Analysis
-
max time kernel
133s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
09-07-2024 23:21
Static task
static1
Behavioral task
behavioral1
Sample
326719aa7c2ecc0b3245472df818ad3b_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
326719aa7c2ecc0b3245472df818ad3b_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
326719aa7c2ecc0b3245472df818ad3b_JaffaCakes118.html
-
Size
37KB
-
MD5
326719aa7c2ecc0b3245472df818ad3b
-
SHA1
ff88e9e238e63db02f200da00bfd9da1630a86fd
-
SHA256
c9c6df7168fc822917e1928ed101e7aa1eb7039f8e09dbff6149ee8c1f17cb7c
-
SHA512
57d6a4c0cdf6a0e2467de1ee6cb37a79742fca6bbb72d4e39cfc5060249a2f9c4c4c9b2922bb74b6ed9bdad7dec5adc73e632ade096e031c2fd2fbc8fa3ba548
-
SSDEEP
768:1JtzrVDeCvQib4+Aax7/i5VOH72T+x5WP:N1DeCFb/9bh5c
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb00000000000200000000001066000000010000200000000d38c0079d12266fc6a28a2e7980d4f713eb99c41559160f62f44d11140a5fbd000000000e800000000200002000000034475e23d33ddba806d993d505decf283030136f6d4455ee811bd8d5a14b0f539000000078de389aab7e784af3fb140d138d526036aec2b84d81939b140f5a86f820ec6c81e2034a3bae59451ba688cbf51de2e7d724f601f955c0a95c67a7bace1bdebb6c7aaaf043b3c2fd49f3bea347a5b4b4f1a80c7ee0349cbb7faac4fbcab0e5a6f5c9f384a717123a06ddb2582e76b817a496d9073db040dccc75d9cfe06f5749f8899718cdc0788148d60120b882ed2640000000ab8d480db5f4721470f0f5137a4e623737181004c815a4f9cc307c9fb9bde0820b49effb8d237999012d93693f6ce297c9c9e3bfab16c04870b7e66c24082130 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80855e6a5ad2da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426730707" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000e6495fc2701d7b3e540d1f29ee64610f7ac456556573cb3c47bda68cf04cf71e000000000e800000000200002000000007b989a328f56a99523dfc39d3cff8530f678ef3cd0468d9b6b4626b83bd6eec20000000a4160ed79e9d69c7306f19c03bc58575cdf4ea8211b8c46e8787a45635a6d517400000005246e12d9bf86bc381b8c1be66c6be9f5a4f5a3f5a79d5fca94a6095ea72a1079210f9c21d58699a6034e1454c7a582b6e5fab02e35af50a37cb8335623a39af iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{944E8B11-3E4D-11EF-93A0-E2BC28E7E786} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3020 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3020 iexplore.exe 3020 iexplore.exe 3036 IEXPLORE.EXE 3036 IEXPLORE.EXE 3036 IEXPLORE.EXE 3036 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3020 wrote to memory of 3036 3020 iexplore.exe 31 PID 3020 wrote to memory of 3036 3020 iexplore.exe 31 PID 3020 wrote to memory of 3036 3020 iexplore.exe 31 PID 3020 wrote to memory of 3036 3020 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\326719aa7c2ecc0b3245472df818ad3b_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3020 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3036
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c6c9e93957a6a4a0c888c22b1f7d2977
SHA1cfea196928f9b79b0a0c3db6d8202b678978e59d
SHA25693452afcae8d834c92844ed15636f6779665e99c24c4c5156ad7f26d5dfa3827
SHA5122733f90c696b850b0be227c22d7917257ff897acc76efebfb6c43a6326da9d339ca4f2d7d145257eed8acdd79af5e861ef4cb50a20f61c6aeeda1786c5a51b71
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD503ed79644311d74749feec3eb674d768
SHA1ab4843291ba3d8ff90664936389e283c24144ded
SHA25642f98952146dfefd5eac24a0ea097ffea36131cfc96335aafa13ff5a7f5ad2b4
SHA5128e8df1ad37f3e83202236a132ddb5492c4e3055bd53e254e4422d7b42c59720e6cbee7aff8a27786b1f1d2238124bc6b694dd0adc335cfeb79282f4052ab34b7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51b3adb6306464083af646af444b05a0a
SHA1aa11974102b35d726bbe01b160b41967aced045a
SHA256322b904529048ca3b7a11e58e2ed184ea1a97fd2d316c32288ab847d62eb9706
SHA5127c256490257c0fbaf3f04789f3dc324adfb27620775d80e17030c6d08aca16df2a765218eebc06fce2cb4c12d0f50d5dc2a71eaa6d13281dd634b4dcd78c867e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51fbac3af24d33e135579a78de2264e70
SHA165f56c3b3127674fcebb12bb1d451f8e5fb40246
SHA256d6738faf10c91267991940a898f7762022a0b6e183a12d81f0795e3f2c441fe9
SHA512ff21e3bc45ddaf63ec6090c097cf9389af46a84aafe0624072098c4230fe5c175c2c78bcc3590525f2fb8d201f2a6012e91280fa706a5649f6c48c8da83fe370
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bab8df9e06da19eff2727cd6b85cfdfe
SHA11d7363549c8827be1e6fde68936b713335fb61f6
SHA2564c80bd13dca0bf5e759deee9ee87178638b93e51aed665b3504b7d1b6a926206
SHA5123fb89ec47e1ba29b15b4cce11b21221700739c834265b43c2de6a1e8d2e12da5b5068356e8568192d8572294bb54f1c12f0bda1267669e9c1c7294ec25d4fd57
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD562a7ca00c182eec666600a91a3e0c5af
SHA1d0639caefccdc7cac6cfa88f7d662a110c2da89d
SHA2564f92ffb6683e1bf6a2e7e98308c636e351aa7863c0b2da50a36017e21ffe6653
SHA512e1942f6ecf97795a970b113c400173402e014422877e6af936c80d84d6865505ca50f57dece156bc0dc4b9ea417e5c88013f9b931a20ae3c8718bc1b5b497ec2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD551c1d2c2d0bdfbed3a687f49fb49b476
SHA13d150669566da474f613b47f04f7d995e14c5b47
SHA256969452dc8772eefc275c718f92d50b0a5b30fc0c995723ead188af81ecac2a76
SHA512537745affcb43542c4dbfddbfeb41d7626d3467e6a0291b0674d48e64378d4e0d00e379085d50849d7e6717e215c4faa28e8007f9d3205cb39347b4af69c0c6c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5171ca57b2dc8b5dc63173f2e8406fedc
SHA15353dde0d791abbd6ba2249baa255e6deb586b59
SHA2569702da93c0ebbc55983b980c696284fe00b4347a5dbd2ac5b4215627b66b520c
SHA5128e631d436dd33f6272b47eb2cadc7397141b654c1442bafd015155fbec2d1f4eb4ded0ac920c5ed1afa4d441ea1b0d470342991ea2404978cd0e46af898fde8b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aca62b389024af3ce200d6d2efb09eb1
SHA1f0a1c2f0aed9f8f95feed7f76c4e016c779bd9f6
SHA256240453a4d79f60a6990e21c53a867c3a696cb204c5b89967ce8b8b057f1f453e
SHA5129a2c1216c913814513a700832406f91301aa5bcc56e1a1b5ffda7e8bf4213a2788d32f22feefc4d59eec5389473534f0b7f7359262c063f95292d5c3f10c7b3c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57d3022d52d94117edd385b71154bf635
SHA17ee4c4d92b002e4be385bbb3f2fb72a88c1e5d85
SHA256572169efce6f524d653669ea0f8bb99d514caad483fb21b4e750c427a27284a3
SHA51225b8958421786c0449b18e734a35e10310bb726e45903e66b094ac4b8be7af238d1110499637973afa7bc371ed46369b46bb401b369340f6ff09c075d42f12c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50a777d15fe1ee4de413712b4a6e26d24
SHA1d144d3e5614dfa8460df2cb4daf27cfc1281e8dd
SHA2568d3f9f07b1a0ab18127ca5b6e6a5f3561bbc69943dd924db8d4dc38f5c05d1f1
SHA512cd25e19e85c690377c892c96c6b73f81d9c951051411e38000f5e2f5078f155eae38aba8cce4d6e51b6c0d3ac56aaf87941e8de8c89dac8aa4829d5fa8339439
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50e72e926e8bf25c2b5204efb43d6a3a3
SHA18ebdf2ac36da75c58b0e7d743d5460bfe5906435
SHA256342d45b48be6d6e7d349ec2de759ddb0cc713bb2d0398e26babad567105cf208
SHA5124a29ac5cc33e3dad9900e6667d32239f0d3c7220b4fef6819419f8db821c5936c58800cee9ad04ac81ca6361f920f7fe874d4b2f62d3f466e9ccacf195c7c62b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e12cef4ac52d7b7e452f24afd623bedb
SHA1980f81a83ac73fed29bd7efd6e9be8da230198f8
SHA256812b9d389dbd65a7e62fd812fa522d18194cb42b76c959937a7351b73cd72a97
SHA512b7cc939d538585b7650ea06dfe8950ad84cee412ead432c862487df0dedb11854626e53af2e46b8662b9ebb8681c9a167eca469df8bb372197cf6a0902cf2439
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59d8846f96e7296828cf58ac3ba3632d5
SHA14628b686b9383721c69e008a58cdcecca3469a06
SHA256fb7d4679ba3c0f90050319bd71bde8d6377a54bc46aeb081d7bbf47982bc0379
SHA51290384600c4a5bbfdce73e24a42d36eeeca82f59592d968edc283ad8f77cab51bc70a8670e7a746cf3ceb388fde216785ce57b5390a7be356fb61a0294b670120
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58f66272c69d51af39303191084165ca1
SHA1b5b1e70e5147e0b59dc03c02cc84cd3471c6b53f
SHA25608a8906fd98d2a2de1fe045307e0a6026ca55dd97b258dc64d048a91be532667
SHA512bc1e0ffb515948c4e6add24a76cce2882c18853cbc2b21e0835efa647a90e0b055a478e8b70142eae1ae0fd391e74afbb5190280dd297f7e6ee5286200118392
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD546b9a37170957c4706a155cf02cece87
SHA1ab7f7e3212e313c4eaa40e405f29cbdd9bc43fd8
SHA256ce7f3327fae26a044d2b45417878f2697464bf8106e4baa062cb5dc5ae49947f
SHA5129c214265689251e371d6aad6d308417f5f9f774c260e510876515586cfb5db87f6acb91d3e7a93ccdbe74131435d91291bd9244c05bcdd2036b72c93879d179d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5549ad4a719fc99a7e672a350c60ddb50
SHA11e44e8d7b689ca0ec48294d058feb03a8ed7bda2
SHA256d8f3995ab01a207fb97b1f2f91300953726aa7d11d8486a702fac640292f36ef
SHA512c3d93f2c8e64e25bb4846b351c10e2d08041baa136606f19017aaccfbf7b1f714759fc03c8ce90c8b703629d359089fbfec85ac3a213c018036fb6ae7b638475
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fe42abddda995d83dfd3a9d97626d644
SHA121ff63e841b8ca2eed3f314246ca658281c14b9c
SHA2564137265dd67319cbfc27d7df7db371b10d790a45b5a68190ce3969622fadc08f
SHA512896ac8ec5857301d48523f51e7885cca7dd7655f84f5ca91dfa8375fa70bc48e17641635f7142925f8e486abeed128199440952bbdd7ea7ca4fe66f708115617
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5426ac710e3514121846e27d838b2fc00
SHA1a3565e605b369bdb2d74ab1f4b1424359790429c
SHA2568155216d7e6fde22dfb1279624aca6e2fe8b16c8cdaf349c7e67a020357d88ba
SHA5123f4d5149b5e22385413406f26794d5a05bfe62e893ecea45aeaee4e170bce8a05735561f025b0688371660a064f6e68c04e9c4645674eaa7823406fa9d3e2a82
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b