Analysis
-
max time kernel
141s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
10/07/2024, 21:41
Static task
static1
Behavioral task
behavioral1
Sample
368021214fdc8ce977df14b93ea06dd0_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
368021214fdc8ce977df14b93ea06dd0_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
368021214fdc8ce977df14b93ea06dd0_JaffaCakes118.html
-
Size
120KB
-
MD5
368021214fdc8ce977df14b93ea06dd0
-
SHA1
8a56cc4a5cd2668ddff6e0c1bb9ae39bf61d6d61
-
SHA256
3b3e9bfb1c4e9b996974563a187176d438cc654e142e9a8ec3a45accdf57287e
-
SHA512
c8c51f9656b30a326894cc1ff2caf8beed7e7213665692298506308fca69ca7afac9829bce68d74808ff9ecb2d7a78c732981676bf7d58a257eee2b7f7eefdce
-
SSDEEP
1536:pbMjw2fMk1D3O9Pj2fcbjqHA074L31duxOcZEnvHhp:sHlELAON
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426809552" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0b8d21312d3da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000c403618a077cd5a775f8edf7ec785fd94586e1c8a560c1eebcc47eebcad14387000000000e800000000200002000000007a946f44eba208b2e26273ce64d8ec0234cc1d502c1901db6d87c658c3683b890000000f05ccf3aed9ce0fc2d2b1ac12bdc6f173429a1622e66968b4968723cc3b71a75e4cd8230c520e9dad7dd6cf24485f81fc4ad12e9d167b663f997b3e0225fbf9dcb21999df4e9f41a121c2a28e8d8e729680477c35306de2c122612560ff385518265989656a4c7f1a7f112512ab12e386d9055f0aa2dd3ee8b9cddfa1f5d684b980f41a051c10468f68a0e6fa2362a2f40000000e76043b977477db22e1be27c07380e90d06a159f27ab6518c5f350370ecc2e56539b8a592e55cb3bd31dba8eba8ac8a2258db47f509cf074c7f96a9931f9b359 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{25A9C4A1-3F05-11EF-9143-7699BFC84B14} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000a1897c8d4d6bbfc86e9481eee215d7a50a9abc52268659aec9da49bd6a8ec6ea000000000e80000000020000200000002e58538a8b4fd0ea615300ae2918bdcba26e11706e48f86114c700d94f90416f200000006a8eefa8773533d206283f0a3b657d5bab6f9c902a82213ada6b026d926fb4c04000000052ed995cd81e127f498a3135aa5c829a888b49748621aade7a370ddedd7f0ee3ce0647b9025b5dfb25e3a740e244e10f1be1e9845339e81c69fb543f6eb42ac3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2548 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2548 iexplore.exe 2548 iexplore.exe 2328 IEXPLORE.EXE 2328 IEXPLORE.EXE 2328 IEXPLORE.EXE 2328 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2548 wrote to memory of 2328 2548 iexplore.exe 29 PID 2548 wrote to memory of 2328 2548 iexplore.exe 29 PID 2548 wrote to memory of 2328 2548 iexplore.exe 29 PID 2548 wrote to memory of 2328 2548 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\368021214fdc8ce977df14b93ea06dd0_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2548 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2328
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD593b1b93e242796ba8b057eb8131665a6
SHA14f7fb61e406b1be1e84b424f3123fe495628075a
SHA256ad7fc3d6888b52a2258137645aff8622913c2880b08bb11782c504aca8e4c90f
SHA512ff3e8e80febf9d5505f90adbc57c2f1c09d9a85fb585c590057a4dfacfadf9f8d61ff8aea920181966d74db5c49aad91ab107bd2c7e0516359ea767c971f2984
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50e9ea0514e2a2dfe79299d47d91f5189
SHA150ab5b3a0cebbcb1199f55bf1af22ab1540f85ca
SHA25647a924a9df34092a31e7779c7e035a60fce4937929011a49663fe4b3958dfc21
SHA51292d2daac3ab80c77419b1687d127bc441e14460ab8c61ac2658c035cc6124681e7958790572d0761816818efe7ce86fae5b5d96451780dee93cfbdafa4c5449c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a6347164c87e403b1f42985e2688382a
SHA1083474d1242707aca2407bac91edf638619a5a71
SHA256f36c9bdd072fcdc212bb1ed55d919e20122ad39e0d8dfb3730dbabd537813ded
SHA512ccd95269b6d8ba4e9b00268abb66a79617312b22c0640b2dc948825e81a44d1150917ab8dfb1fbb3e65a1670c662280acc60a85146f2613db2817fb70921d7bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD514c3f5dd64abeed74d10fc6389d67f73
SHA116cf374448f9ea1e6da49528ac5b5a55059eeba7
SHA2565813b5d112c43ab018aa33bd51bb57b4d926b080bf31a750a86f8f2994df5f3c
SHA512f60a3f98079001e283c7f625d52919e3f4f09e7cbc2864ff1a69ffb43d54d98fb3a08b3a77f0f0f7c16e37d58bbb9f0b3966b45b4420a20c425f86882b237146
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5554e4a55652912cd5c384ef2c7e8d3ef
SHA19486a2f84b4b07bc00b7942905df4d8f34e984ef
SHA2562bbb527951a1c2cbd0e9c5a85cb21ea8726836d66553d68688788a2dc70e7dc3
SHA51206f1e447c3786d1f1b9fde2aed3cccc75ea3621473a4ccf8af832f2c5605a1ab5845121748c6999a993592a2580b4ca3e6917c5783699e152bbc941c68b109ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54e6d29a886c52480b630d61f7f6a0b58
SHA1c0a3b0bec5417269702a8108e4b612b0fa6dfce7
SHA25682c08626e626383b61af28381d222c66110379d6f0586453ecd381eecac485ea
SHA512c8dfd6d586793fc856ad6a3dc3e3aef171aee3eec23e5bdb1b1fcd55a93dbe0e83a9279d377e58d46fbfc4f9b3aaea90ff06cce0a90d2f13d50e2b2e536946b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD533fc437ad27e77ec19e685b436cb0dde
SHA13ca8f0ab8a999d1e40641b8188a0baa0ff8b3479
SHA25602467d7f610e75c7ca3c95669e99576003dfa0640008000ab411687e333fe3d4
SHA512c626a47fedd1df662536ab6868ba22748eb960d731a598b5c3e1f322027e6bef6df780c8cc20470fc54205f9d15bee457fe82970ae2d66a69dce63603b6344ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5802a0c0962927acf86dde906998d1cc8
SHA153d6c7ed2b614c0e4ca6c152271fa1c8e1441d41
SHA2569d94edc588716119c02e6e90c348e46a88fcb5d0df0867e4e16474b752ada0d4
SHA5120d2226f8346a43104efb47b2529b09d2d3caf55d3609335fc7ae06066ea829acd6fd547e2d70bb778f1870013b2d032565f863d670dad2237f84a080ca590bf5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53b143b1eb8a1a52df916af4824e9bf84
SHA198f3fda7b4629de43879b33eca3e594f49334060
SHA2566357014d45ee2dd88e4c4a8ff6c12c66531267792bc20b0c8c040444e76adf38
SHA512cc9feb37049acfc990c7a9c9ae2dabf9749af22bb60b28e035054ac49d102969ec54a30cd5d63a46e6c7690f7cbc7b76d3ad4b1f1a065d84686425b8ff142ee3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD586704a276294d09fd999f8bf52caf013
SHA1abbff9e4382876882dc5c62fe60ea8993d2a1e11
SHA2568cafa1f17ebe5747e71f585433b6e8fff2c891d5277923ad950db57b501e9efb
SHA51280ca70282545d180e6d234a459e9dc293968af9438b73b391c6f9ae940d02fd969f3e4d76c9c88d78bb8131d0a96a18345c92116c01f4be56349f35e2a805db7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a8c55b18ddfae39768c49923ddfd8b7f
SHA1504b67c7804a736fca455a86a78f61a25e968488
SHA25694a664e61946a1a52648a0d2c5e19c6b721e99ed531f90bcadecb0c5968df5af
SHA512bb36880e94811ae74f0f835faf84df3056a910261be37a2ac8e0c356e9956bb7c3db2dc384be2cc651f1b56d4c3afbe7eeb81a4881bcfb0d082d165f0c2ec2b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD513c1d14d85e5f79a43b62b64768bc8e2
SHA15f6586230cc37202a1b5305c0aa1dd7878819165
SHA256ad2b25653dbf64a89ae7b2c822c663ef89a7722a9fc47bb5f2aa376a03735f06
SHA512cf6324599931e1dc21c223bb5580d1ab4766af93954efcf50f6eda2e092348911e84079f2d645cf952fd314e0d632b0a96476385929dcc5e8cc923b5a40d38b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53c3f9b516b103ce70cc4230606d22938
SHA1f77cdaa1a0eaedd1606eea8458c5ff0f692e9838
SHA2564acddf849c1b8862d7c94c30e5396bf17adea0f2995f1a9870cb3694ac99717c
SHA512206a7d4f7be18e9d2349eb3f0a2f632dee59b0e36dbbb0002284dd2dc52091d32f47ec7475500459e23da454b9aa041eac090369d67168fc37dca4c12f9d80e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52818323512a5c75d6e1eeb0bc7605d0c
SHA1581551667aac7d94700f0f67623a850739020266
SHA256f3bfe2d77ac508799833b69309076ba0a91e9180021601707eab3ecdb92de890
SHA51254f5df1ba8598becfd3f6b0dee547e0907de41e7c25aeacc1d0eee0c7cdf7863eba1537f872a99a205a473b7585ccefc8fff465e88715647b917c68d9637d644
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e286a6bab6230a76c18c4af4d5c43ee0
SHA1b346ebad55fb6a5b36bbe27b9a63e988abf3bbf4
SHA256326eb6a4bd95fd09abfadb23f7c29674c8a3a309c4328f2e2d161d62eb368ba1
SHA512ef80efb1c1596a112c94654578c7f396d6270cba349436806ded0db367f590e70bf46fb3420568a6572a2166b1c6a5ecade5c68142fb9c42f7745c866142b868
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d0001864b9bcbedc0b80152777e57c1a
SHA10908e0e5f1078d859735c7759b8d43c19d069213
SHA256dd028dac71324ed99a1473a57f7b021b382e81283817fb93ed047897073fbbf9
SHA512c33b00c8abd031af3f74dabcff112ed7d21231472db8aa1353567bdd05ed24b75c01e5861a790a7f36062ab1fea6970cfe053bfc3e8ca83435204cb807a28b78
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53aebc0b52763b18bc6e86d9be81d9e38
SHA1550fa78de0f5b6661a47366ee43a7342dd26ed0f
SHA256354f2cd8134c9729a6dc5d152f36962d3da9b1635a1e3a87dbe40b3e68ec7a48
SHA512c0327547eb106cff8b4d226464b352697c1ec4f1307af47abb43303c330b507f3576823521e5ede24190ffe6fe0a331f0afb8f484d22bc2b5a14e8c9c2681093
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dba77f4de7186f3e93f20b4b4945c691
SHA1da377607a123daa9badefb4c9e669b99da52fd17
SHA256606e726e0658accd9571f12ca991af6c1b190a1deb113e4afff9293b607fef93
SHA512385f418a058663085f4832dfcc1097f6151d95c4d569b0ed14046fef353c72787ccb84b01898e65ef6a036faa651cec49c108033fd26ffc58bc2510fab3607d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bb2df123d2a6f0b573f3b75690fbd9e8
SHA1ffa949263d85f699c8e33f9c6398c1522fa2218f
SHA2564daa91f77780dfcb8ce1a311d7890f2af365c2b1030deff2e5c30882492243fc
SHA512262d47177e57036ce1d0e58a1a6122fec922ee156fa411dac19c265f85749dc7e87671dab5acd47818bfa001ac2e1c93604aefbda4fbd7d3ad8660e62ed39337
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b