Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
09/07/2024, 00:13
Static task
static1
Behavioral task
behavioral1
Sample
2e552d1cbcfb251024752d5c407a712b_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2e552d1cbcfb251024752d5c407a712b_JaffaCakes118.html
Resource
win10v2004-20240704-en
General
-
Target
2e552d1cbcfb251024752d5c407a712b_JaffaCakes118.html
-
Size
9KB
-
MD5
2e552d1cbcfb251024752d5c407a712b
-
SHA1
bcb88f440023b8f87f3b9615fc889f1e8b2cb224
-
SHA256
9245cd6e6e19b7ee84240c0afa418f75757681650c18baca0e2325ad88865b33
-
SHA512
34b18475aceed3f7bf0ba20c0eb87071a4c557766c5a17e4648066e398179a419166013669872f481c089ef160c78035ac29adb4fc8eaa6b5f0d074df62ad179
-
SSDEEP
96:uzVs+ux7wGLLY1k9o84d12ef7CSTU5GT/kNSOQpNPSg/tJTlVHcEZ7ru7f:csz7wGAYS/82NP7PHb76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c01b0dedc6d1da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{16836541-3DBA-11EF-9CB8-C278C12D1CB0} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426667360" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c0000000002000000000010660000000100002000000088c19943085ef30bd8eb8eed8748a1d65b0392e668374a3b59295d9bfedda69e000000000e8000000002000020000000b47b5ef57b63490e7a30acabbc17510f2ac15b8676a1b14e9e86e638cf98a46190000000891d1bbb47186a2e1aa8e7e62bd560e76f365eb2c00f20a9e324c709dcacfca964451e6e9a69e5d26a0233099ad42744655a791f96d2c76e58da0bb96ccf18b772a978088688b7cc4481a2466b80abf95c13097e585e4f30acde7ee7aac0d883b12583395ec8b5dc7760e3b6cf288774f72d1f45b26444222e0b8368a1c0f4591d23c352c0de5cf9ec6a25cebc674c5140000000c47a001f3c0101498a52fdbf10be8e43cbf4ace84d55de46e9b292e41ec66b6bd3fb657c2e89dc1a1ccf5e76d1350a4449468ffe3aa71c6867c5dcf137cfd1d1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c0000000002000000000010660000000100002000000062992255b132e783230721f8d6c1b26e212af14d4d5bb7a7e13da4f4e4476d27000000000e8000000002000020000000b05a3c8804a500a3cc6482bcff9f07e077f4026f2716afc844f5c4bca3d30d33200000005890b7624d6e9b83ab1555f0173aad11dd7de1f29e086b2ee52bfe393ea5580b4000000018712d99459ab471d48da635d061d692fa5d817418e888610983f15f33ae94e0d50f8a0d1ba6ae52739da57b11b17bd162ea005c7e87c14efe37857d96cd3829 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2540 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2540 iexplore.exe 2540 iexplore.exe 2296 IEXPLORE.EXE 2296 IEXPLORE.EXE 2296 IEXPLORE.EXE 2296 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2540 wrote to memory of 2296 2540 iexplore.exe 30 PID 2540 wrote to memory of 2296 2540 iexplore.exe 30 PID 2540 wrote to memory of 2296 2540 iexplore.exe 30 PID 2540 wrote to memory of 2296 2540 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2e552d1cbcfb251024752d5c407a712b_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2540 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2296
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD573c52380a2648f6a1394f5e03ef8873d
SHA181ea45a23a84fb868e24d43a97ade2b1e7fe8323
SHA256e2a4d1905ba492b5619e04de8dce0fba49c87ecea2e4e9bec00286a7f511fa11
SHA51217d26495949e362597d6f9e83bdaedd833210cd012a97c7c8c54a3fdffd0543eed809c7c25cd73ce06c732afdc9fd961f9b9332cd91d0776c70cb6a581a25b04
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD52ff89aad3f812facc828e1c7fd314b51
SHA130dbb79fa78f8e4903121cc16cc8696822225073
SHA25688ad3041e38587738f95ea6eab1c8a9081e254f765fb4d2021389b05fab51031
SHA51245200349e690611739635a5647df56c481811917ca89c15187c281b6143c41a91bfb015cabb27c23949c079e45a1a3930017bb019cd159f759aaf6af6d1f8a01
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5dc5428a66f89a2573a2935ccc30f1b74
SHA187ad5990a03d17dc6f8a3d0f93289bbee8008874
SHA256e7e09925a2337d4d9db695e09bd83fb791dfb3763ad55709dec608730a62957d
SHA5120970143bc069056e3054dc046773e0b148db3760d67ab71f97c6bffac7ed763b0b2d839d16ba911a65d45a894c154fa20fa4aefbc257bfc4f19e02ad520362f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD54a924ad0f0c3cbb3437501bf3ba6b2ba
SHA1bd5e113aebbbe5bea9092e51a5e860760456d066
SHA256b40a00623f784c39bb4f2f7150de9d32480a76da1f956b98d505c345baee8581
SHA512dd653007289045ae333cafc4d96e291d9caa5405800182e279aad7571a7f1e34502b43e963948d7ad74e6a019a33466665f5db3d08dc6281c21abf9ec5fa9ccd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD591e96dbceeabba7ea321d4b1c8817c86
SHA1c13a5caa7d3d6c36422d865ad33e61cedd409d5d
SHA25619d53398271a957de68c979acde121e59a7bb74392e57f0fce6938113a5c5fe1
SHA512028035532ea6f086004f9c29c1ea9dd06420a826c86fc4fccefba8ec24a2c3edec98d7eb552dce9c14345f997b56badd3f2981af04844188416e60c17c6df795
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD51d5dc960dd1fd8da3997f27a4a576778
SHA1ebcd9de151ae3485c00e7e241e0e144cd1ee7b06
SHA256ec87c7c6e35ab5844e4ef53bd3222e0f3c9a5e3cc03941e7958da33d5e195cf0
SHA512c002dfc7869a5c5e6c4520f6b59ff63027166c93c3592686649d417181ce0831f8037f8f2364678358d49340c382cefe11581922a6ce60d30b487ed115fefab8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD504bbd20d14fe72d2956745e6337d5f0d
SHA10a2bc9ae51678347fd0b914f162e159038698b1d
SHA256961155067b14ef79f4cc9a740498e36dc4f8d02bad7324f1820d2936e1a93c47
SHA512f97ecd9d1baf64876d554f9797510ae873f8c5699d6605da3015de1b78416cc59c50274a9e43ce0476bfce97af32dc7f88a50f7354dcea1c1a40abfc6a28e2f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5caee17f103bc19cdb47e797b953f3b00
SHA11f5e2e3b992ca43eb28ff6841ebf54cf3c9e6691
SHA256e0d737cf7106dbefd70db4756c4daeea170ef8c3f1d15f79f43e1dcd1632df79
SHA51228452fde48357c80542c1e3932c2221f183750b7d503817123d9ef1fc400d4d14c00d64d7175de79e1024de6ec67352c527e2cdc3f7c096d2ec644e28c66b08f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5d76df5160c2cc73a1f684507628221a1
SHA1fbca21e02740b63f3d8c73f451c115439de0e787
SHA2568a45be71b4eadb1e0c954337471f31fe257265628b318b95a2e5ab27b0f9d815
SHA51222b5ae5377ac91bb3af738f74569fc99785b9c3cfcc7d7eeef0772c5781d601f52722ea1aee0c6bc27bb6103f1ef1627ee548f72b46e8150ea3ee756b780e85a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5cf13e9afd72c439eb22ed989fe772dd0
SHA1e2b700a947a9fdca0a992297fc32dbb349ad6235
SHA256bdd0969f9dc51e6c6ca0a5d15b4fa67d38108f526c09abf1cfbbeee1c94fe4f6
SHA512c4c027ce95ee13c82eadbd0ef75406969059d81b45eeb3a9e730eb917a093f1ae7ebb8d14595058d9e81bd0defb2910b56acae9e7819b5b4c2b5e6e4743c3d0d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5c0ed3fc317ec9f96f5e9a7675157d9c1
SHA14f394c471c76c5ba465f59e9f04d1761a244a9ba
SHA256ecb2d6e5c65c40709bdc5d55dfdfddd3b4608032887b89e54ab10c24cd1cdb5a
SHA512ef374d745b875333b56ca37a3f4d1cab18f56698adbd2042cd1564f5ec7838fb3ab086851e95bc9bc86a418cf6e5eae09f12b3af31a2b1beac712142b7db33c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5b9d2bd965d81c893691c735d3141007f
SHA1b1423b316b4733cc7f17f0be7cd0fdcb32c97ecc
SHA25647a930758ac62c0646b223569e0a8ce9ef71e53426563c57ead52611faa5a800
SHA5129388e043be477a9dfcb764b1ecb751445812d5dd86be199646af9a3430e530fd3671ee3787028d65b7c5412c56898f0498e6eff31c918677b6f700cd31435d72
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD57b32908a11efab069de5920e279de0b9
SHA1b0e2476cd0ee7799deb1f90148450063f789a720
SHA2566a3fe4388d01ea7951dc6ccf4122e16d2e2414978d5e8c08c51b83b4d1fdaaa7
SHA5126b4c8ae4e3d09f355c9a69d47f773c653126102afb49c84e5719746eecda90797dcb6b8a8ec729c46d969fdd52eb2a95f5de0029224081de046ef9b0c8c4d7d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5cee38c1c295850ae73c39204b44ce1b6
SHA1552ef009b2e32930df9d55c1470ffc43e0ba6e22
SHA256ed0aa7193f01ed4697e232cddf20a4a7f27c738b15b3708ceecf42bfbe58891a
SHA512414d28ebb1f566a8bc8097a3fa6ba435161a0edb670bb7690fb42478fa6d5df2d23740935d098d355d1b8f8144c418e4bd720026a6e8d2f1bb60dd5fb707b0ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5e2e8550558efa97c3b0edd21529420f1
SHA1edb21e4b62f358c1c62aafa7e01b194b7897e8da
SHA25665965e4c503832029d4388faa2fc9b3278f8ee3cab2be54fdcafdeaa90f780dc
SHA51208da9b58ed551b6a5b6dbee21b1c32cd93d132a66dc73fe3810d17874625638aca0db4c73411b33bd2c480e7967812e7f29b8d6cd7e7ff21763f0768f51a3b1f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5ae555ca6e5ac9bd4d81632166c8e8937
SHA19339b2c15fe550ebc935f84c8423a17ae2335856
SHA256416dbfebbe61fba90f178b4d16f58b98de58df24e628b41b21d3feccbb51d85d
SHA512b84764a89d5937f49b2bad9ba2faad8ac6789cae935962023ea3b13294a410da248d9b2ec9631de02ea295b72189bc8fd3192c4044a3af5bc1d2a424b0ff42aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5fde605e33aacfc35c7261347785bbb36
SHA1259da7161e66f9305e853ef7af0dc29583a33620
SHA25684693e53afcebfae27af6a5e54f76ea77a59ae971dce7c39110a58c63089032a
SHA5122733deaebd428a6853730a4097972b6ceec5b744f55a704a13a5c6acf5b447e9291cdf0bf103f871df33c7aedcd2d1524916809a57956da657c19ec18fa202d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD512b4bb16da88c7194171621877561665
SHA1b44bdfbe93c5c42d4cbab3a14d892584ac6ff825
SHA256995ceffd4ad212715d5f39adfbead90c5b3cfa6067f97300996f7e7062422049
SHA51289c6a62872d4396620536d021d622ab2a49b810d261dcbb1b718d7d67bfd3aaaac65b742b03b39edc4259647577e735d1c4a99bc29b772dcdccc7b4c17f18cc0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD57f1ac64ade647b790cafcdfae8e0cbfa
SHA1f10dd22db5e5a76b8fab993c2d1145d0ef8c761c
SHA2569a44d8102f90aab9a354b33fd9f5beb82ba88092f78f68e645aa8c8f77cae8db
SHA5129ccfa32bd138a4a8cd21ec9bc0e3a9e17d08cb44f8b52425c0c33d60875050eb9707cc3788be29f5593273a6eba4408ddfd83b9ec236ec9b5f48a0683297867e
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b