Analysis
-
max time kernel
133s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
09/07/2024, 22:35
Static task
static1
Behavioral task
behavioral1
Sample
3240b4dd204f2ee348770b18c657c21b_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3240b4dd204f2ee348770b18c657c21b_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
3240b4dd204f2ee348770b18c657c21b_JaffaCakes118.html
-
Size
6KB
-
MD5
3240b4dd204f2ee348770b18c657c21b
-
SHA1
41eadf1afc53e30a880f1ae1be94ac0bc0b6ea7b
-
SHA256
c55c871fb259e4c1c39e01015368e1b3f7eb9b23848ca86eb08327378043cd55
-
SHA512
d8e9b0b850c1efb89e6c481d312fbadcba0c47d9e315b34b826d27ca88958ff86d882d7b865fcbb525491c05fd75d7f448d5b87b5891011681be4d0fb81606e3
-
SSDEEP
96:uzVs+ux7QrHLLY1k9o84d12ef7CSTUSZcEZ7ru7f:csz7UHAYS/Rb76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{94B01D81-3E48-11EF-BEDD-4E66A3E0FBF8} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb78000000000200000000001066000000010000200000003cd76a0e4bd57616ddfc770c898725539b641aa20d20e46a47876ee10292b19b000000000e8000000002000020000000e9e21b1f73ce6205472e7660daa82db09af772387cb905a5bdbd401562829359900000000b36e80ab1234a87fdd2a456d7262b1b26431ddd001be5149f0152126ea9d79ae3ef3d79c83bfb641eba6ee91da16ffe5d83c025666d4dbc34abf158ae3144c0e32c9033758e7bffe19e5ef2159108b32012836604774c16fc668545aed3957b1202255571b8151570155c17045c29a6609bdee1e8365003714ce6f0a7904e9efc79bdf323ed1754843dc44c6e3d38ec40000000aa13d709b869e6a5d1baec6ff63a54a09b78e4027ec6c163e34c327f25a63700c6542428873e35099cd2b765ee15c3d849cd2c5859a62420b7aee237d7e73392 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426728559" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 902d3c6b55d2da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb78000000000200000000001066000000010000200000005c45e05f197928f37f9f0aa431805c922bdff98ceae96ee5a79d5cbd7ff54bda000000000e80000000020000200000004ae392edfd51111c879db9f11ec2dcd3e6a477a1bd1bc962d4b095fd3ebbe90720000000d25e94594907061d738a702fbe4240fb7d87dd40fa8ab48e3afcf68a8648b89d4000000053ecf0b1f47d41711b4d664304feec6f130a6e6b937cb57bde09ac29e949d83825fe025938ca3496c392eeabd01d57f63ae6d6f1c10234dc0e5b91be09b05cb7 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2624 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2624 iexplore.exe 2624 iexplore.exe 1524 IEXPLORE.EXE 1524 IEXPLORE.EXE 1524 IEXPLORE.EXE 1524 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2624 wrote to memory of 1524 2624 iexplore.exe 31 PID 2624 wrote to memory of 1524 2624 iexplore.exe 31 PID 2624 wrote to memory of 1524 2624 iexplore.exe 31 PID 2624 wrote to memory of 1524 2624 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3240b4dd204f2ee348770b18c657c21b_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2624 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1524
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50751ff7e9990c206a9d25cfecad3faf5
SHA13d1f21ea35c4b947dcb03400644bdaaba7642c63
SHA2567a410999d4edcb3ca12f6b01c1c02f044ca7af6fb4fcb77d0a44fb94a7d18733
SHA51243e6a5da9fa718685ed717cfd0a9ec0dc74e9aee230119631a4119a5436f4fe7e50114ec7f4ced079a0ec4a784876651637aba6e32209208b609f3068de47b68
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f7a2c320c3a23c8b6c1fefc10eee3206
SHA18e01fac468a1f4813d033ce2cd84f35a923db3df
SHA2566e9ab57a7f31bb92c91510cd787f23d3824256354b6b7d4df4d5b16f61f69476
SHA51280bc620d9495b7b98da281b244a2f28f635532def166d1659a73050e89f8298b6e5bbc629b21ce235993f4b5ae7e5e6193b814cda15f1744bb12637a9500a97b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d4552da5a0b0d911f5d8990bac92716b
SHA179cf6032e3f90876d84191039953ccbae30578cf
SHA256cb9612784a82f8c2ed5650a9ad57b6ffd276ba5113628543b3f2199b134b0bc2
SHA51276991203d6103f6e5e85afbd482d809e79b623640f9ba8a77b0476fe62b1be57be1127d8261304f6906436eeffacd2c520ec0747473cf4a64ec37d31b1de795a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD533d558cb15c798c58c7535e9b51b0d21
SHA11c99817a17649b7a4e9cbdead24e40591433bd2e
SHA256f5b861adad0263a029c0b823a0015820ea4f373a469a8015001082981c9e0ab1
SHA5120755800ebf4aba507629f879324e6b54dc8548344bcae65da8582fc87397fa7dc5154d41cffc93eb0357efbee530f10a77b25e6e814f6801c2e32126ee82b8e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e85144b86bbd57e0dda91fb5a5abc5df
SHA1e7a5ee0f003459bcf8362e2eb5ca72661df1f19f
SHA256a84135fa491ee6b0f5e17f4b83a5b2ee8c487fa2ecd88e05f83bc151bf22e33a
SHA512d56b687293754d8b45d20c43987bb3e894493cfa934e1b577b6363a68b743e6f82b6687e991262ed60457c0e0b30ff7ec244b8db59264c868e20b743cc5303bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55f99c57e2c9cbb652962b60a8c01b0bc
SHA1bf1f4422b03ef285a0a914d30d7f62d1c3383c8b
SHA256772c86b81a1d3e6c01c2f47814662297a48905da7d04236f77397f603873cd70
SHA512ae49e764235015b67c9987fd40a3211586ec2984c10bc4f4f9e9f9f19937fb72102fd06ae570fda1dae0b6f2edb97a61f5fb8fbb6d9bd92e60c2a3c5a1dc5345
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD558632d53c2e7c4560b724aae8c3fd33c
SHA18dc5792f2f7296e39c97c352083ca3886fa65426
SHA256a72922d90ca25aea722ee75b8c6730b82278fe8ef0593c35a7638e5447aec42f
SHA512dda454d50bce6d44b44216740eff8bfd0c75f9bb149dd4514ca3320b724dc8819c0702530672981e5fa7f39f8eedb085278a104f987a49141a2023f927c559a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57e41bb5924f770a1a3b57df4058034a7
SHA172fd4780df712e06c79d29d3b8ad884e0c018408
SHA256020315f2a44780eeabacfb974ab25e0e66d46c32e1b0be97a60ccd0ea0713022
SHA5121cf8f64d25c663da40934a145734102e7ca37a102df9286a469c62a5b4d18fec685f7a79dfa62f5711a728e8bfa55d270410ee40ed978306e16d3c80421f62e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fb022c13b0e95af9aaee4b3c2d847ada
SHA1baa668cb273f430ea880c789362b78f941bfadef
SHA2567022fa617f87a6ee9a2b6ab279d87576cdb760d1e1956ddfa63e5b0ee4c4670f
SHA51202e130f88e0c55fdf7c91d4634314c4b3ca72e623c7169d2a674fd3cbbd85a2e80f8cc6f098da5a1954788c0311723a09fc2f2ec49404901b4999d1dbcf7d88a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56279378d279aad298acd16eeb2cb0d92
SHA116651aaf4b5c836be3f5cf3e88daaef66f7ad62d
SHA2566e8a23fba59cbe28dba27163c2b5d25e9817cdea77c0846bc3b9a72fc09ea8a4
SHA512e41312fa5ec5080b8fdf135f5cb7274556ba3b59e206d7579813d83c16590b0e1b53ed4534f170b032439ebc47135be8cf85b3c10b80349c8146bfb78c813bcf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD513e3d417068670af1f17d8b13b75ec2d
SHA1716781dfd4e7194925a5ee21f06534ca97345322
SHA25637415cfa0921844be3eb684842c9c3dda1101bda42e46e853fc4c8d2c796e4cd
SHA512091734208b6a84b3b43c4dd0e5bb59abc61996f9de38ffe6ccc93b8b3c6cfbf692570ef5643834369ffe5b8f95c281c5d281a89549c99bb6d4a6e9f608017934
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57ed4557e15e3687fc0d9736232f4287d
SHA1a96b149844fb5f245569fade3810008f34f97b44
SHA2565e8c1fafd71a8930550555fe150b89fba1dcc1024287744b16e0d3940e5ef07a
SHA512744fc61439bc7db13fbd05111ec431f01944dd5c7e7ff57c3cd2420f7684af7ae387e303ee9e950c6469e5e1c4e580d08043b1e1321c3a6896c37360d18a603f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5265b0210d7f873cf25384fd2c2a51b1c
SHA17b19d52dec9b001032721da31069993d8a2aa943
SHA256221171dc791834d840ce63df16335432f2b11867632fada6b923876067bd7341
SHA512ce39b08150afed6d8e06ad44603f7a990aa4c9fd85b5c8fbccb7ebca9b9b5228f21523492245c34ce790a6fc3da09d7f211e0e246a121a9b6e3279eb63601d5e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51e60600917cda7c355d434755536c2e1
SHA16ea067e879d7b54098cb4f385bda91ac14acd6d1
SHA25632e674e8eb46e216b3960d1db00ef57891f72b104aee4c90b97e9e1821aa9efe
SHA5128fa7f72ef6bc75b69a4177d13daba1acb974c29eb3c7eb3fc59f19017c4c4305438c61c61f4b8ad859bc24c5ba90cbc4998cc9189076f40332c05c8870214089
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ddb195b2d1b0ef20f72d1c0677659781
SHA1ef458d37f8ae5527d5d87002cc836cad40ad522d
SHA256bffc835525547430f6927f9518099fc06ddf9e1a2de1f76f3ad24fafd6000dd0
SHA5129d7eae3ac1bff145e9df8bcd582952504ae84da41c17d65524cf3cca2fdc125aaa544b1d885b291d25a3307005d178a327e43284c8814cba3b1708e9a398f59c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56eec2304ca2ad7ad936c1bd89c51ad77
SHA19ff7f5f5d2511d68f0bf6c5c09fa5306efa8bbe1
SHA256458b30625f9565d45b4e4347c346fa55e968a55ccd28522fe19ddf6828cf9e0c
SHA512fe9a1209c13e711fb3be59c7c2cda65f2b797c74652f2ff49645e84e692048ca3f0ce0f720d7b2fadea9744bb0bcaad8f29af4e917967eb877cf78bccee1d058
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bd14113223cd6e244c6888c9ce61b0cf
SHA14777aa0b5a4016f1d9b259a3836ecbe33cfe0d26
SHA2564ba3431af8ac4479e723ac67d84296ffecd9675878b960524dbb1ff6f8595ae7
SHA512ebf357301884bd707ff8c440fd036f30398d8bb7a158513848d2a9563e8f0842713dc560fab50221c693ac650fa30340df7759f6726f47e7a45e5f3b9170130b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ab0f39a2fa41e5c41add57c4c617ba9d
SHA124d339c44c24ca607f2c4ae6eee076fa9c67426a
SHA25601a4c9fc90c3f597a511ec234e5eb05c786c0f416c6695401d324811c3d0b36f
SHA512d949bf5dd5e968f3564c991b4544b0664d048ff7020efd72c7de9053cacb74cdb6c4851c82fc1bdaba0fbf3b3b2a0cc26b1928379a8bd49a9109a193e98f05b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD591e733c9367be1051f633f520709cccd
SHA19b38bd65125b56ae4d311740852184a4b0119ed1
SHA2560f2b49351f5e3b9661d8e10a5582cb2f296e376888ec5d41c855f1737f9457cc
SHA512bfd3c0123796f02ba09489e35a28da48ed4517678e3111d1680c44d3df36cc21f6ef53db532936dfd6bccb16fc26ab378f907109cab0237d3b3ce24135d42164
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b