Analysis
-
max time kernel
144s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
09/07/2024, 21:30
Static task
static1
Behavioral task
behavioral1
Sample
320bb9bc0c7f7683127914641fb29055_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
320bb9bc0c7f7683127914641fb29055_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
320bb9bc0c7f7683127914641fb29055_JaffaCakes118.html
-
Size
15KB
-
MD5
320bb9bc0c7f7683127914641fb29055
-
SHA1
159f0af27118fcc751ae0935bc2d90de3da633d4
-
SHA256
c5ec53540d4ada56ca5371a7ab83bf3dd0d8bc2ab8353ebc61c8adb60d49a0cb
-
SHA512
cb9f6aefd58d0d8e224f836a2bab36bf67052cd1fbf9d8fe3ef8e99ffaf647560242e6e677964e7d10cedc74e4486a7f8cdb0517b048d2c972ff793aaaeb23d2
-
SSDEEP
192:4G3WdqdABa3kXdqdGZXCbtUCJXu6BnqTmtY/NJVTDxbQwQ7Q0QGQpQ+Q1QvbQ1Qg:oCthJXu6BiOYP7wVx4Zk8bodgSC+yk
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426723415" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000c4fba716c539e202704b1a509384d1f4037d3c18032be03c58a509003739db30000000000e8000000002000020000000e3aab3dd1f785f6612c193e8947b50f6d20a944fe1291c230ed7f82a7921b29a20000000931c346bface09b918807705514760f4439b22f731e0b9b838bace723ccf8b7f40000000a1f63bbf51ab19976f1e3f4c84a8836f0a550642d2260fef52f440db82f570fcb85de238d684cbe00744f1506402b680677c0633743c23fee6d90a8b16598bb4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{99346B61-3E3C-11EF-AB71-E6140BA5C80C} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10c0308949d2da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000bf6ac3d36d80b4d61ce145b10598c36f806606985c75e438c8ea001379e80b87000000000e8000000002000020000000bf2abf00dd651c8cb3abc2fcb2bdacf726768331d95c1a600bb4961256195bf3900000006339d3643dce7fc740b0d3a9073f89fd6e53d262896e0a4c4d224479a6c963ae6d411804220d49dff8b817a741f46f53b8de5e5a565cd62c7cce47e0c2cf475c3c67e44364bf908d5669aa30495164cd577612dcd5eca2c7b4a2bb583d8cf8b3cc2307f2cc94c62a37e31fb757603dca9290400883bfa47334ca6b5b38d120006b4b1950e6a7a7867f8b7d1d8cf73728400000006dbe25d3cf4a6baf733e35512e406e08ecaa3bb59ba88255e7ca84fd84effdb8b7173968fbf346072b2d75616f150c63cddd3616ffeae6c7229ef01dbf2a47b7 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2120 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2120 iexplore.exe 2120 iexplore.exe 2620 IEXPLORE.EXE 2620 IEXPLORE.EXE 2620 IEXPLORE.EXE 2620 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2120 wrote to memory of 2620 2120 iexplore.exe 31 PID 2120 wrote to memory of 2620 2120 iexplore.exe 31 PID 2120 wrote to memory of 2620 2120 iexplore.exe 31 PID 2120 wrote to memory of 2620 2120 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\320bb9bc0c7f7683127914641fb29055_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2120 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2620
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD582a82bd952c00cd7f69cd15d4ebc4b04
SHA13627737ce526bd7f0a181f830f101a730d2384ad
SHA2562ba6e86773337e21aa444e07952432b88e6848051327b7951aa3f4c2f46a35fb
SHA51290a8822206f81b1ecff53b8f7e507aeda8376d327cab86450190f1cd81579fe6cd85f625f0e43663dfd58ce835f927356c8b43f131f8a7595dd12e226458d512
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ef40438ce6387f6719ce9a88cd38555b
SHA17301dfe5235a96d10f92ab4eb86f1168b49f60f4
SHA256138021418e1b8a5c3ba84c569890de874f37d7573430ea401c6c1c5e272ba98b
SHA512c0543bbb36c1f9b0d0340b3af8d201d27411a135de32f9323acf8bc96280add663bdfa487273165b17a8da144ccc5055be06612d69dd33e64a063343f8de1ca6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c6a4fe2c03edfcb8d1e2b48de9c621fa
SHA1d9a5157199cb3a6487c538ef3088939549a17cf2
SHA256a3141332df6f30ce30903d4570b3962d9d093edf1e64fb63505ba43f12252e5c
SHA51223745c98431ef48e0312ea4628fcfc197120d277e953f7f775ff2f5a24cfe37c77ba256d56960ab64557b72b29addd3f4f6d1b91c619dfc7d330e3d09c01a6fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e4b023b3737a4a55ac35fc04b4e26ab7
SHA1f1443adcad32dfb578273a19b615c3c72cfedd37
SHA2566a96a450d3b062997ff6f12506199918937fb4727658e37e61be114e2368b4ea
SHA51285a8310d0fbfb80b183a86204032a699386534ed7a99ac086670d69f791b6945364f942b228dde9bb740a4a597795ac5c5cd89e3e14f15492101a115114dcbeb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d51c63ac21443410ea0e7fb813555369
SHA1eab943adbdb7405bde99167cf78bd52ceb4411a2
SHA256cd70164cc722a96a307045b399adb20a08e16e7af07960162742689726ee68d0
SHA5126b797d9748b686ebb9f7f0f07847f6bdffab954a2cf51f0d151f28461c73ef0826ef267c5adcb6b02e04b5573979718a23f239b5ca25981d86b2c657d5ab0afc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fa63a36887d30a3b16381ccae7f85d99
SHA18e519d83d93b8a6064208b61ef56f13567bfa53b
SHA25619e8ec6b3d01937b48f876f16964e25f4372f8c11bdd54b05f5315284e9eb6cc
SHA5121e7b6019f24c547f85297a0390d01a2f657973530a4bac93c8082aa81114a1130b197c82b8e1512d0d2a0a2c23c239ee6e6ac83aa3349c21b22780b83ffb6e66
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5083b60f08377b690a856f7adcf54b6ed
SHA1353a2f1388192515d3db8f015b4d5fa78ac5a6fb
SHA256177e41a2ed5095bcad82ba67b1823b1581f67e2954454dbe80c4c5c440a4fc7f
SHA512f2c3371afd0f88c46fe5ed0b979393a98e81d9136b869306c77e30a6049b45166b177880f4340cc74879ba3d9c14271eee34318998c86ccadfa99aab08a5d86d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD542d8d0a84c96e27b9a017cce3e0c8804
SHA150a4937b75f8c249d4d03720a4d878a7006c6fc5
SHA256af6bca9b597c678eb90450bfe82496d2191a4236fc65d6f879dfe850c6c1516a
SHA51237877ef72110c938d94de749f1c564c6376408a22347521a1940422d17e0528956e84b717dd45bb6c9553e59c6317560f61b94d738d7bcff236a217d1bbe0b7c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ebea01514d380347a79949c9669a1067
SHA1d8afd99bec02a5ff91052a85eaa9206d3f1853d0
SHA256c5378692199fd1004d9eb553237dd226f1defd321d68d37665ec702839dcc2fa
SHA512e71d9fd59d433770ebb8c1ec9f76469bbd623e69ef457d4376d87a44d288e4f792dbb76cfd5bf027266564edd568b99a555513fbc311c2f01d57133fbe9f1706
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e30070216d70a3cf58bf925b029b183b
SHA119811562a354cc9fae09b6f3ec54b1579342ebf2
SHA256650c02f9b8ba73329c1b808aeb87202f77812ab7f317d6700667e4caf2550607
SHA512e0a36cfa9ab5198ed89e8b2d43569936f8bf9671136214448a98c20bcee0e63094678a9c64b862e121f51cfcd6267f4b4a5681abc6dcfde0197aa42bcecec9ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d6c7b2dde67f07ce9935119b7fb8ea42
SHA1a1c6e398b31425269caa714b9f2f6a0bd5a71e15
SHA25600bc20807ac75980dd473ea5a15e5cc77d26c5b948e02b5c18c49ecde94c94a4
SHA51209ff616f34d0c7dd9ed8d49bbe42d031b213c2d63954e282d5d736773022c5de49e562c917279eb6767a7f46067b0485dfbaa4c0a019ff96b6f95d2abf9de462
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57c73c8b433c7a9109f4aeec4708aa7eb
SHA1b83c142d989f908e5b819d0dfc9b45bdd0752e79
SHA2567637aa1b5f4a0e2e44a40d2f48eb6cc1e54318eb3698c2b1e680debbc95d0771
SHA51266712bc5d38d2f5a77fd97529f15ea888b9c93d9e93864f9a46da3837867c3c63495bfa902ba0cb03c8e8418afbcd03a22a8e8f63a88362dc7cfadc645ec78d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD575791bc59dab5b94ea012c356d172cad
SHA1823df8d281b6e9a281f2f8014f24d8a16a272612
SHA25622f4bb59e98b28a08ad8f4fc9f1c3e8f990214079fa7f44025b9bbd0159a6249
SHA512380610b383fb44571cfba91280907026d55941cb67b6b129d421b1766675907fd08511af90d0b1c38281db6bf1d14d3d2717f8b2763a6c46b57c975aa0650c83
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56085e3f220351403d726579d9720d84a
SHA1526946845c26fbc277a729d8d97b5ea5768114da
SHA256c17604758348725c3779aa5dd8ed9db740eb0a646ec110c4435c4c6fcb56e272
SHA512230f434b5e3354f8ea284282f4bfe663bd6d396f44a77134acc7d9be46be7def6259ad2a51b15d947e24be6457360fdd633af15f4207363f0e1bb8c91643d721
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58799a604578b2740210e0e06544f773b
SHA1397a8f468ddee4c7051c94e2424769f9750371d4
SHA256a4ae4155acf8b74f0cd8dc411366ab9ca9a36edab4f7d2b11623ea347355ae4f
SHA512e98b135c61208e02808a05854bc97c6eb3ea37fab5af9cd5e627cb01230e299bc5c7be038966d4ec43e8093e4132e9df13401c0f3ead049f2c10cb384becd2cf
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NFAY0EOS\httpErrorPagesScripts[1]
Filesize8KB
MD53f57b781cb3ef114dd0b665151571b7b
SHA1ce6a63f996df3a1cccb81720e21204b825e0238c
SHA25646e019fa34465f4ed096a9665d1827b54553931ad82e98be01edb1ddbc94d3ad
SHA5128cbf4ef582332ae7ea605f910ad6f8a4bc28513482409fa84f08943a72cac2cf0fa32b6af4c20c697e1fac2c5ba16b5a64a23af0c11eefbf69625b8f9f90c8fa
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XWMUP5AI\errorPageStrings[1]
Filesize2KB
MD5e3e4a98353f119b80b323302f26b78fa
SHA120ee35a370cdd3a8a7d04b506410300fd0a6a864
SHA2569466d620dc57835a2475f8f71e304f54aee7160e134ba160baae0f19e5e71e66
SHA512d8e4d73c76804a5abebd5dbc3a86dcdb6e73107b873175a8de67332c113fb7c4899890bf7972e467866fa4cd100a7e2a10a770e5a9c41cbf23b54351b771dcee
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Z7V06J7Q\dnserrordiagoff[1]
Filesize1KB
MD547f581b112d58eda23ea8b2e08cf0ff0
SHA16ec1df5eaec1439573aef0fb96dabfc953305e5b
SHA256b1c947d00db5fce43314c56c663dbeae0ffa13407c9c16225c17ccefc3afa928
SHA512187383eef3d646091e9f68eff680a11c7947b3d9b54a78cc6de4a04629d7037e9c97673ac054a6f1cf591235c110ca181a6b69ecba0e5032168f56f4486fff92
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b