Analysis
-
max time kernel
142s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
08/07/2024, 13:24
Static task
static1
Behavioral task
behavioral1
Sample
2c832dfe17bbf60f2ad2136dd016375a_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2c832dfe17bbf60f2ad2136dd016375a_JaffaCakes118.html
Resource
win10v2004-20240704-en
General
-
Target
2c832dfe17bbf60f2ad2136dd016375a_JaffaCakes118.html
-
Size
2KB
-
MD5
2c832dfe17bbf60f2ad2136dd016375a
-
SHA1
a22f3093248edcbe6dd503df32dcd89559308fae
-
SHA256
8f229b52d9877f1110af33fca91ba6eb918b81819f1cd9e9e899f7245c8ce0c5
-
SHA512
5382b30a7f00aa5a6438bc31a6311e1137e7b918f15b62c9ed8cd6303a63aa95cf46fdeb82373f43c1683011dfc3c710f617668211d2467a2116861dd2a124a6
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ED004C91-3D70-11EF-9269-5A77BF4D32F0} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c70000000002000000000010660000000100002000000029f377883b72c5dfacd3fa12efc9b9a2e2513a60f5bbeff0bb784b5164f40f38000000000e8000000002000020000000186ae89c2db2e27d7e940893225d1dea74f5acee547af510b70fc2b5501e3b9b200000007977a4749ce933f14b48f73c75ae654348e3130525fbe49b68cddac81f98c59b40000000436687dfb366b3fadbdcfd074d28ac1293373e9a7205ce90fd7430fc82593901ede93996184c1c71b66f3d8133333e248af76fb7c29826455c12e156bec73a4c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426635937" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10c01ac67dd1da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000754f5cedf646d05d1d8d1faa07b6e3fbdaa1ae76568a6461ca72ea7b66dc4db8000000000e800000000200002000000020d59d940bcbe6822ec2b0fd67b12a2bfb5a95befd470f9510611009b2832207900000007de09e10730c428185351144f04e49eb934b72ec70aa33de2956d69fc274d2b7295332fc0d7771a1eb7b550cc7526ba03f0c3d205ba3248d9062ae4d182e0fd1b774be55b54fd0696f0f675363073a3675014d60b0b695f4bf743a0a1d1d60390755a492f1cbf7b402d75ed035102535f7bc6d0899f1bbb3771c18193e306aa5b5ed2645824396302e263e97915807ce4000000043666a8197ae71c608cf3502bc625a142c9dcdb493fabce61eacadf1d09ac35ca7ae33a2e5205aeaca48be442bea62db471e556b689879eecdd8891de074b2d7 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2700 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2700 iexplore.exe 2700 iexplore.exe 2728 IEXPLORE.EXE 2728 IEXPLORE.EXE 2728 IEXPLORE.EXE 2728 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2700 wrote to memory of 2728 2700 iexplore.exe 30 PID 2700 wrote to memory of 2728 2700 iexplore.exe 30 PID 2700 wrote to memory of 2728 2700 iexplore.exe 30 PID 2700 wrote to memory of 2728 2700 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2c832dfe17bbf60f2ad2136dd016375a_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2700 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2728
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD547ee40c1ed8d830edfdcf756c782f80b
SHA1651195ac5637399782581d6df6e926723d346bd3
SHA25604d8e9f6204c7e298c759e00012914b7202fa5b69c6aeba4b2121b84d0d1881a
SHA512aac554b3f607852d67e3bf1fb85d45e63980b87f0434a0d18f2eae7d4366241a80b9e851c07d03216bc96264a809f93860169eb3991c65990964c4e4df2c3b68
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD534ed9b3f6b9c2abd498e3a89c53dc993
SHA1ba434d37b7499b28d94a8063e1e45f31f5cc28fe
SHA2561f6bddd3d07a39a9f4fd13ae23f34d7c634cfe1ed4447c2a7e3287e55b62f540
SHA51229b192eb80fd368e44518d5711911e2dcd9d18dbf164284b27c0cdd47e8704458371d3b2569b53cefe01bb9f5f5ef71624b7f7e201cfa5b95d6540b08edfe39a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d05633a2372fa91084a3b459fc6e9420
SHA1158180c24b6473f74605911063c9d9969480d8da
SHA256ef72e719de231cf415547e941daa53d7dafaa8a0b70d17b34fd5ac31e85b793e
SHA512c4427ccd067e972b2a0619cf275d11a03a56cd6df278850e05c9f8fffa679dc6ff0a6d089d9c3f18d92de1df29be63aa4f65de6980288b8c915254e72eb10ff3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b5c53a62002dae99ed2e207f100a698b
SHA1adfd2c1e5dd1a8df7d391e75dda187a7f65b6bb5
SHA256c2e54382ddd5f0d755bc6478d39d4bacc956d77427bed2c32d0c41b149a866ab
SHA51236637376e8a0ad2e245c5d323aa9bef0946591b522f6bf5f9029c0ae9ed85959a07c497f6dde774bd5bbb46b44b34dc6ee8970f61e5046152212169fe00b0db6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59f1034ed0ec7ee937b148a602de781ed
SHA117129d421031ad5de93052e61e68d3586d50ba49
SHA25634e443c27d0565ca5a2caa645c1d264f2d99075325eeb6408af3ecbaac9ee647
SHA512b65994981929a8ee797493da7d90298dbf067bf037211554203af5a7051485d1d34ae99a1604ef5b988db84ffa6e0e6d1e821f4f7a2f058de90aab42adac39c0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57e1143f446edc1297ca9ed1f89ed75aa
SHA1469ba2f66802ad27b3806d355bea76a988456fe8
SHA256610c53376f3ec8ad87af0adc8ea9583f58e5655dfb2aafc8348252422846aab5
SHA512d86bb3d0cef5da499306c41f44597d46bdf58b99bb98ad73ff6d26378931b86473caac6bb6bd014317a9b7eb30e57c06fbf69d3410b87a41710d9d2fdc3a2812
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5066801283e0d55315e696c7a085fe4a9
SHA10d359e3a1d965d37e2d451e12ab1421d4aea948d
SHA2568610239652d7ae0fadd2a2d4db51e89083f918c6f92d851994cf1986623a9934
SHA51204cdd1bb34eb6663dc71c68ba9d6fd0acf3d089343ae947c9c31051409e96232bf1068042def807e0f14f49ad862cf044f147aceaf0c337c1249bee7688b0bbf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f6479b36ee0a9555d2243d50e6259c6e
SHA18b482fade97e9194052c8a2e27e005e7aca76825
SHA2564714604c9bc7543ce556484b5212864f60754ca21bfb74b2b5b09728cb7f1684
SHA512c2fdadac2d1217f680a791de925e1802aba00501b06dcc911474932430938d00a8d003db273551481aa8ed25f70e4039385527a2607d50061bec38c804387171
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fa1abcc1842a1b330164e9ac1081cacc
SHA1fc39f87e914bf45dd9997ad3c783f9a1388a1b80
SHA256f975f89809cd31e3fea47259305d8887d9a2732ac944d7db7653b399564b3425
SHA5121871992d736047f07bd7bf5dfe2f96e58ef41adb4bab7bab15393ad979b6f700a7d3208fe3022de1d5a3d00b87cece0e384cd8efefa594949c2bcabf5c40a889
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5acb9f58d73846af732ae394274005d06
SHA10fe4e7835228c1cb0fc0b8bc77a1f9f3df173eae
SHA256fd285fb8c1ffcbdba533e42d4f66dff8713927e9b7587988760c682874ef807d
SHA51294f4ddc66f4563b002229055e20991af88b73b09ecbd29bfa8bacbd8204f837c208ba0832896b557a70290e9ea15ef76662daab4b3ae60de169d5f14782f6a7f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD516ddcaa95398b3970182ab096baeb982
SHA1baaab419aef1e7912b3e60167cd7b263054d11b4
SHA256afe0b1c457b0c6086ef404937fda8c7510e5eb82581f3191033afd4f0cff0ad0
SHA5123b2e02fe18fd3d81f23868a8cb19d6e944c3db28ad4745c045c9fdf374f46bf3655912ec3f466e7b9a2d0aa2c5f67c2ca174293ca7253d4e361e518955da2f34
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52b2efcc13bd0bcfd304a4142628dab1d
SHA1e439b1ac30e58a6ece984c9f378b314a46bf354d
SHA256b367dedd64f4e5bc4c2e3534b27b5e2443893eafe8adfb5a9668236e379df9c7
SHA51204e30732fcc7e8897683fc71adac02a84f0e0754a82ec6857623f7b05908df333e75090874b3e28483b0a71ec670e2aa20e4fd8b8d5ff212c7cfae7e3c450f39
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a0593823b9eb6f38a781e81b3cd2fb6f
SHA1079c03e681abab9b02767fa1bd24ddc436f1459c
SHA2561e991a3ac4e0f4920c0bcbd38e2c45079dc2252cf3fad646c7248a5f5b36f694
SHA512c9985e2da4e52edf779be2efaf2ebaacadbf89e23a968481548cd07bc79f97f676e139f5d7a5763bb964a94c893422bf583d2fbad9dc3f55c67328fd9c643eb3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD527733fd8d3d94044ec615ab24c6c7b79
SHA1ce032c2afebad3dafaf4be3355db27fba85e679d
SHA2564f8d0bcf351c485cd4cd130cb36a19c21cf7c0b465529f1f5db05c1aaeb186f4
SHA51265419b3de8b77e8697f9ed7c5937c282fddc2f4cde3fc0b1151a2763a5e8ebb376a360f0559ff79e86ae87daaa3bf1b8b6f62a4255cf0eb0fa741b63bf65bcc3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5160a2c23079989ac2cc58ea67e5e5b10
SHA115eb70436b4afe6b29a2778e286c4ff75fcca224
SHA25636b3bf71d832732cbeb1a6dd947a94a8a34ce8e090c60026f07385cca87ac737
SHA51290b6b05f812be96aad947a2d653fc22a3c88b5e0a1a29a9126f69a747557abaece13e9f41177810db24978d9a6bc1378b5330b05e24713abba0b488a9c84699a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5631628af9052ca8d5432a90e4a3d21da
SHA11992b2773edf0ff25e8b8e43a4ee3a39968e1303
SHA2562eaa0031ae9b22038c1088ca30997c8e93d581dc50dadd3b45942608592afd4a
SHA51282614ada28cf077568ef0c09b0535feadc5be46618c37de259ff69f1e67de6265cc1c2a6e510e7e1f0b3ba48471cf1db0a3b744cb2a868e380334dbf77bb9996
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bab52a1d1eaf16e2ee005a6981913399
SHA1a1012baf1b2a524ed415bc18019069060d628f00
SHA256ba6c3d18d209b38e63812102f0069b34cccbf12c86ba32022c8d802ab1264b38
SHA5121af8bffc85a4711953c0dcaaeb925594be383ff089fa7566def2a7fb84810969d26bcee2529ad6f32f5cf57567152ec140f61d8df3070e462120179b0bfbb702
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c697894ce1ac725d247dccbfea278900
SHA130ba704dc9eb0bd8183f32ad6db1ccf25d04ffa4
SHA256294c5e0fdb0c4efa630176d85e32c8272464da13ffebfc941c8ca197650444f6
SHA51206e57c6cbdf1d3418d2f0f4346ed9efcb3fd96c54706d8294c4ffe1e983a69fb2c4543f027263f30b9b1d1db25fb71aca15ef4faca32734384da68bd774e47db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56fb8f91f4b654c1582da26e428a0940f
SHA1763b03648a9a2acbd8c2ca4418febb3413001505
SHA2561208d046c7f234dd595404e42fdfd9dac13712fd221035359cd8502832d9a9a2
SHA51287b68db0e95d0046767c88a2abd80686ffd2070a900faa65d3b0bb3a0dbaddb19987d4ed323f73578deef689c1e963ad362ec0dd9f92be43b13585029d6b2245
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b