Analysis
-
max time kernel
137s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
09-07-2024 00:08
Static task
static1
Behavioral task
behavioral1
Sample
2e5237bd12bae9646b627a66be0f3d66_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2e5237bd12bae9646b627a66be0f3d66_JaffaCakes118.html
Resource
win10v2004-20240704-en
General
-
Target
2e5237bd12bae9646b627a66be0f3d66_JaffaCakes118.html
-
Size
6KB
-
MD5
2e5237bd12bae9646b627a66be0f3d66
-
SHA1
4c871a53c06ed78c23708c09bdd8dc965966989e
-
SHA256
ce172b35654aed5d9242efde75904aadf347bd38666ff544bc60a225778bf46c
-
SHA512
15714fde0f6fb753709503df29abdf5cba88ca0273d3f3652bdc26b4298a7211010f8270e4117e3cbb6b4f010d7da99d7eb129b95e980c96da24b27273dcb696
-
SSDEEP
96:uzVs+ux7y/LLY1k9o84d12ef7CSTUQLcEZ7ru7f:csz7y/AYS/Vb76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0109137c4d1da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b700000000002000000000010660000000100002000000012d42d844d8577aa55bb4e3d4e7077f3e42fd0383d1947d77f2980212501713a000000000e800000000200002000000051aabdca48ae7b4e77f95973fc2292be934808de7d4c87c13ea25dd83573bb759000000021ef5f817a9c95561e3a01d046c03ff96f57e74a4789a6f0bf3be1b6872c3f58ea253990d76c9851aa10bbe905c10c7a825622fff9ea44b3360b761c923323c4385e1e6fee99b2ffe05cf5f320d413c77c51430950ef18841648f6ba8f3369395afa36b0bffb244fc5318dad1084d0728feb81e2094e695a25efefe086056d6567a8c102906781bf19b0f81e7ebc32f240000000f8a12293ac3281415f375310fe058f8ab90b6f8fbf021f3c9eaf43d46cba9fd90d63f84ee83f22e096443406faf16790f09ae0e48bd7149abe0f5e5d1f57b86f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426666201" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000cfb8ceb3502340d80cd3f00f3fa7143dab58d559d24c5d9c7e165ef15c35fc84000000000e80000000020000200000003ca740ccc135ac5fabfdc3ce1892df94af727ef84c732a5d89ff3ed4e2d4c6d720000000c061f2f52860ebb54e9aacc4a368733dec569d606d93e0db33d0086faf9511c94000000040c2ce0ea4ac6bc2ddc478bb9612413baef02d72cc47b3b9ddc8042cd12d1e884b21f19883fa00d4d2d7a609ebbc8d002fcd088d214a268c34fb14e6905e8357 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{620F44A1-3DB7-11EF-9629-7667FF076EE4} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2376 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2376 iexplore.exe 2376 iexplore.exe 2436 IEXPLORE.EXE 2436 IEXPLORE.EXE 2436 IEXPLORE.EXE 2436 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2376 wrote to memory of 2436 2376 iexplore.exe 30 PID 2376 wrote to memory of 2436 2376 iexplore.exe 30 PID 2376 wrote to memory of 2436 2376 iexplore.exe 30 PID 2376 wrote to memory of 2436 2376 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2e5237bd12bae9646b627a66be0f3d66_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2376 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2436
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58148e0fc7ccda027db28c07faef894c3
SHA1ad1f82cbd5556c7d9a094e254f0bbd37814ff1d0
SHA256f6ef03aec4c417dcc10e3328e8aebbfee72bfc0604c3dbfdece67400fdeb2a5e
SHA512930fcce52b4141c0b38b8d906c6001b2db304ed639c0a3cef2e2ac8b220e03128e01eb160e690913e29de116974cca6ba378837f6b425de6b78f7b657b08aab0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fdf3ac5edf88e33820f0fe8cc72d30b3
SHA12ba987408c98341acea0e84a3d7748efec3f8193
SHA256a1097ad6d2fb2546c87cabec448a509d0ecedf959f1e4e8cf764fc9afc90f05e
SHA51262d13e37d85274b6205ebebebe2e6d7f184cce331fad405422613ab99738de9947906b1ce19dbd54fb5e6de08220d487c518301a4cfb1b519b47f330b62a11c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bbce36053e4748d9cdc0592c5ef34ab0
SHA1f59f6faebc4c8d0fa439b86b8be5b40eca94745f
SHA25623f5935a7f723af7635d12db4a2d3dff02fa7aa8c63f03028a020e02d247de67
SHA512f7e795250b668555a2b59cd5b5f444358717abebece2f1716035ca54aa56e43d596a0de210ca1a53b96dc792c072368d9337816fab8dbd3210fc15986f2d00fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ab6e8caaaaaaa554c5cda0296b492d90
SHA126406b69f400fd33ae2771cb29a584e4c62ae82e
SHA25685df97e6c2cdffbd86f5a5c79b1b53567c845adc68cc0425b6718fb9f6cf4132
SHA5127ea8c505581a6d00093cccb32f9ba14d65fa7e815ad4b11b68da89a239e3eaa676d33d541a133a42a9de595c42fc99405c2df7597187494eae348787c84dfc57
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e32368c08f7cb20baa67a6edfe97ae21
SHA1787b8427e4179dc0043b8f7c528b1678cfa0b609
SHA256f4571c9cacf1903a4fc1d17bee2ff9bad454d650e4ab51d32c9f1105f5e7ec63
SHA5126926ea8710b014718b5689c5cfea52ec85844db56aeeb510a4fffb6657c5e1f2922b90e9c9bc627fd0ba91687e4dd5a3759207c25b6101272e39bba3b4bdb5bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b76d818b04df45245351ed0c68ca345e
SHA1381f2554f6706dc5aace08e51a5e2ccc7d201471
SHA2560cb37938b9695d16f4784fcaa947d095744a89263afaf5606fcb9e336805cc5a
SHA512f21f6df0602a7ea9a24fab3d4a6e17d66f13e1495f5ffd7f2e0d0773d82505377da7d839f5eae3f4ea079c57ec7f523d77ee1b17828f8d3e39ee42d428ee26ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d0760e4d3f138b583a5a0b8afd4247b7
SHA11ce33051d5149de46a2dce462ccf24f97384a2eb
SHA2565a2c1c99fc5c53d09b693a5754909eb94015493e47f013fa57cf41956a8db7c4
SHA512e4547763c6d4be82e55757631d5d975943d1291f360782bda3906a8215d91d3bc1b7f808797bb27e959c22cba0909977c3d69b2087600704cf1396bb22dbdbc0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54c5db3a7aaa0d31b4f6ba726ab1cfa4a
SHA162d62f807b9cf18fde25274e5e7272043618d018
SHA256c265262f30a116bd1be2c1c0ee602fc9f00ba7ab9b18a7cc231cf62f3beb405c
SHA512d819a6075c098f45ebeabae93f301dc32d0e9249f0ff77fcd1261c9a7dbfc34c3a5b723987447579f72fcdce004b8a07604337cf8f7f36608b64f46f051c0d03
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5138a483eca40c581c2f530ddaefe2bd6
SHA17aef14aa1e0871ade2d486869347df1f2848e3b9
SHA2566d473ff3548035ba7c13353f3a920b343be89aeb3dc92d78afdf0cc1cedf7ba7
SHA5121de6d177a0378f606bbaa443b991f87489cd886ab5f42279fb2c1d39bd1645fb8f9c59b574b3db0fb22d7f9f3bd35b45b850cd0478e29b328cd9bc3c9869b000
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51ecb2825b9ec0f02a02799b4ec74f57e
SHA103fe9b6ec6c1c297cec91beb26fa75a8f7ac32c3
SHA25636991bf78a3313d46d57d846aa6b477fcfafc6648511bb1ff5b5fb4ac06f1d80
SHA512e56f7d6cf0023503880cc72129e595fe231b5171f3a203cf74e8610133311082a8e4a0d6bbb4b88edd8d5be34c6773bb68eb77f3749a1d0b0e4a9da8768dd245
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5defde571c8f743f7e364985e31c48b3d
SHA1de472143c9f4f9025db1f6cec22a1978a0192ee8
SHA256f0540bb30541f43b441c4d6e5f8845fa347dfe5dadb0d46a9c9db2ac1d57b46b
SHA512704e5c646a7014b5f78cae1ac62a24e8709e17ee60c94a79514bcdeb759302baf7a22a829d8d63c3f0edd99bcfe6f537a9aaf18ceec5986b8fe3dc8fe622d31a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c42ff5b89e7db65d751a97bfc3a6c11d
SHA1b87d99bc322b35a6a29ab3c8f104cda0302592cc
SHA2561853bd96c6b6c018c22f68d61f6f62a13847b1ac09dc0dfe34d5e097cc08bdea
SHA512c370803ccc8e9ece39f5b97e83d01b79480fbbbde4acd9b02cbfe7df38a2db0ab2037b31b3bb6195ff299e340e54d034106ae4300c13f40afa5196b305ba4721
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59d08467df896d9f5cde67cfa1d8acb77
SHA11f62751ebf5599ae373192a96c54be83297430d7
SHA2569fe9316ac267700dc2062d7eb51aa6635600b779571bb87d01981bd1d83973cd
SHA512480178fe4040a440e268f9a0cff348823be57f8501e307f609625a3a1960cf745ee951804c36d637e8cff26e91ef38ee063c61409332e9c55ee7db1446943059
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD585cd65e8f9a8ee8fd56ac0c5734bcc4d
SHA172211ce9c795be4f31629944e4c73d7f9bb9717f
SHA256e54c5809a2a55b51dbe4b0b3b955718b856a9f0cea6b78b623f562bb2976f32a
SHA512ef06265fb497aa243da5cc49008c6f0eb3ac2577f6add3bd6f79dacbcdc918e09dc353980d0e9dd682ad6519116ee7f367ae944728c680a91f8f21736f4b5d9a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54c5e66f33d19618cc876633b39c14407
SHA1d250f04eb8144fe6c467d734dd12be956ed1286e
SHA256b0570125e42a34a2cfcf161375bb3db01f61126250153e3fbf642cf1c64d1b57
SHA5129021364db94fd1e25f7f17715549e6fa290427b6b684639352ccc6c63dfdf470c60397b9b9e6b74105499accbda6096e0ac6db285a265d695e50ac756d010647
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5013d8b2ceb41ee7e8c62fccdfc9017e0
SHA1cce22d506a08fa4510865417ce91ca04a9dfb6f8
SHA256f6c9d259b61059fa269e0a965fca5bf59943c992d466e947706e03ee63381491
SHA5125eadcfc0fbc688617b975788a9527b29624a47011fa468b38c02400230f947c7fc541187a076c7a2e2b81f01a9e33fd61ee4d18fc40020efb9c2ad8c9ae0ca54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b74288d5b90753c1407bc7be58c8aeb2
SHA1aeb9c53d7881aaf270e951fdefc391d79d9d4089
SHA25652252656bb375cb5c6ac9c2e359259ac7e3f331ab645ab7d5a6aa4c707a5151a
SHA5121a17e69b51069da20503351af57d5fd756badbe5ce56b0c795c62aca69450147c9390c919533cff9ae69047ff7c528365f5845f949613a37589126376fc3e688
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD568e4bac6479707758c20abeb79227e37
SHA17fb8b8440043812eee4c53f08171bb548bf644bd
SHA25679e81499ece604af71edd0024501c60ae0db834507d9dfbee4e68893afae43bc
SHA512fcab4ad15fdd68d3423c22c934a86d512ccfe79d6daedbd18f418de3586d6f56cb585eb7ed0e5e3091089858400cedd8672fdf982b3ac0ef2adee3807a8f1d2e
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b