Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
08/07/2024, 18:45
Static task
static1
Behavioral task
behavioral1
Sample
2d6d68a512260fd46cc2a82a40709df9_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2d6d68a512260fd46cc2a82a40709df9_JaffaCakes118.html
Resource
win10v2004-20240704-en
General
-
Target
2d6d68a512260fd46cc2a82a40709df9_JaffaCakes118.html
-
Size
2KB
-
MD5
2d6d68a512260fd46cc2a82a40709df9
-
SHA1
109ba94f8df52c81c34bd61a2d7f4142c5b42d23
-
SHA256
8867ec4adc0ba2896175ad6d5710b5483496acdea296949fab32850129d4deb4
-
SHA512
ec3206151ec6be245cff12425f4d23e9d1b89aba9a48caf4467a5a1f52ea4f681396d20d38432d76942d3c0f4a5088eb241930d44639feeb40e17e69fd057f6a
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70a0b5f7a7d1da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000e4fb597aeb385a2380633b42fc8db6154d4ec1815e18b24e08d61751d00b2201000000000e800000000200002000000034747e13f9bcc6c7e3e83e80364ef16844320bbe6e9e0846c5b094f654d085c42000000022950764be9333270e96c089c9731f46b7e49e61345740d9d4e7290d3c503465400000007164f938d1695bd16f60c2f119dff7cd764ecbef30308bf3b9a138c03daa4faff95657c21438851ff97676c3b7883ed454b805b64498bb8ab1bd4d62a329d34a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{23421FC1-3D9B-11EF-A7CE-FE3EAF6E2A14} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426654066" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000f1735187a11d0f0c25b8d9b421b186f79107603adf0af1c78efae2c442f79855000000000e8000000002000020000000a61cb27c90537bdf45e0de17c3439d2cff00800a63ae3f45f1cceef2c84276fe90000000f0b6e1b8042ecd9ebcf8b6faf4133cf68ba4f13d8d4959c9a79180244753556d1a5ec0fc7635899a2c264571413f43556b91c9ae2cceb6e11cbd6f206e20a517cf4905acc59f2f83db9018603e2a979cc6551e0530b7024aeac789a1025ef88d228ed18b82a827064a56bf1ce847194dbb3381a938d5fdfbc0748fdcc1f26b4c93b548d9ea69a66649e964132b26800840000000719fc76cc19cbe8cb3c3e9ec05f2467765697e4f4b8d6254519ef0a2510fd38f62dba7df23b936ac7cf8a42a98277d76e5956c08185c4c65fc5c72806abc973b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1992 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1992 iexplore.exe 1992 iexplore.exe 2508 IEXPLORE.EXE 2508 IEXPLORE.EXE 2508 IEXPLORE.EXE 2508 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1992 wrote to memory of 2508 1992 iexplore.exe 30 PID 1992 wrote to memory of 2508 1992 iexplore.exe 30 PID 1992 wrote to memory of 2508 1992 iexplore.exe 30 PID 1992 wrote to memory of 2508 1992 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2d6d68a512260fd46cc2a82a40709df9_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1992 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2508
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD561f39ad2f4bebed330d4bce650cf86c2
SHA17761c70cdc84d276cd953964c4999515067d1851
SHA256653e3dee21832b581cd7a6e472a048829f0c5ce2f45c5dd310bb29e5d6b5a4ac
SHA512daff60e04cc43829d609a233d29c530ec0375668d4deca1b73c5aabeea7601fade92d5769e0a05f3a27ce76fff32eb8e12062ef5271cc99419e841e93955b9c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD518761d62bc1b374617b731b8ebef5963
SHA1be68ea855313b1b872b60ea26f93f0e8a99df385
SHA256a5391e167215f1f73354e91294fd55fb15bc1ed16774ff131814e0342dc391aa
SHA512e39be08ab0d188c7129107a6b9c05a21e74f2b80d700e4e908ed6bafd38b6fea8bcdf1763ab228129354b13d9f3ef74ff656fd07ab99e1d1fbd45fdb9baae9f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51055882bfcbb3db79a9d244c7f908a0a
SHA16a8fc93c3a87edfb8a7e0ae24f8ab8515a53e286
SHA256568d909ae9ae2ffacc0f98ebf94c6f080322feff6558123f595945de093b6db1
SHA5123d3938284a1bedba6c6836ecbb7ad798ff799cf626bad89ceb239d8e9e2e2ec6732ef524ebee49735166ebff60a7f7e293b4d32564c1f055cb2a4db348314bf8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54a7999401133b202b86ef4353d017e29
SHA1655cb65429bbe8da12d687f8a9d15b7ae051cbc9
SHA25675aab4c6e5668208a2fbbd04018e30a3b061bb24b90332baad9c8d840a8141c6
SHA512098ef3ee5808ef55cfae2d17b0da82d5a1b16e92b16dc40533041af87965a9e557f420be1e747425f241ae3764d18c0e72fedf73675afaa381e14e99c2546f55
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58033a8278f34bec84b1fe1224153758c
SHA1f59ddb25b84703ef20dbc5825341a6ea3839e41c
SHA2569d630ba9d16785dd0fe12f40405e0aca86ca82eacc88152e3a85ebf34b8f3c7e
SHA512bdca2926786e9295f649e2f84704aba5790fcb35adb58ae91abaafbde256cb7613efee40d6efdc0906b4f43fcb1e4f6552c27eb19bc5cc198d00295807351969
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eb8f54496dbf1b61e4f1980cc271bed5
SHA125ba0b7df4259cc9196e3b4d965ad92913285d30
SHA256cece58b17881959610e3d160a23d8e119c9563b9a69fe72fe817fb231ebd5c17
SHA5120ff013a811f87daf7c8c72d38bf950d6c37e60ba4c0a9c301017aa78d7397b09931c73c37e893b0145116f0d3e1468e1b4722d948dc109500500e030f3cf91ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b01abc806992a73ef273a47cabf7a2d4
SHA1a439cd352c79967b3cabbcbc12a57f8231df8333
SHA256a73b367d8af572654c9d5a4188ae9098221a736d46af0e88f63e5406fd564384
SHA512c2af8f94d1dcb1d42df19348e8ec5708a7a904cbf5c16f5e65ffe3f04b4bc638741779356deb87e3364655372aec6e5b544de23cd767e2a389d26e8c3763d5b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57ac40210ec4c56b9e80dd02f62eeec9a
SHA12d5f1431d01ff67ba8740b5a7fccc21409bf1de3
SHA25653f0d87ececba6d54bf90276860322233967cf54363d9cb89067690361305020
SHA51235deaadccba687456b7a8232cb9aff8b696c14884e672627cddc3717f44129a9775dc83ac2b21fedb84aaa8262f4bbfda3e738e421fa36c41a099ed56746c48f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58785a867b9e44683a8426b1b44a19733
SHA112a4aafacaa76e5dce3113c9c582184a3a613f73
SHA256032f7e5299150f26b0df21a12e6bccdfaeeb5ac7979d787791ab0376e62c7752
SHA512eb43a4ee0ddd52936ab7223550e2b3c9d82001834145c3c1fe785afbf6b6360266040b4ebeb39b0c33bee62ed680a21c90a4fd3d4c52dba0351fcc6a27d02e71
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e21713991a3d3d6d25901c6fc19a674c
SHA1ebf85afde1c53018a085a53d28fa6ff1241b88bb
SHA256e805ebb9b25af201c8ed75631e0d5dbadae0ef454229135fb7a687ff9222cb7c
SHA512a7b0a067fa8c381e53e9f01bd9327379dbef51bd677aa29a98c0ebcb2d50c43854e8359e456d947996b45ba830a13fc2a9333fd62973ad9d6756408911a08420
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c373c6da6e8a4d4fd0f225e6bc991f16
SHA1901e28e92b8ac05f1f2f11eec1772358ef5b8dc2
SHA256226f8c56a0dd79200c4f4d51fbcb68632636e7d401e633dcd43c721dce658659
SHA512159f3318e39b99707cf189d94499b02191e5880a6a5e39b3a45f856a586e15e7e5bf0a6ffb65b8e3947ff57b6553d674fa6b69016536c1c1fea9e7d62a1e33c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD549ccd137d440dc6e6fe55a0377a961dd
SHA1eaaaee3ab9c5591673d76226210db27779c00056
SHA256c59eed31dbfa085fa35ee9dbeb00e8c9395bd4640705ecbda17ecf9c5c5d992d
SHA512f703af5456c89bea72ae021946b51ad08174799865fb0a0ffce1091744e878ed06d57fcbb15c66863e3d979b7661e65cef4dc91d544fef2e72be518bc00c5614
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ce32b8347d72f9c51f9c488d384be698
SHA1d06dac7bcfb868ad8d559476b87fc4454188c5e7
SHA256770ef95bf552a71a5bd0c4f986d5693b4b9d5413b3e4598c1a8d4f4729a42528
SHA512d8196eeadb9da98f79bcf03f1f3d241358a92df1e79e4435bf2a36433e1ac716cf182761cfed480403c7104f68f327af2de6c4ce8b7ad419713d051ca630bd9a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bb8e21470ce81303464dbf8d9872eb4e
SHA121bfdd712e9f60d0c8cefa6006e399f3e666dff9
SHA2560c762c5c0474b738d1618ba508a7d6b1334eab5a18c27faf12ef23f4f5c4c1f5
SHA512cea858bd7df309d99587374337e9e574732930b633f7fafbd9ad29d2e9c14de213a78e564b6b1f5430072b7501171ff6e9226533bf1c670e03e452fa7bdfac96
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5274464563a22140941b148a877270c5d
SHA1be261dd5a17e906b4aea6623e791503a0cee9e48
SHA2563f6d079cc2521ae9f48ef06d5f70e92f3431f4d3dfb0ef453522bccbfd5b41ad
SHA512ae4f1b604c67e92b2197323f8b77829a57dc198cdcd60a6e9005e107586ac3ad739dd6fe071b6844bb265bbf716ad9088c97811662f688f8f5280203cc66a35c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52ea533425bcfec8fbb1e374119b3f649
SHA1493f4c762b9c426935b0da096dcb5aba029adcb1
SHA256d64467b1bd90ecd96c1edd47c1a19aa1f917b088d0d44307794f8e97c104307b
SHA51222bd78391cb614078a003f9653bdc305ef39cb045537cffe049738a95ee3964995cc4c692ebe1d4e0d10a93817a4b96662e9e252f7e2bf9c3daf4136b396f380
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c2518a2e4efd3ad018ced8f703a81d4e
SHA119f34933521cec7e85d2a98cf42ecdeb903dfdd1
SHA2565fb08ed3af537d67cc16605f4629cfa49dcd32da395de06a251889c61c491de8
SHA51226c8dd4632d89a78466f8eb2539b0a52401d6430d068230ff79b7847e58acefc985540b04762f22d66f00c3a42c5fcb40293d680abb9c44e8e661b2702935b3c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50c88d75b5281e48dc48c8c28cb3923b9
SHA17c52c9028a12925d2e8e57dd9d84d3ca6f245df2
SHA256a541dae38b0d3db607e568731a2c48c976d2464e3c639b8d8e0f38511a3c36af
SHA5120c1fe706f822f66ea581015fb74a432cfb9281da130f1c035421c3278ec28c5fbb516932af84c2e871940c9eb32acbc4d3df760f2cdf3f607716dc34fc11abf0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5baef79ddb6af4f39632a023c18fe4403
SHA1dd43fcfeadceaf9743a4a55f6df65849630ebc4e
SHA2563b0292ae5b284ebb7a49f6e301dc2914eb44ad7188203097c078aef833518e7e
SHA51216d463534cc53658d70bb4d3bd6569fce95e2ace51296ac20be1e39c07b21a443da4a636ec507e0e1c775d545ce6ed324353e45317b44f5d310919bfe936ca09
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b