Analysis
-
max time kernel
144s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
09-07-2024 13:18
Static task
static1
Behavioral task
behavioral1
Sample
30889fefcf4e806262d247274dd58f32_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
30889fefcf4e806262d247274dd58f32_JaffaCakes118.html
Resource
win10v2004-20240708-en
General
-
Target
30889fefcf4e806262d247274dd58f32_JaffaCakes118.html
-
Size
22KB
-
MD5
30889fefcf4e806262d247274dd58f32
-
SHA1
fa1b6836efa838093922e25daf28c24df05aa24d
-
SHA256
d31473e3e5403db16d9e4ccc4c0038c283b85227650caf727d830fcf220188c4
-
SHA512
54f98930efb200aa082b4f6889a019f0c2db6c9f2c27149907cdb9d0125c17f1d05c86f3c09a5061054f73da3ed215e51657ba1d65870f2a11df18ffe70b8160
-
SSDEEP
384:KIBkqQJ52sABXOevNb3LYTFkOHzM4K7F1W9zAQ16hy:Kq0J52sSZWkd4KRCt
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd000000000200000000001066000000010000200000001aefff45d3624277b978be23ca0eaf9e02f1fb66ba9133290d424e25b31cf61a000000000e8000000002000020000000751a98569bd5111e64cbd0b17722dca4b6d2df355154cb622d60b8288d345ce320000000d17a0f3dee9dd185cd65b31eb6fd0fa0e77048b14b46f93eda2c0771e1677ebd40000000b5aca1d53a88de3741c5b43abd750e8689d84fa2252a056d32ecbe1925ce1bac872d4b246516898a17b52d90264f9ae32862e1463b75ca66082a82190b04e785 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd000000000200000000001066000000010000200000001554693dca14d68e115f4dac36c8896c9f19da453023b3961caf00e33d0fa8d7000000000e8000000002000020000000ca75b196caacc63e50da3d36334e2995e770a58fc474613d41ff912e81acfe5b900000008e2c75e997c81d9bb6e91124fb47537a4ae4e2fa57f4a5a1880d60368ebba7d12d61a673d23b282756da79d912ce245e9ee6042154d7df433f6688c4ffac19cdc3c2a123085e1486be21059cc2f2d1f71ebd2257bda233c53ff32594c992d57a10e238ab0c922882c6450ec9331fb779a2db0c1c49f3717c6bcd234829d023c0fc170a169383371ca9419af7b632b39a400000007c75d5efead0fa1a4099fd597533c2e1df59d2b4e7fb1679e09fc94275ba66fcb6e08a81bd5b854c8c87c5af200ac9fda941e9441ad371e501f15b3869b33eff iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DB1858B1-3E01-11EF-8FF0-DAEE53C76889} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80431cb30ed2da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426698184" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1564 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1564 iexplore.exe 1564 iexplore.exe 2548 IEXPLORE.EXE 2548 IEXPLORE.EXE 2548 IEXPLORE.EXE 2548 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1564 wrote to memory of 2548 1564 iexplore.exe 30 PID 1564 wrote to memory of 2548 1564 iexplore.exe 30 PID 1564 wrote to memory of 2548 1564 iexplore.exe 30 PID 1564 wrote to memory of 2548 1564 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\30889fefcf4e806262d247274dd58f32_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1564 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2548
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD502e255b5f22d6fb60e798a15e284d325
SHA1f169182408ace3ae215bebb9b2cd934dd4890797
SHA25669ea32e22bb84c52113aadf5e500381aa32841637ff9931a829c59090fac2c99
SHA51240066bf8d2ebba6cf4ec820e3aa4089d47b5caa53346b85d18eeebccf462e578fb96afb994795cc2971f78f0799fad0b56d0e655024c0e5e463feb894e1c7d1a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c66409e9fc259d3cdebba9bdc06f2188
SHA1600e87b18a0426a9cb3d7c2ca7aa1b17ad3a0a54
SHA256705da4b0ce735b333d8b31878f8f5e20f87b0b0a5f7295151872c8448dc1ebdf
SHA512cf36ad4900915978a5eb73ef124a751b0d1cf95bdc26d6522bba5662be5ba2849e5031914b21050b8aca8e52aff872e87508d5f8f19b44b275fb7fe5f60656b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD583a2cd550e2d7a88a7b803314befdaa4
SHA1bd95031983e3b6580ffa6ce5b82a92f1dba37f08
SHA25680359aa27e4a48e40894ba2a1a1c46a6b818b9851b2cb3d000439aefdc9ca4fa
SHA512d43772fce1108c0ae0517395b5835258c1c7072f569cdf1b724406e3145940a127106378be985f59c1e5bad0e93e055ccea070bdc6b285bc8addc408d3bc8222
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5983cd4034779b296ef0375e10f8b6967
SHA100d0e1ac8b0b143ff708ec5031d5ec156b10ad1f
SHA256a264840ed18244a4733ab8a1713c47231e838054d088675589b13372ad35ed4f
SHA51225030fcc8a6300702c1f5679baaa2dd67f6f70310c2151dd46a3cf149e893fe3fe2d0bebc06923f3a20255ef3f145c123b8378a2befee5a24726ad6feb6149fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53952f3dcb2c06e98c17d6e33655e9e79
SHA1458986b3db47a46b6c4b9f1f469f6748c3030968
SHA256991739b127ff5926ee19579849465c991bcfabfe88975b83d0bb02a918c68dc8
SHA512bba084e21a47d577f7c936e8210f2f764cf4ecca23259456d0d3fbd67af3d0d9d5920c21c28042556105088a881925b5131bacd1b784f6aff0b9b7f31cf1f07b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD587ba3bca7cc8f3b1e825a8b226eea6a6
SHA19021e08c38c17b90996b140d288901d648ba3f25
SHA256645e53e233285a18f410f1404fc230231cbd48385ab46447d31ecab6019631ac
SHA5127e9b6f5bf05406f9b35faf9eae014851ff4331c5b8af789aec291dc001257682a0756604d03245b4b23b949cd5c75d01275f12d88dbe3b7ea74d47c9c7615987
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f8a2b1f04fdf10a0a612c9a81cbd9f82
SHA17647f044e36c149dc14a44a1f839bff84fbf3b68
SHA256a3ca5a6683bef1cb6cd103ac6d4f3078f0f64d1a5c4e386167dc005f3a3f0222
SHA512ba7a92404e337aeb7344057cf09e6a78b050b05f4dea46f39cc897dcb1170f050698faf3e0e95f18d0f5c21dcd840edee98874330e18c1524a734a15f45ec801
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57a929bfa022b3bc3ea83d6e6d0e5acf3
SHA1a75ecc361098dbce6338cf4cc299429058252615
SHA2564b37e44fb74b2c528bfc58bd13342aa34fc83aae1d1516d093dc6008dd84f54e
SHA512df6a31a9f2ffea492471b977f91b371ca7569fd41d6c5a2e832ac8a7dc7fa5811129b7e5299231f5aed9690f29ccaf2e28aaeb8345e827ee4c3fef62526be27e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a9738687ac629a9e6afb4771c2bbefc5
SHA1343a0479b63ead015bff98b53bb0989767b6b841
SHA256f2764049d0ef0998f8b5a3740e6502a93060c3c9582683f15612c66449af5da9
SHA5126dfee6e692ca20c12c7ef351dec5ce81f2859117344b4c88d92156d60318c180cd96b5d13ceb846c8907f5969e5c4280789a4725e2d503d16c1c15a6499e04d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51957fdeaf4284b8c247b5626bd0c0856
SHA1b312326117527bc88113d043ca43090f0e6dace1
SHA256c16c14119709b5e110591fc7d1308eab8c81ca65950d33a23db1410ffdbd295a
SHA512d46ce2cc347701b4c0fe240840232eb14cea88c3393ae13d37fb086fac42dcc2b94a598673c4ba1c8a79d30e2d5660218965025e9e4742a36bc3c67efdb61163
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55fb572028f8f09576461148277d95322
SHA103fb2f89acf8101060c47c09c362565711756f94
SHA256d3c9fe8debec60d495438ccb6c5ae410c2e30fd8f22290747d3ff5372b00d6c2
SHA51291d82476db2d95c522a4a077bfec89577862057ee8d71b276340d22a354c6c2ce6e752c24843976f296147363fe4e3950a7e1f1eee53e637f57c98298c797c54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55f0e2bfb2d7c4f8102f38ac79e4e9654
SHA10017af9a9e6cb507e4b255265a5cb5df06b643ce
SHA256beb69944a255cc039e62476b89432d5693b3613b8b2263a00fbf3b7095c2f3e5
SHA51282c61559863c39472d2602c0b082986a2e34b3f6f5da354949fa057481887df54e6dfc9cc8b7805ba9da50f54403aa7eb93b79356e4f644cd9c76d85c09b4040
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f69b73a223d7d0f5c3e4a4b1750ef956
SHA1a6e73c8c8723a1fed46691d4277b0c054a83ed2b
SHA25654ee58506bb646b354be7e83fdf8c815bc383145bed470f10c33d9822b248fef
SHA5124a273ac11daf27e4632e2e99a394a45d36aabcd210ce926b7cd6f4c66a587e5660e0ea6e40de1e90afb362e9dafdc4ef18455d3c33a26fd629bf94d3a2ead7ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dd8bfe16708013e6233c6b967e8d58e2
SHA1ab919ec8ad58f16e3363604a2219391de37835d5
SHA2568753a70f2cd6b0c9d8b886509a14b07cad00de1ac5c4295c43775eb3fcfea981
SHA512a86e17f24f9b0ba0ffb282b5a314e866bc8dfcd34b7fe936fd45cf574248a8b2a8f6038c316f9f3e027707e7e57eb47f04ba476ffb1caf7f926e3b349de74b07
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e2c7b56d6d35ce64e6931c71be402732
SHA12ba65558b1ef371e9b561cbffcb2d90e057d3e4d
SHA2564cfe062961f3c60ab7cb629c4af789e712f01aeb164155204d27b7b1d06a7c6c
SHA5125dd2f4712bf33085a7891296975429bbce7f27e781d3d1187cd266831f6de9d0441757776cb76ed5946f2307e4076336302838c1c583d5fe511bdf26ef6d7198
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD585cfa9d2c7142265b136c127e3d2909f
SHA148d33c712707091891213fe68f49058acbe958f1
SHA256c050730e3497fac9b3d1e1dbe2ec72ab880073c9d064fcc3c6f61e6e78a69f4c
SHA512120b608ca639b76fc17994ddc4bfc6921ac85dce71005a0535397b9976582b6cd6a3cfc4d7791e197a55fcdc6e36da48cf3f331767e2b8fcb568d95aba7b3dfa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c19a960de6747a76984063642633f246
SHA1e11aef9608ec237b77d130a479e12acde5b8247f
SHA25637ce2dd56d15426f94ba2dfd60c008077cb1fe6a0c0319551ef2e867f0e3e57c
SHA512499eb91e2d8fd64f7e559ab91a252db744072759ecb01d30e8a5e768cadcd6d39983caf573b8fff1be2e821212812bee62fa41ee57b6f813f3d975a0efdb9be3
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b