Analysis
-
max time kernel
117s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
08-07-2024 15:20
Static task
static1
Behavioral task
behavioral1
Sample
2cd3463c12f4a3f6da59ec7bb1461c12_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2cd3463c12f4a3f6da59ec7bb1461c12_JaffaCakes118.html
Resource
win10v2004-20240704-en
General
-
Target
2cd3463c12f4a3f6da59ec7bb1461c12_JaffaCakes118.html
-
Size
105B
-
MD5
2cd3463c12f4a3f6da59ec7bb1461c12
-
SHA1
10d457e5967ff45f353b4ae93c90d480b06e7d55
-
SHA256
f9cfc7c4059f3c4c42c6ef6d4eac257ace7c3535f1856871e8fc0230d854fdf1
-
SHA512
fd89d615c8468c38de8fec42dd66fa96fbca96b99bf19cb29fb00dd5e4c86848f2c53ee20e3d9c47a510cb051b245756e949ab4325bcdebb31268e6a5218ded9
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a021ab774ad1da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426613909" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000e8c7b3fffe9519eea6d7421d1210f3b7a75704dbf6c2b8ed0e1e975255590bd1000000000e8000000002000020000000d24d88b3a7302fa523ab98a01a571e90b34dbb18c33af16ae701a7cb498bacab20000000c0cf89119904641e14e4e6555e2267531b55bf39a747e8568d2b125eafab710240000000e0c0b6f93c323aaaef762c17c08912df380df8259f473e2f482ba6a1bc6347f92c233b2406045f5971563d26132455d7dc5b74b417b998fc26281c40979cd784 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A2DAA441-3D3D-11EF-AEC5-4605CC5911A3} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b700000000002000000000010660000000100002000000005b0b168c1742b105cabab8fb44c732d1e27226aef8cd5dde0e2cc0d29b089ef000000000e80000000020000200000000045d47f617950b0cb5ab5fb4e23dbd876fc1db1e2aa25205d372ff534f25a5290000000237f6a5127ad751fbbaac382ba96f60329568a281e6a209fdcaa24380cf25eecb5f7c1cedfb80942b8112f68ddd10789764052daca7487e5b1262d8f50f8ece78a3ba9b470b6a63a3affeba50cd496f513d812f98ea9f0508029cc0dc4e7d8ccfe5cc0a2619dc74e3d65b28ef84b050119246806d402319eb3de5ee8c152a2e34c961615b585c85173bd71a20138597440000000d03b8100c4ffffc92f47a460526376567877b7e6fc1b4049ca3a13d3ddf6c1e5c9be2f242f096c11e6fd08482a5830d2b94a8133122e392cf8421e43c7cd0054 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2292 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2292 iexplore.exe 2292 iexplore.exe 2184 IEXPLORE.EXE 2184 IEXPLORE.EXE 2184 IEXPLORE.EXE 2184 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2292 wrote to memory of 2184 2292 iexplore.exe 31 PID 2292 wrote to memory of 2184 2292 iexplore.exe 31 PID 2292 wrote to memory of 2184 2292 iexplore.exe 31 PID 2292 wrote to memory of 2184 2292 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2cd3463c12f4a3f6da59ec7bb1461c12_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2292 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2184
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d9e0b5d437197f66df18900f18f88f7e
SHA1da1ba1a24769e952254b5450f0df1afedca899b8
SHA2566e54a9d3723ea451250264ba1d3fc67bc80bd60e1e4db39fb365be47f74be25f
SHA5125e3f495732ded9cfd9a6833e78569cde062c909e4a7ebbe5f7e4ab294735675b0632c976258499e6e26cc852b4644edb2e2ca73e79becc3ca2586b8c69c87004
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56462c65ec3bd29dad290eac2153b2f12
SHA118e0a7218f65dd59dd583a219768e68da2afb9bb
SHA256e5c6239db536a9263b84daad8ccf810a5f9a44e29a3fa27e2148bf4aa7472ba3
SHA51235260e491f8664fa98c38594883a608828061272903b57180818126db820f7e885f3bc25a72b56b2a0bbfeef07e8252a076b7849e75119a73b8eee5edb3b3b02
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5795df7c359282c21352377815c1b531e
SHA158d1b415874170285230d214ad1dc831a9b41379
SHA256b8c2ff9bcccf31ddc611e9e2041529f876c96f3653ae715615ee32e464f39b27
SHA512761ff1374723ca80b3c1ff403002cf4b5cab882d8b283419169c33b01c5a0efaa023fced2199cd0db4f516957961890cbd694f56c52891b390aa188934a0a22d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a45eaa96d15c41c2400058a48e80f172
SHA13a675985fd14dedb9d238ca8b6d5f0c1858bf797
SHA256fdb8ee2b78f84c7e1941c1f7acb21d670a6bc50edc885fb64aff19140834b07d
SHA5125a63357753e9747e5e6026297f3c776354567da0972c4f8ded4d9e26db6ade0d06feebe3395f3804fdb040d623ded1bff72a5c88d955395cbcf1af23cbf04040
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD541ea2adb1e48fa54a28f3c95c61e011a
SHA12a745e66f94ea1c66cb67e264680f2d7027c41bd
SHA25665690d51a0d883fe428709842e00336e02f9ba62915d2c32eb6edbecc89a1f0b
SHA51201fcccf64d9ec089b11adf78a31c8568677cde9d2adc6cf78202247812ab58ec66c4995c69bad94825d7bcf4faa7839d4206cf65d9b28c39681cdf7795665838
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD575befcfc9b6ac186fb6396c1ea4fa732
SHA1b8f96f60bf0af4182774a72240807ba9eb93b77a
SHA2562b7cf7f88199ae5909796bbf0d90cae114648724e024b268605db765ad055a29
SHA51284d221b6d4f86b5b61043025184a0ae38ea0faa57590bb7426ea2aea418f0b46c76966c9da1625bd9aeb6f19e7e1ebbaa8e543fea6390de2edd40a3186ac1e5e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD582942553dfa8b392329461ebcb7e74d1
SHA1a0708b5f53bdad24f5dd3ec9a5ec100fecac4c19
SHA25636ce821e0206564595385b920599b6dae84e87e705e6f322462d5f30fed5c506
SHA512fa11f58df1cc7b421ad5888ff0d9afd733603e2fcc2d2f49e9073d4f152f786e00225f4dc5efcf54343ea732382fd108c4c8fc19852817b8e1f9b72f2513535f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD535e26ddc645037f2a18c3432e965f805
SHA148d601a87cc3cf4f2b6ca9383a8124d9e52d6a42
SHA25605bca42f022a29cc5eb8d60a375e4e262f48712231a572923eb43b87684ff5bb
SHA512d9619ae5628a0f1fdfb0f4a25b5c1ec934886fe2d30fd5dd5943c041a6132849afbb4f60ab009376b797d42b82e7391d23a53fc9c4a452c8101423fa06f3c5de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5788fe22c0f0e7338e94bcc5bc264ca91
SHA1cf539863c76a5e6f8cf06e4755a44a5421ac8403
SHA2561f07d9f41066dec05c0785d28b73b47eb1dbdb13e82df0c775d5d709356859ab
SHA512826fe6510762dc631432429350282c77f41b59d47046a99e46585591de563322fb90d1d3fd9aabb917380465f69d7d49217bd789a3bf8e0cd9e1a2ad8f4aeb12
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58d9a0f17ba85988d7e8b3a4256ed4d00
SHA1fd228ec8fa8eee155bbcf3580ee9609edceccedb
SHA256a68ec9d9daea7615abd59ae57fe2486fef3be8c39a972dc3dc4dee0b49d6d3e0
SHA51208f6b6b79e02e6d797582a81aef15e6bba7845792190d34155df5f0dd7648b4f636e81355bcaa03db1aa27321af8d1d4d42e9a80f825b9c14bd3bb7aac61e20e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD503170786f5cbd83719603739251d9fa2
SHA1a24f5ffd9c1d4840e815ef961742e1dd329e731a
SHA25629512fab8456d06941078f1f0615983424346e08017b3e1395ee9455cae6e603
SHA512617b15fc17ec78221725ae73039ba2532fe60e2156dc594cef34be58f7b46db43c303e79e04e0f09569018d17d27e7770d3b65828c74240e39b3ba0fdc97a50f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fbffdf1af247c831e2fd7fde914ef89e
SHA14faba860b33e42f58f72279553eabbc7468b689b
SHA256ae1b96ae0a10ca369cf368b6d18ab0ac5d0c524db39611c41fd89ce812ea99d6
SHA512373139afc76670816efb6e104038823355d52e9be56886f620efb09dc6d4bc97eeb6d9fd08c9a6baafb88b76f7310639ee2b66ffa2d54f1e6ddbe19f3bad4e06
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51286af109fa3bdacfe4fdb76e5f34b44
SHA12b2c38385771232f237e56d685ce81a6900b128b
SHA25610c61337f372006764551f69823024dcaae730ab4a2dd8a8a0293466e288b58c
SHA512c6f1b62b21db794b9fe0ea1c4e2625ed4bfdee60960d115196c00b72414ce1f6b6f8113300b046c0ee1e07b0d8286d7a1e7584b326e1528df343a72e2c077c9c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD589582c36c0e481406410630b446acf57
SHA13337d96c44c27764f8403c4bd4369582b98b0f0b
SHA256b2d871f3933ecaafa51c3f04aebed70721dd9add5e67a005e614fe56e0e6f3a4
SHA512d0653ac444f444d19119834564ed263eebb02f7cdbb10975da6f9251fbc9931b7421eb9f588205332d73aa59cb1c85afd25773575c540326d74e8287b7d218ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b72e8942c9f4ae40544e23ff7ee7ac39
SHA1598dae34e35fdccd05d0aa1d5632525cf9ea64a8
SHA256c3faa6332e3b6e7dd49c528591e4b3d9dd365f8ba57e01c5c2f61f8552480674
SHA5125c26feed6898c7503a423c55924beac9e45632463306836686cdbeffc9b25f7ee2ac1ed9ce4348e89d0eb2ad4a3175c14add4b6c691473e8a2eebd38aa474c6a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5edf4803cc499bd321f84ff26e3402054
SHA108d6b0626a20846f19257c33c773ef4c53150cef
SHA2563d5dd77b4a0185835831324f54c55d2d2e471c63ac3cbee8a7fb9f594431cf0a
SHA512eafb70bc93b1e5c7d05e2a5dbb3d7ca539dc4c482315b1be7c8dc7d47c4341cea31d76c7e7ed75fb8f756e807677b02be95526b343c08310e212282f552a37ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD503765088d2f0f620849cc53943ca9119
SHA1d4485acee7708ed1f4891327d536cf38f3a9cfd6
SHA256a0f6176a94e99d801b81242edd0703448fefd119c6d1dd96d5e72f93e4e5f532
SHA512c23d41e8870c6918ebc88f11fa6aec15083aa56896754930707f8ae0a1923d65a99a7287e7b2f48ad85c8d3903a9ffed09c43456381c1b4a331a538c6834a09e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f832d758a186c9a3fcca454e34a6b4d2
SHA1edfdbb9940e7650d030477b82af10866f792803f
SHA2564b4c8ef5be5e9cdcd85d7ff1350fd52846483c45d4fb9a219390d1100ad317c6
SHA512ef32dd35b629aad4caf4a72e839dd738d7977c500b4354a6a61736dc5ebda2472eda5d96de8b6fdb75ecdaef2bc0e0a9f2d596bf028ae3d0b0731c9081ccf871
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57b6112c1f92da8e265a0cec575d3d716
SHA1b73d6ac98eb7b1510e1b8f3785a809702f8bdbac
SHA25638f8d976243cc5a0348ed9a956c70c5d7108b76145d4fecbc31194a1391d9f09
SHA512451b5e802dafe5f376bbd1e38714f698db5d84dd193df3215713955d0b331922767f452597ca46e173d5fb5b90ec6cb1f6805b97851ceabb3599e967baf309a7
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b