Analysis
-
max time kernel
131s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
09/07/2024, 16:26
Static task
static1
Behavioral task
behavioral1
Sample
311d00e8772e586873ce4be93aeb75c0_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
311d00e8772e586873ce4be93aeb75c0_JaffaCakes118.html
Resource
win10v2004-20240704-en
General
-
Target
311d00e8772e586873ce4be93aeb75c0_JaffaCakes118.html
-
Size
120KB
-
MD5
311d00e8772e586873ce4be93aeb75c0
-
SHA1
17c568ff14344f0c76e40897697cb6fbecf22f8b
-
SHA256
302916a8f2dbbd4e81cd9ad871a4821e54895c0c97b669aaecf174992b4b204c
-
SHA512
cea488d32006f16ef55f75c086c173eb47eaabdc8cb05cb3d8898d336a6038b93760a595a03384f5732eeefd95f335577b90cb4639de30f6d96c0182da287c4a
-
SSDEEP
1536:5Nbvmjg6/sAamQLyHfXRv3huPZPiAQFZheZu5NWp57:2jgvAJdhuBPiDjyuiD7
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0bc3c1b21d2da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426706053" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b700000000002000000000010660000000100002000000020128c5e15454c9f2052188c3955edec74ad4c90b0cd50e0042826cc349736b1000000000e8000000002000020000000d8b5860285a1e0a5b5e8a6dbd7fd69d31484966b2bf3b199f2038267b32e69b590000000d4ccf5c60c5229c69fe9eb3829a5db24ff4cc03752299d8ec3b7d1c20775324f06dba7e5be8cf93dec6fcc57117ae3e72186f4af07d642770b8d003f7d458f4510097f40cc49d1066d5774f9ef840199343bea85ab8c007e219c1f9eb442cb4adbd1a5cf35ca8f4a7f78da4ab10a3625dc27d2e4401a5869c72a9961ef9abd0b26df61ea75792402a10d9728f83ddcf740000000d6636db7ee25fa68d768d4046470a7eefdf98d413235641c0c01d62e4df4aa25bc41ddc931f58e39d465a2ea3dc62ccd309010e57d3b782fd9e4a80359121867 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000d10352d161ed39d96743d38b6e153da7562e9d087b76c43377cd5842954364fb000000000e8000000002000020000000e6e281eb4ffb6ddf9cb92a2363305c1d7fa07c211444b75797fded656cedbb3a20000000537a97d851802970539544cdc0de2075d79390a0394a0c24a4e44d6a53490170400000005162fe5b76ed5ddcecfe09d2a21e4c7f888ef2aff67fcbd5b6088b0eeb409b8b426d48cfa2ea4bc49f016c9392ea913a4541fa6fef1ae206c04e57a5ddc104e5 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2B754361-3E14-11EF-81BB-526249468C57} = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2388 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2388 iexplore.exe 2388 iexplore.exe 2380 IEXPLORE.EXE 2380 IEXPLORE.EXE 2380 IEXPLORE.EXE 2380 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2388 wrote to memory of 2380 2388 iexplore.exe 29 PID 2388 wrote to memory of 2380 2388 iexplore.exe 29 PID 2388 wrote to memory of 2380 2388 iexplore.exe 29 PID 2388 wrote to memory of 2380 2388 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\311d00e8772e586873ce4be93aeb75c0_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2388 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2380
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ab0f5d7b0b1990bb2c78a1a6c8dfb948
SHA1b34382be0d75347414679935a6dc0655833bbae4
SHA256a86b5a7c6afdb45b450451a728f51aad2f3d0e8a00e24377930dd957f19ac7c5
SHA5121b71e864a0e82e748383da94af968fcc0e1c030519c3b43bb6bd8fc23fdf1d73dad5e3973feb09e5a2e27fe6c66056f1ea5eeedb19cf9d739136e6de15896b60
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5385c74b68d5858f038eb7e3dee6349b1
SHA1b331cd632da080f6593a9cb4fe92004b034a57fa
SHA256c6662691d2546655058f6cfbad4a506827fa117bdd9ce6ed35804ad0e6a5e3c4
SHA512b0001687908ffe9f24eb8f746dd3630f84e87231ba524eecc19a21b5f5fb9db5b4f92c2b60d89ea5b242931f901660bd71cc52a5a647f2ec16b4343d799adf6f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58f63edd12e3087a7e0c41b1e0e1b3529
SHA10a6e0e2cab6af33b63008975b49566e8e4beeb85
SHA256b3118c0639a6702adc42a144200900ae2b041d50f943d6982a1fc62cdb7e1836
SHA5123216557d0f147b2ed2995913c5b9504b7b84b17ab6509779695a2eb0c25f4e758a5c16e4cfa6e1b23aab2c83503325df2a8f60571ba619d5249ed0d16b4eb76d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53ebd7e120b50bc325e467d029f3db1ec
SHA135967d4477da341ece6fe92f4936292d3a7ac4e5
SHA2563f29a67a17492d184d8f19f9676cc9207aaa9d33e1d6715046fe9a5e656500a5
SHA512603a7fe071bcc87f6d5b1f4f52d698b5d848ae7f84e4464542c4474f50e5f7ad97236873bc24cb827bf22ac1d32595581c68402eab77f68b3b5c71e2609a2525
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56a5281b63df0743aeb8aca72968b2f4a
SHA1c08766432f66b274a1dafa41541059a1a3c36239
SHA25651439c7672c25c32045ae9e4d5b37cc03efccdccbbc39dd7869928184d466229
SHA512004f824334c23faabd203d5ddb266b4926602391cc5775800bdadf95fb13e54aa08b5b3babf1c88f727b64464428f6cf21abc65c0af65f65dab977df43212bd3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58d805095754a1efef60f0ce023a943ed
SHA1310f600174e8177167ca58788cbef5e49ef4b7ae
SHA256b538f2ac83dc0c81e66dd1a821d5f76955e6a1338e536fcc6437d2caea11d34d
SHA5126c3d37ce4841b3afaf8cff887c9109d078a542a48c6e84104165d963db6efe0d710d1638b948ec9ff6b62990f30bc66bd017d996239bb24187f32fb587275cec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dcf15acc311c519112c2cd69a01af27e
SHA1e14404e39006cbc3468ec5feede0ac82ba8fa43d
SHA256505328c1299cb12b66341fd6e82a27766952b68de6fba49ee95037875df4353f
SHA512d57523e4e670b9039bed05120da06dd54dd00eda871e0300220617b57d51480fede6b718a20623070929fdc4e2e521a4d224aa02a73d26c959799c6bc834ada1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5256af464e3657f4a70b3f8c9bdbaa415
SHA1cc5c6633c657c3b62706c7c528d5f13f42e95b65
SHA2561c5599886236e155ede1e680493a907842ddb51cf4ac7364a09941a647f63e9c
SHA512f3bb980412168531ab1e28d7af8dd9022eb52257b4d67c73b7dda81f06cb3ae391fbe58a634a640867bcaf540d8174dee38cf0d3a757ec2564955fe75df9b515
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD538429b6fc0ee277692dcab4b67d3a262
SHA18def1c6f3538482542618cfa72382c2568fd5373
SHA2569a360adaecf32c4a289bf353305d10133e7781dc917f1560674d21cab0793456
SHA5125afaf92b8d108cc076b5a8123622248a894ce2e458f1bddfc4e20508d9483ad901acd284f23304c47bd12e862fd693d1342d7527b967d4a7c08489367799afd5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD561e83f5ba7b38116a117ffe64446efbe
SHA155da459502ab8d9752d9689fd31d0da2b696cca4
SHA2567ab5e055c8bbe9604e76be79528cef879098f1f430714ad0eef162a1c96608bb
SHA51208d0a5a01f1f606d20cf6e5ceed8d86052e6e4a092b96de9c9ad78bee6aa2e9fcaa7db5a0625135a907ffb0630007ca32e28f2bdec528d04e86c6832234a7754
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59789fed50e83861d413dacd8b6dd92a1
SHA12565b641f053feebe191442ecea8c051cd949bc7
SHA256da18d224eefc9c1fa107c647f3a21f0bb6b0cc4a3d79e1782799465a0019bfa2
SHA512ae86e2bb72f38097c27bfabf6f1e58def822fdc801e287e4d7daf9835b2b5f863fcbb9d24a30f345283cc706b28c3fb5e340c4f6b1bb4b1e4ce1f5fb7e6213ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b42ab6d7da78c24cd324d92a1008b162
SHA101cde19bbaa2b3ade3732c65d39f5da13a612958
SHA25606049ffe2125c5059c9f1e45c9204352d444c2e2d31cf41e8b9a7e9bdf6c2a21
SHA5125df167bc3b354acfc03d1a54997769253457799960ba90e01f318619489106eaee8ceb7c5e4c58975e6dca4b43bad8bce9d2c7d45db3e63a7d27e2eca233004b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57adf4c1eacfe3b0e9b6af65e31089b38
SHA1c2e00cd0116c34b499f3bf76f12cc6e2a1a5d7ad
SHA25672a19024a413934b97c934c80345edc452c01a799684e051de99bfb1fe6f85c8
SHA512c3326e785651a1dcde2082231ef865f891fc0afb72242d142d2b6e17978297481f09cb328bd76f3acaca512cddb2cc1c771d87f9b11b1f48b57200f835c4abcd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f9f653670174b0a604ce3da2043b014a
SHA173e831daa4840539744aaf235918ab1fabf3468b
SHA2560a8f471b07e7db2e62d17934633305d9daf715d3384cd484e45f72e4d14f435c
SHA512c91df8a3c62ecd75919d3c235cefd852698633768120b11bae2e28a62e39b48562fe319a505bb89dc617eebc2a155d1672ba2a583c0579b01bfdbdc7136a948c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e221220bb040632a6bf9982b555189c6
SHA100db1c89e95396dbd091d4391b4efbb929aa8542
SHA25681e0ec4cb55c6bb7f7e3ede2dbc72bb88d4a10fd873a5dfe6900cd55df52af3e
SHA5127c19b6d65ea7573cc619fe648ddae4b63eb28cda39eab71ddcd803a86f522372290bcb3694093f7231343561275906427cee90ee16ede8470dcebb8bdc0aff92
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a99faaccdcccb8e01637d58dbee2ad9f
SHA1620230928ecdcac88b566d31ffe8eabe3ce6acb1
SHA2566a6628ad9c33c2eb559d689e6e4e2a6712a365f4d9a90fb558e79aef7cf9bbb6
SHA5126a392a1c833cb508e009bccb6d6de0919db95d2623b4d060f04845dc27959387e0427495da5611bac7fdb55eb50f6cd676a6ed52efd2a4258c14935cd83df771
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57ecac075da33a11c8e7ec342b2a42dd9
SHA103b8a2d28293c5404abfee76d6dc7b7dee465699
SHA2567bde7a4e8d76a0d7e23f85fa606caef50c361be3e9cc7953a8a5fb4bd4df757b
SHA512ffee2b2e0e127a6876b5979b2bb385ff752279f917a29ba3bf042487fd4f378e3e6139015f10ad54c16a0fa6be96c41d311f2d8b94ddd4a83ffbd4a731c73ab7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52cfc1494a48c6d67309cbb9b2de2e3d7
SHA160654cb7823b230c9b36fb462c50a510a2de1d12
SHA25613d6f8df6aefacfc682e128b5c27a35364a62ba338ce29657aecd075a01d69e8
SHA5127683d6bc9123332340c336f81e52f503c9c156f9306438308467b656aacbc5e697e33244bdb4c9583b8ee50d28da7d6df8806d6c4258860e357d162266d4473d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fc9830cfb5779b47880f534e0d13c923
SHA13d919a70d9c8892659d37bdad2721ff2f4ba79c7
SHA256de9d837c12f6b3b41259e5d541160413040b9c3bb9768ebb2d4d159dce8b1af9
SHA51202e6876b1794d6fe7ad361d765f7a264ad4009699178fad223398f791c4dab5b3eee87fd2fb3914db38dca6ac2a7b150a3fe889891eb679ee310822e3d7f913d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b