Analysis
-
max time kernel
133s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
08/07/2024, 20:14
Static task
static1
Behavioral task
behavioral1
Sample
2da9a0c4ada3e743f89ed7261218e091_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2da9a0c4ada3e743f89ed7261218e091_JaffaCakes118.html
Resource
win10v2004-20240708-en
General
-
Target
2da9a0c4ada3e743f89ed7261218e091_JaffaCakes118.html
-
Size
10KB
-
MD5
2da9a0c4ada3e743f89ed7261218e091
-
SHA1
2e40b2bcc1401b48ccc72aed9c3139710ba2f106
-
SHA256
d513b1efb63153bf57467593937cabb8c3aae6290da8f57306a07a2cee412b89
-
SHA512
19f5205ad3b097f8e92f0952a051cfa51e2a200c736546e46cff14ce2785c44937c9efc38f6e511c6b21d492e0ef9841c64951cf63d8a0e80cfdd96dead040cb
-
SSDEEP
192:2VfwlIsr03tTtQ8k/w1wvqVkZtwBtstHntqvtAtGtNtK013auBuLbdU8d:sfwlIcutTtw/gYtwBtstHntqvtAtGtN0
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e07f5178afd1da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000796d565dcb3f73ae4b55049fe36a555338d4adcc950dddeecc083e1a86cac52f000000000e8000000002000020000000f45d978b72f93531aa879f0c0551c48ab103ed3f80b66d4d1014b1389a938ffb9000000007a769f532722bf79dc79fb0ed840fb9054d4ce26949430ed0fb33bee591b789143008ec1fdc555f07cfc98a78f6b6ade6bbfff269163462e617b73dec23817cc4092f72d4b31b4f53cf39a8af4150b0ae18649206950b5a5b9cf036dae2996097a0c6e1cdbca33c7d38fbc7825ca5f651e9d613ffd36657ebeadd7d597a0b29f952a1ebbdccfc53726fe2efd3df3c8a40000000db84d9400cdbc560c2c3fd72b1070a0dd6115a37b25892f604bbbfe38fa413ff31dfcbe1e4321c733cd516040c4ab9f95e13b0217eb31cd9f6bac52c3b35a591 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{81CA0741-3DA2-11EF-A5CE-F62146527E3B} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426657231" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d9909000000000200000000001066000000010000200000000eec011705c8bc4991f85abdb470fb124a9a61662b77bc3aa5601ba414aecb66000000000e80000000020000200000003323129d56064bb2b55eddfd1557af4a3706049ecf1a31b89627883a0da28125200000005f4c44608fce1be1d76c054146bf97026822a6668186ec5f6dd3b692c0f51d79400000003bb3b554c5986da11a5ec9a1a1f0c0489cb28d9a259679cc13d37e03de09055d3fe0ccac2700b5b5aae18c8c35d1882061bf56cc37f94ae6d21cac443471f288 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2208 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2208 iexplore.exe 2208 iexplore.exe 2868 IEXPLORE.EXE 2868 IEXPLORE.EXE 2868 IEXPLORE.EXE 2868 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2208 wrote to memory of 2868 2208 iexplore.exe 30 PID 2208 wrote to memory of 2868 2208 iexplore.exe 30 PID 2208 wrote to memory of 2868 2208 iexplore.exe 30 PID 2208 wrote to memory of 2868 2208 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2da9a0c4ada3e743f89ed7261218e091_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2208 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2868
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f29896087f07ddfc661307dc1cf11b36
SHA12685cf601b91caf973224b2c6c8ec9dd365cc058
SHA256c22286fdf287f0588cb96a783d03e27cefe297a829f79564f74079209fdcb42f
SHA5125428485e81db673c0840900dd5c6e6f6c573a4f9635ce3bdd4802c2543ba1ebf44e21168899b1841d10fbf064840f4c1b11afc59fa97169f716d2d5cb945efec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53aab310ebf506d5111fb1af336c4d06d
SHA152870ab896cd95b81bb308454949cbb667cf1079
SHA2565049f857d8bbe9fbc4791a84ff567ec8b97ade335f5f8b4fcefbfbaffc6a9da7
SHA512f689e65df9f6b58cdb241c4b767e060ab533c9066acfe83969e674284aaaf323ee99402ff6e98cca0158f6688a9dca965bb6f0ef7598b70f48d65819c9992d93
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d76983222ce2c49410598b61c2517e1f
SHA176346e617556658082e4066d4e370d5d7ab20ad5
SHA256cdbc764aea63fdb3b47530facde23ecfc8b94dc277a5a1d5947985079b4239fe
SHA512e408bd8926d3423bea8a34686d7fe76456dd1b31caee71435470d1dabed1b6720d6dab373b431195b3012ed84e743d696ff8fdbd94b48ce036d190835e8e20e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bead4b7b55a643ec4473818eb225118d
SHA1521f1e7362b38fb532757b8f4b9e805c2bab3a39
SHA256afc3e157310f935ecce62d5486e3dc1542e081f7b51f18f45427813b6d6e5972
SHA512554a7914e537c338867fc01204e024557c709a138f06870983e541f0b0ef8ece7e68c88e2ba75e20828516b7eb70563cbd048704e3ceb33f31035175ab35fcd1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56411c3588f31eb5b559dd57535fd3d8d
SHA1041d270f0d9a37880ed71e9ffe1b8d14984876f5
SHA2562051f6b965848d09960a9fae29cefecf2e1c024457c8170c2e5ef85e350e18e1
SHA5121fb7d71b8a279412ef15c79eb63abdf187581f2099ab39cdffc2e873760986a0cb4cf09df517dab871378ca488e83dce863094cd995a1f868360d0c2ae79bab8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54dc5b2f28b898a1ca14b1f1f9daa348d
SHA1c5afbc2fefbfdc1f2666555293a1859e671d60ea
SHA256c4edd08e04a5118226ee01010d438dedb831e318a574f323ad52a59d2d7be7f9
SHA512d931018a76dbc864d94d2291199a4afb71903b9ac8019438e60e795caef65fd11228bb356ddbbd30d80d797aeb16da415c179c533b8bd119c410daa9982cf89f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57a40b926bbb0c77d3c122846678535aa
SHA114a7433cc3a20a76db56d52b8e38c6cee1d0e74b
SHA256e2ff56fe88a2ec7f5b8ec0a8c1bbad6ccedb15d9413efa4cad04da9b2d83a921
SHA5121e723282d77be1c51d8e91e1569a6fdd47b2ea28755ae958b7aea144bc3a0121928b68a228bfdccc8c286e86c06c1c0b3920efcdfc2f9451d6793d220ae8c02a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53cd23914ef349feaba6ab1498e12c0c9
SHA13bfe47c3df4432060c8ff2c139ad141057f5c39e
SHA2561d4059741da25272bc4d97391c7cb0a816f8c51fa61df209f61b387a25c6af7f
SHA512cfe8d088cf1dcd2ed9f828d151c9f657b550194fde95fb66ecc8938b6b067c2c7da4cc0b61f05f844c4efe67328f6182b7a6e5d8f461a2c2ef626ed34e61b84c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c8a1c3132cddd93790627294ae32b16a
SHA1e1bfa468cf3d16ee76b3494167b01729c5f5e32c
SHA2561f75b830b226175a8f8e06d892854a7521aabce8217baf20034c0962a3876424
SHA512dc6f9603a3ca0071180e262e132d040e445b109707a29c6e9029777153a4aaf11e630f5be67c8e9943e3c12cbe9249bf31e66c9e64cb482a4e8265704c1d786a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cb75eb79d013190e395c041c7f059135
SHA192544c8b8292b629c1fdec270f6592f02dafdb42
SHA256e5711fa7db75d28cee4cf5943c184e995605ce8c4590b7ddd35919a3640a3386
SHA5126da3aa0c80d6ce8357b00b75daeac8db658d05d987c728434683dc53bcf5417d6317ed2a33b46198baf411e10eda70d085909fcf34417d48c2e4c8b3e1928010
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD500949b273a768a24c88563d677809e57
SHA197b53d916c1105bc2c925f708437ef0befb43d27
SHA256d99353b89128cb37d779f91f3f3dea13b98b9c12977e626d6b152fb3f2f0f3e2
SHA512ede4b2bf4abb7e638e720a8e70d04cad97621a9f9fafce2b6d1d39e83d1a8251d94a41b0498d5d3149ff65854f9d5143c8ab906972817347e065a818ecc71c3e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59998ed5ecd62e3c017617c94fde01e28
SHA14fb8d72792bff109e6672a52440295caea86743e
SHA256d461d0d27baa56108ea7bbcf6ae6ca37e9372caeef8c4a20bcdf95d80f52967a
SHA512e61a1b1544226253dd1845d54a2f4c774b62c8f5268dd0dc080fc5628f47cf5dd9ac98498e17b48e5722b9f3d22e627f8828939772260e80802d8391684f2fef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a86153af35cd9fcf5b6c07dc1969fc44
SHA1c1b0f1394a8da61191fec0dc3405831ee3163973
SHA25621ce05e4cbaa8f425c33e2fc3c286985316d4eb85b5ae31645c0e5c66dfea4c7
SHA512a313ddb208479dba98ede7f590f5c1b395380ff9f1e6e8776e57c5477397d00d6340d954b71e5fd912404b738cf2ce7759eb80cf9e1854917cf81f998d893dd7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50ca426ecf90b45433749a78019f59ef6
SHA14dca49d7ab19f0394a7fa0df172120d0215273f6
SHA256d24becaacd85a63b949529318d997275ef4c7687e723c674b77a95262b136120
SHA51295eebee9686274dac5862981f8f086ca1cffc5cce8e676885bea2dcff3ac1d83c4addc7f2cc1bacdf9c8788661487a9dbbabfc4c991169584f98232aad7254f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d5380a5fe9eb2c6f24c40044c1daf307
SHA1dcd73a4452b71149a8fd7f805f8b5619ebf6addc
SHA2560365012bb23d2dc1baca8a8ab6d32c33640a8dd77659d9d554f7848cf801f9a9
SHA5122f5283e795aac101f01ecafde462ee72c6d9518c1f060607da4cf0d256a51ccacde347a71173f9e689c5dc64f9e5d76737286111ad4862b23d858bd834731a31
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cb24db2aac5134dd6e15bff9fb1f37ce
SHA134a401fac564a68f0a6598d5b7ca713c6c4044ea
SHA2569af633f0e257a39912fd25403f2b6b3a2928b5de9168014760602dc7b9040ed3
SHA5127cd91cfb30807a3db6a3c95550a98f556bdc23f5f8b28b27e8c946d0d974e6ccc27c3e02cfcd753de818696a01dd5f91b258d35f39b4336f21b562dc5baf5b3e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fdb9794b578a2e71ee03ab4e7ca76144
SHA178b9a227b650c6922b8965846d0e613827487d45
SHA2567d495c9531398f1eb5e98960ef5d2b304df00ccbc6826b0bd4af3129aabc47d8
SHA5127d81e8865a021e2e4756a082c87c485cb8976b8a10159f69859eb6851cfcd76d3f7a9e3ef4934288764e481105b910f299e5f2dc3e9c5ff499e28b5b2c84bee0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56520cc884dd76b9a9a942fdcd56cb2f6
SHA11b17232b40b577234638cb95fd8cc5fb131e3d3c
SHA25640387bb335ad2dad4e9dca9903f60c1d0c96d30260f6dcc54c3595f12fec023f
SHA512cddcaaae2c554e8057253f40484f083367657a2c5a6926446355e2372b51ebad94b2007ccb528170ba4b2e89bd951f252437c2a00452ca8cc20f79f799e98a75
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57a0f4ac2991ec1779cdc9a16aaa6c53f
SHA114b60e0b29ef707a8e2c129e317dd8ea73653d13
SHA2560b830ed7f858e8b6c5da298ee3043782e9ef9dad9c06c40316841b69a59a90bd
SHA512dd0f4c38b83c5fe194af2903f2f0af41896230aaf77c7522828015b5341f201b1c42646215a753dbe94dad14f2ffdd05d513c1e23aec9e10eadc71917624cb08
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b