Analysis
-
max time kernel
132s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
10/07/2024, 01:58
Static task
static1
Behavioral task
behavioral1
Sample
32e147588d526f0ae7ad5b4a39250e27_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
32e147588d526f0ae7ad5b4a39250e27_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
32e147588d526f0ae7ad5b4a39250e27_JaffaCakes118.html
-
Size
1KB
-
MD5
32e147588d526f0ae7ad5b4a39250e27
-
SHA1
311094828398ba38e03648f1b972170294118192
-
SHA256
1de8ea16a93a2ab164aa110e181e705321983f24e00adcd9f33028bec3dc67c0
-
SHA512
dc9943ee0aa25745f993b42a06814fd8ffab8a13c2207218bb45d55a3063094b63ceeaac60a58238b1e9f10063680d62d2e5cd6dd5f35efcde46be3eb8055e77
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b000000000200000000001066000000010000200000002f3a067d152d1bcc9306084bd0d005b1d9ba384d1c94ac254ce4fb769b75433c000000000e8000000002000020000000f92f6394924aba161e1f4b59167fa79fecb0c022c85e57e9c6647336185018d320000000eb07b854f0f84d08d10434a07b4191fcf36160ea5186a1ef7146a004a35f88fd40000000c548c8de0f3297a3b76b2b73a17cc8cf0ddd8d06c857cd73f5ea41e4a905cc8d372c2b2183d1c0857aad3f7fdf028b8e581ca5149800e0ace244f38e19993079 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0e4fd136fd2da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426739584" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b00000000020000000000106600000001000020000000bc1e04eec4da17173b978a384a5ac11a3fe8da93e3e3db70e688b705f6135c0b000000000e80000000020000200000005603ed50babb9537e55c03c9f09f755e1e19b5c4756c5ef493bf7cc7e2b34e969000000051404a077338ace7941782cc16f154ac8adfb079cde601f7f7efa1ef809a044b70682073fa3f95dca9971f3709dcdb8c4aa7be6cf666ded03ff4d9129ef835b9d744fdb5004ddeab270a42b24329d44b09aec516bc3eb6809c94f778461c027095238d352beb3ea9d1a2ce2433e1d5caaa7bae5aec7cd6307f52553fc4149bfc712f000a1ed674f1a0db68159afd888940000000d2707ed8a3bcdc733782549ff9fa9f2de051a1b717fcb696bea5adb4acc573ba61a051e460acdce206f0fb5215868e066d5116c0850b87b3b5d4f45a32840013 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3F6F4A71-3E62-11EF-B4E9-6ED41388558A} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2788 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2788 iexplore.exe 2788 iexplore.exe 2776 IEXPLORE.EXE 2776 IEXPLORE.EXE 2776 IEXPLORE.EXE 2776 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2788 wrote to memory of 2776 2788 iexplore.exe 31 PID 2788 wrote to memory of 2776 2788 iexplore.exe 31 PID 2788 wrote to memory of 2776 2788 iexplore.exe 31 PID 2788 wrote to memory of 2776 2788 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\32e147588d526f0ae7ad5b4a39250e27_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2788 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2776
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD555099a24f96db5b875245a71e782c4fb
SHA1c9e97dbf7e4b8ad1cca18800f99cd986f5b10b31
SHA256498170df0cee57f77b78902874b841becf9b9d09778ae0ad8c767cd3e7736f03
SHA512ddb846be3ec7161f5937506bd17c105839e018fe1e2d4d521524141cb5267f4cf627c2919ec574e97af27c1cc4556de708824799df81e8cc3dcf1bc1773fb828
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD502ed93e90f4a3afb4f1526b208d0b091
SHA18c5a1f3e476269b64e92c5fec9a151ca2400be31
SHA256a3fdbb09057592757a87bfc1f3313176f06d4b97ed5347e7d797e79fbff251ca
SHA51254639567a41e4668ed0ef8ee9bbc480d98f1e22b5fbaf2e43e7556c0fb281cc345d97cb48129db70699e9049fff1c0ba8c6a52e431fe530028f97ad3429f0953
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5591135998bb84951ba5e7951a7ac6fd6
SHA1311a4443f0c48b4cff7091180bbbc4b0622c139c
SHA256842c05a2d0979f8aee760c0ee2213215a3f9568d804435af801a92b2250bac80
SHA512e8797f99f9252002b52bb682cc97f43cc094f4bce86db5e9eb1cc4b8094a3e67c900490c77c74da385ecf77dbd7a87ffce3d57fc0e8177bda2ca82772f8baccb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53dade537cf75c7e74e004aed9f5b6df3
SHA14ec340ca5c0a8426c48cfef53320580a5669e376
SHA256a266548117b444aedacd192e93ad76043cd78b47859da9b8542c0a98b670aeba
SHA51230cbaaa89bd6d92e8c3fce21d3320e21d35c77c9a7766558c281dedae4f5ce0d83921d7f06f50bc4eaf085d90037910986cea331c19e9a6c097e7d2b9af7489b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59d05820a1e730222c99d8c90af41c081
SHA1cd133092a5123b03e79f06dd7ac4fb27fa72ac72
SHA2561ddb52a06355adef89a3a5864641e9ba8e91c656cbacad101ceb3ec17eca5913
SHA51297f1da1478a03fd31e53790e9d52b7b4acdeb2299a2029884ef2e2ce584c371bb196ecbb5117a12b67a0e5411116f9741990c13ec28b986be6bc72c936a507d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d070f4afb61d64b2a7a6ce6606270961
SHA14beadecda257c99645281a6568fc9c5690839490
SHA2566f904aad8051e6ab706b3ff6d7cac8a1c685e4d0fff51f74886e3d26c072a8f1
SHA51210fdfc9a0f914883dd0e1e6ed245af97394b4517f590bcfe8e6736fd206288b450a19b29732a0127cd81108d2d6aa41442f1f98ff592e419d3a039154f831463
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50206c415441003099c0bc82fb1969085
SHA19be63c24ec892f6320022496748ee107b305f1aa
SHA256ff500fd28ba9787defd694049b36d85133342d66b046259a5452751edf11631e
SHA51214e0c096cf3eebdd1a184483dbc7f24d528c8fa6fc36f7cfa68dd7336572479ceab94bd9c217a07ee514f0b7599ddff306c2687d81369435217e53400c484c97
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c834f5cdd06ffb7afbeed4af3be36fd0
SHA1e009f2da4055ef73b41d50095ca6106bcc14760a
SHA2567abfeb3694c5bb0211da3781b93ed6f4cb7182361d4d716848804d8a72849ffd
SHA512faba185230bf2193b1a393dd1ec463876b154d676d7e806327ffb60dd78a96568528cbff949e67405a66cd7200319b781de8a4ada49e62dcde40220c94a262d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ef05ff8cccb0fd619c40be87cfcd9448
SHA161d3a84426e0a528ac07f41f232d3a5b589a4ccf
SHA256c4ee04a082daf7a96ce73a8d93f0f17bdb8843cc8324babc5a28b84d2bc2578f
SHA5128bc477eb44849fa48e8f5b8bc658f19cf169bf141211ea716056a2a4bb4a8a083e6f984f2cd408cb28c41086978041cf8fcbcc4977921d1d45d128b32c73df1c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fbb515b58ad3223de46124ca504cc5b0
SHA1dec3d02a934adf5f4b09297444f37060aaf3a4c5
SHA2566b54a76edca28d52a25739290789637fd6be6c3004a20085ee3ccf5317558c39
SHA512fd9f70b729b07dbe83cbfb62e3705930ce11ee12dcfe451e19605f8fa4d532fdf767b603b65773c9281d39c4790c5477f2ff88ae0a8de8e84c723ac905ac38de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5328cfbf44257dd96930eae0eefb59d56
SHA1aff422d10768991463f5b867620fd07432eb664e
SHA25610d9ab1c63780bae138a75c0a52bf1aa1782346f87cc26f0d820842669aca68f
SHA512ed406a6d4a4095074b74231c8d2c1ca1c5354113b92db522281de6a644af83b18198fd70631865bfe7664039db67e766128b5c418599fb0d4b47ff758fcd08ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ce86362ab38c5001d9a44e8b93d718e7
SHA13bc6db5753f768f03d10e17f662604ecc13f3b6e
SHA256a481371f10083099b743b93fcb6409043194d76ad2801f2f21258f413d408cfe
SHA512f1f4d13abcd6b8910ea933518e0b70dc082c743aa21ec428360c71a9c87284c5d2b8d05cdc4af05c574925b4d4dd70edb72cb80969c0ffa34d1aa2969a928db2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eb6460b23142e34b46cc093ee142fc3c
SHA12b038eadfed1bd4731bf09863c08488345dd3a53
SHA256346441ddf6b302a1b5f6e32c185fd0afacb519ec5fb122329259117c9f9cf932
SHA51202da824b0ae9fb8b87b3bf1b3f17b83073b1a708ad5723c19e9397b3788e5917cdbd7c61f774d9558d9b32596b9f3a4f7a0c93ccf0f9f05fe721f334b1703c2b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ed66001e602c095d238d400dcfe93109
SHA1798e3bff7fe6c2a686826a32c9c2ed6a68fb112d
SHA256480478fd2ddac95a8eee4f366a60fec452e52351d68dce12f7a8f9a109ea836f
SHA512c6dbd5aff769ca5229aa7baca4fee2e69c130e53d12fefcbca2d98fed1dccf27ef8036957c1480ecf7d22b0bb9b56dcfd157305a2a799d80dee89ad2d81e3fc2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD544b088d2401296e5aeaaf40a551eacba
SHA1510e31e899af3e63a3785bd90abe5b5e0dbb99b8
SHA25676e21fe1c9318c3aae39d2800bbaeb27bf42ccc8eda708054f3eff6531382812
SHA512f351c02fb7b7a5625785a510189b808a7988c3b7145e6a7d1c574ad569656aa4e95fb156db70beb24350db557591e5ff78b7364b7da4a45daea3952327f5d9f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5673c1c24c2e4d70c096addbda763f4ef
SHA19f76268c9875ff4a1eed154dc9cd5846b17cd29d
SHA25635dc982d864eec7e176864a6cc21c04df6e20065ebd959d9d0a7e17bb7161317
SHA51217730d79148f54e0a1a19ecc2e1d769cd54354eea40ba3745408129c6dd170f74fc70c7b582f63dae2fa3d9a70a74a22e5c5cd5d3510fedb915470307a6d9628
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56701c059efdee1226a3d6df44a9908ae
SHA17d3a406ef4ed7a645dcb7993203f83c76dabe766
SHA25653bbd80dedf6d0e21d5ea6782cdc0236d505c1c7bafa3088b002d3b1dc1f0f5b
SHA512ceaf8ed9a2a3e52726dea2bacc213d09aba43a0b22904312e52a256fd887a6ff3ebbcb04390362ecf649aa7690ec012d6677dbf57d5f8a146c55f002e37cf270
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52a734f9dd77c341e2ce9373e307b83cf
SHA1b59b4ca764e3687430d1a000aba64e920b166181
SHA256b016939b6f5a4371d222245095c999d903186f83d8ba5ca1eda156e408c9b2c4
SHA512e159c41ff0d786faf4fdb67b027ac805d248fcd7be12760c926eb9f71866e7e342e76837c66b9ea10d14e25cf1c9c5897d72f6210d2dc683f798d78043d43d6e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e733974ac72546806198becafda4ad38
SHA1440368e13abbad6e17ee65e1617ba91c2a3fb81e
SHA2560f6738efc171be41634804b72ed04cbfcf1fe04e0992cd67ed5f3ad60f3ae71a
SHA5127391931436a2a9a044267e6527e5dba2cde8564aacc496e28ac108ce10fae4511bb7c13408f191c2e49dab2bcea59dd3cdadfedc5f472e010dbc552ed43666dd
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b