7c7476034d6172822033128a991633701f5
SHA512a967bfe1492516245487eb803060d2761d0d9a9da09149c573fc2131fabb46fd52057d2741dc07105224b15155483937c7e646c657f0c0d596c1f87f10f32c1b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ca0da030e860e7b9c14a8559b7453a02
SHA1ea660796538e8cc6f434687225697a1ca0a7e588
SHA2565c89824804a08855b141c1f4009913dbd5ba4b0c361d16210c919cf83d2b12e2
SHA512e24781e6f34028e3d3702a4e8e8dfc61d3787876af15ea01b38ab9f407a38d3c29d758a8f24c8c715a96588e546333ae0399bf7ad0af7700652ab63964a305b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ac092ab676d68fbdca09907d3031af45
SHA1379ccb198c43c6ba7080ade132824b0cb82034fe
SHA256d1d7dea9369bc1aaf7c51c37f4916f46082ff84fd6557e3589015d79c4795a5f
SHA512603d7f344cef0f8e1ac453c98a1e2ffef25f3b20222ed1cf4a21a0dbe71dfd9285969508f2d6d27ba3ed2b8cc7db168639471bac777f2284086097b9565e236f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59cb893e1f3b32b2c1cea2b48b4ea370d
SHA1950e821b6b383af6e3ed998238cbe5b0a957e627
SHA2561206f2be96a440ec0f9a7e61978ebbe8633ca79eebaf81d9128c1340429f5288
SHA51286b26e538178cda57e5f77f0bd98146455377dfed70512a1f5089f267beda4cc1f3d775ec8904270f087232f25775eb39a1e6fafb97fb8980dcfa2bb81cceecb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50a482b6f0730fb185f9d4e59594ef594
SHA1a1b997b7a83cc9a97ef711cf2287d3e3547b3158
SHA256d11475de552a311b9be4b4bf7922de267a0c11161a7edbdf38c02350b4ec18be
SHA512c8406facf101d2cb40916331294674f5b21d063df0e158eae92618439cdab8a4e9ab7af0fdf12cd399b33cba820162590649e21d204aa6ee4e648a2a3c54db66
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b