Analysis
-
max time kernel
118s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
09/07/2024, 21:01
Static task
static1
Behavioral task
behavioral1
Sample
31f63737262e3afabecdde9186661922_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
31f63737262e3afabecdde9186661922_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
31f63737262e3afabecdde9186661922_JaffaCakes118.html
-
Size
18KB
-
MD5
31f63737262e3afabecdde9186661922
-
SHA1
9d030634d3f1f51be1556efada275f338bcb8bf2
-
SHA256
61cb5ad9a86f618e6663a2255c079a0b5f2920bf02c7b1707e6516ce0c1b79ca
-
SHA512
52b24219ae114fb4a1c0b042d6717f1d190c3b7d5ad5881a190dde9d3f8b9d8785de89ae31c5626cea5b52c18c0fa9081662df7a29ef29c0962eac5fb90ec246
-
SSDEEP
384:FqgfxVixZaXx3SL0EHYyIJ0JfSIAK3I6deAVk5VJ4l/kzICzu:QgfxVixZaXxUBHYyHJJR+vKOK
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000cc58e4fa46ad64d93c7ec1646f8e73fc040b47cbcf6711c69fe313a4cde8244f000000000e80000000020000200000007d7b02fa2d33995b6b2fdd0991edde071165eb28c45a9b48cce8a330ef0e251a20000000d0222facf145ed5df2e916d06896fd77d0506b8b62542676e597678a66ff9c19400000004079fcf62700ccea02300032339a2f3be031b742fe0454a84c16cc8742059c55cf9c9a11956f88c5b82515ec11023d15e3fa9bcdfe2edbb39b769064880ca221 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426723852" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9E76FCE1-3E3D-11EF-971E-EA452A02DA21} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20ca68774ad2da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000de4bf9f8c94f3049230024e45b1efc5995e2bcafd8b1808611dc408840578c4d000000000e80000000020000200000001ea58afb99a588e2795f61fd42b270706b568d89770758544cb344d074a8b0ab9000000056ebb680caa6496e37424dc92b75e705b49bef8f8ae2192828a0cca88b28012af8599174008a24803b846da8534fc44ad677356b98cc30765cdc0c4f178a1906d45d71f052f485632d2c10e4627049decea8873db4cd229e4b8715eb846e0918b09416485a978e7d295b0033baaa505659ca10c461a53c4e885f3fda61cdb932edb67fb8d3d29ca6e09d3d17b126b7d440000000d3aaa74afd5f01c3e09461ac452f6fe2d3efaa7935001f56194f9bdbd3f754dfe66608263da335a8d73e0ac22ee3e31f387e5e41b367f2e536cbbd47045207b1 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2540 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2540 iexplore.exe 2540 iexplore.exe 1188 IEXPLORE.EXE 1188 IEXPLORE.EXE 1188 IEXPLORE.EXE 1188 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2540 wrote to memory of 1188 2540 iexplore.exe 30 PID 2540 wrote to memory of 1188 2540 iexplore.exe 30 PID 2540 wrote to memory of 1188 2540 iexplore.exe 30 PID 2540 wrote to memory of 1188 2540 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\31f63737262e3afabecdde9186661922_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2540 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1188
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58ec0958f0e288fa4a4e93e4f825e02e5
SHA1d9ce140f90fd7fc2065a53463aebfdbd7d977704
SHA256f0909bd0fad024c094ad7cc00c216418f81ddaf57f8ee8f607de62ef44d07644
SHA512d4b281fb3f71a2404b0fa4ab95a9f57e77ad7189e89d822c585feb1022ef3b9313b63e4377bf465c17c8f64bb967f0fd7518a0420ed5d118d2308387638d13bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5daa83a21f803931fc0114bc50efd4675
SHA1ede7d381a8a55fa3b11ed76132a06f2011cd580e
SHA2560bc55c4606e211da12d04a2ba7d97e97f7c942be58894d19af71ea59125c746f
SHA512a31442c33783fe3666f87a23e50c5378128b7f003c960a6af445e9cd07e4474feea35db625a0d167b961ba93a3b02e047a0dcd754487998b681867815dd2a10a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5092bf8e588808c3e1cc6e709a7a9d5f5
SHA1b59d4717b7a86bb52f5d2b9a46d3529db2c05857
SHA256610505700b041e959a240ea37e74415d46e4699eb7489deeffae41c2814d9cd7
SHA512b65db5c4f222468fbb7fe549c41d716260c29c3fc89129297c86574d31f5c9e5a804cd81fd74f2e39d15feb977651d93ec428f98fcf7bcb89e6ccf4e4b5263f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD525f9ca4225bd9eb2f7c00c1eaa66e8d3
SHA1526cbbbbf7fab42b3d8609d7ee30dee90a2581c7
SHA2562d7b42f288c719d1890b41014a0a40e6a11c5571bfa141284a815ac711fc1220
SHA51255471dc41e8ecbcda3b1cb99f479914241161b13d75cc971762b020dc78e6c2e27c2b64ccd786103aef51cac5b93c631119ff26e42c188703065b224e9735397
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5be6fa38af4f2630fad77f2e23ac8b303
SHA13c8cab6513558c143b0f97eeebcd33677630e63d
SHA25685a353220644598bf45a8f37816ee19beae8fc0def83b2e813a33b67eda1b566
SHA5123266c7c9f9b59e1e044fa6cf2d02370c12c5e28c583df3460cad6141f01e554cb3975065c8caa17e2bf3b7e9440b41367878eb4a5168383a1f311a6b3c368381
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53b74ffc2136a3f78de88d7fa160af788
SHA154ad82f5158142e2bedc6a340b69b06910435b0c
SHA25640befc052f542ace14e87c7515a1f52778b7ed3ba4d95d7a01f7782c045ee23f
SHA512a57b05b004ea1f3be75f2617bf8bfb51b6ab9a13a1f05d5a5940f9865f8be4685470802e4febffdb6c36b9dc51bd2b22bba20f5a7a9ee0543dbded513f99df61
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5181270fba765d367d1a7845fdf5e0431
SHA197d197ce8e724185dbabf45ddd105bf0eb8a4234
SHA2568919c8b0de79160071568ab262ab973e3060838a6898c592b39e7906a36d0a3d
SHA51239fb57751877a5cc9665995057b751a8155208220f6f79d2c546e14acc45d96ca92322aebe6365d5521e96ae60da1ef4e1452ae699f86d0afe5f99fc783a88a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58b65033ddec0443909b31f6093fb1a51
SHA16232e4469455a7c0f6648e92204da2c850cf51cf
SHA25669d09033e0ef2402e41ce54e7a1df0f8528ca0441c9ac4229741be1349685143
SHA5123e205515f3f1f0d842ed23a8f10b13dec877e42b06e9893bd054a0dc71229b783e22ae8f1717294af0ed9f1707bf5e6eff89f9e4cac57799e09ab971167cbbab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ad84d814d046aecd55a6f223fa578492
SHA18711fb27c6a3dde8685e0ec63b943cb3e2fe9a77
SHA256600e99ad2a87509b8c10323a5bf25d67a9ed2248e0bcab56c1383d7decc8bb9a
SHA512a09774b687cc7825650f7d01169f8117f78d3f1142a246f94683b6d505d259f198e9544ec45ee709a146ad9af6b2bcf849babc8bfc1438c8d6ac1f32645676a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bc1523d25360f3c7746a59c554705cd7
SHA1da9d9a6373763a77581d03109a45c9de8cce8d3e
SHA2561ab39a5839e10f7fa15eb09c201d482e02c59a5fdf833203c271fe693ced6ce5
SHA512cda5f43a593f2f64e81e7d6f983a4eafab26c97ac248c4bbf9a65ade3d6e3b5529607da25efdc87c51815524a801a38d06a1d9059d89cc099dba8be089564559
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bb5d0102eb9ce67582d14f93bb536ad8
SHA1c1bb8cce6433caa33804ec1040022392d9b75e61
SHA256ba5445b5943e7d50446a3f78504ba674b8752b53acb93716b1058a66f55643fb
SHA512288bf81e0b2a2dd6c34fd0f8a4dd6a783de4aba9978eaec7e76f050904170688e65d316c84a26fed3d27d6f6ca31fc2f0fbc6dd788bdc3e17e0e03323021f945
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5822b990aa98774de316b9eb30a42e685
SHA179e90ba5030695a24d492e9e63cc16cfc647ab13
SHA256d2e3a5de50dff770af6012874c9f1a46e6734712754531986a5a03b0debaed95
SHA5120f4a669b8f26c8b244260eeac946b0e54568f44889fee211f230c5c43ae18bbea5cc876d280f268f84a628060fdc58e88f7afa35cdcbbe64c00cefbd8500bb81
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54223e5440448af8657a55433aee7a8b4
SHA1fd77258e73ed9658ea5583bb48c751693db93e4e
SHA256fdf74238665cc6e5ce8e3fe06e842b00a598811dfc234b3c444ef5e62938e65c
SHA51214e194411c3b49d8eae6b6d23ed7581b98a0a8370486c0c82d8e0dabcdbfcad3f857246271214e796b6b11672f7387d0cc91ec18585c7d0fae353c5ae844a0b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d6c9a9f1939d5cf98b7c2c6586ab9c35
SHA175ffe8e3a74dfb73ddea239b74bec4344116bc59
SHA2567e7b0b579d1cebc03b535908d7c7b2f20148852c979b0fb2c74e3398bbe54283
SHA51230a8f34a90b050b9368c2c55f7871d69624504efa1097979a404404587da8c20658bff0d8ec9dafdbb155deb97d22f74ff5c3e75891055693fe2249ab18f638e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bee658d6151e533cf71571a2f16a8edc
SHA1258aa8a54bfdbacda0c4f96342ac7948280cca25
SHA256e83761e7f30347e50ae1ea964ecda022398a7f6b46bde024e4cfa4479502e3ba
SHA512fe9cd8f4b7f235df82326b6c8263adffdab68a73f3be6d93b377931d37f8dcc4934dcad047228dd2b848ae04ce7f0421e774f4628ddc56c3e9a7744fa85831c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f683f7f8b3e2abc19f9c76c756f78049
SHA1cd1d3b10c52a29a8d78e7b072856d239a6941338
SHA2567b2d2358462efdd556e481afb98ba3b11a51ab1483598eaa7548bd8e392488af
SHA512057685f33c0b57541a1162001f44adc13060486fd701db02abe9369b78070a6da967458d740f14299b3fc50f7f1b123956a7892366a89e74bbcebbea9c8a8c59
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51a774332956dc68ae6970d2161081714
SHA19510c7080ee19db92a2cb1116af32ebf66566ccd
SHA256bba640fdd89401e02cf08ec348e46abdc1151720dedb6a8f715ca41b753998a5
SHA5126699e16f0dd32e343d4af231c5e9caaadb48958f42a0fe208fbb3e139a0fb988aed2dae6108976e1db07c7fe0da3654e6ceb01e7649ce28b07c480296017faf0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58d056ddb367644ff70baceabd97e755d
SHA11a2f4ba4e6c68921a6fe2154318cfe4072cb9a36
SHA256c92553f0187e4bc9a6c5d9d186405e4ccd6b69c05cff3a1e2e86c850ff85371d
SHA5124032e911a19ed016794be73190bf1bc88f51ea54356dd42ef4c71932c875df9b8ba921bed2c7152ee38342f81db4f6cc798df38463bf5217c7d765755201205d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56a2289b28a30c74baa81c9bd10ada36d
SHA1467d6997339d088c9638542d74a34c3885bcdcb2
SHA256375848e3624290d7c9cff924b1b6b56d489b73986d0a1fe8da6b8cd2d8e0b405
SHA512e9b8c5ae2b008e5795c7a1837db4857cea31e20ae49e38bc45023a36380fd18d2e67de2097c7aef18720c192dc88ba036f2f93c4cc99de9921757f368d7ed67c
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b