Analysis
-
max time kernel
141s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
10/07/2024, 02:53
Static task
static1
Behavioral task
behavioral1
Sample
330989e2b824fd965f19e50ec6627195_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
330989e2b824fd965f19e50ec6627195_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
330989e2b824fd965f19e50ec6627195_JaffaCakes118.html
-
Size
19KB
-
MD5
330989e2b824fd965f19e50ec6627195
-
SHA1
fd7f6c2091df1ae39c8ce1488aa4d72c87f285a5
-
SHA256
ce27b8550fd01167e227f311d651ddd93c6d1a2856bfdc230cece032d0d94def
-
SHA512
b08ffb3a4bbf85d4651cb487dcf9a5424aad13c5189f020565075271d4955ff6c48ac626ea648676ee01473baecc26ac228d67a36620a82cc0168bdd2fb6f386
-
SSDEEP
384:4+QfPFd9QZBC7mOdMEqtKfpC5IgSnbmFe7Acqb6h2LAPd:Zcd9QZBC7mOdME/pC5I9nC4lPd
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000c628db644deff27fe42407db614e1dadb87cf6e1f62ee0422c2a5a4e0e334c02000000000e80000000020000200000007c2d82d134c0010b4823ca21c6426dd818af0f7a3a763905994d2509c6a2de379000000051775038f4193ddea9afeb7e75e51e922405447b41024227c1d5f92d18c3198464fcf3dbafa5455980268d20c42fa8d33005d30e3228dae28a8840dc96ecc7a532571f99c1c0d23689f5aa6ff4bfe18728d9362198dc9c069694d893a9c2f55577d5ea4e5f88a264bc21c9e381a0112af3d1fae46259779e42f2919539d98dae91feb2e1b45a343ee075ed2075b94baa400000004fb3eda1944b580b88638df070d49e268d734c5d09a4174791ffaf7affc6fe69b905e453150c0999405bbcfed97fdcf37ea0d5ad05de798249bf774bf0da40ed iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3B93B9C1-3E69-11EF-A6B8-D6EBA8958965} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000bc10ea4c7f2c99cb4b69ab54f40943924025da27843c75a8e8f2a54e05f4ac16000000000e8000000002000020000000a8371f8f6b76bd816a52cc154eba165f4283bb187e88bebf328ba9822f7d2e7020000000b10e42d07eb4a0b973b004ebb4ed93e343dac58ea192334f35297d6a77b86292400000009c93051acde56e2f74ae5a171d1f01200098eca99aa67bad7c785596476e1920d1499fc9a8c5d3c3d6811551a347c709a896a57fd47d3938d5368a3e4f497045 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426742583" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c084a11276d2da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2316 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2316 iexplore.exe 2316 iexplore.exe 1952 IEXPLORE.EXE 1952 IEXPLORE.EXE 1952 IEXPLORE.EXE 1952 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2316 wrote to memory of 1952 2316 iexplore.exe 30 PID 2316 wrote to memory of 1952 2316 iexplore.exe 30 PID 2316 wrote to memory of 1952 2316 iexplore.exe 30 PID 2316 wrote to memory of 1952 2316 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\330989e2b824fd965f19e50ec6627195_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2316 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1952
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bf67583e61cc225d83a2c5c3e763d413
SHA143884ccc4e7e0b61454eb684e00a468efc540cb2
SHA256b343862be4bdd074e710e05ae54088ee91979060dd86bd821844ae1c675473e1
SHA5122455579d358c8f892322ffe929ff4107fcb8bc402847b3ec75854597727b02657576005f8923a397286d09fe05d8a392fe606fec138700035dbeb5aaad62b7ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD533c8542690c03c3eda79ec0219385b05
SHA189b2bde6b05074f64f7cf4166833178be5061a68
SHA256237822e2429bec4fa7e1b3f61c7c489d1fde0f9680487716e09e86f547db665c
SHA512a84ab7f006fd4bc5198916dc796c653974165df0f51e20cdeb207b919b4c3bdde174cad0e9c02d2f1292dcc438ec2921666beae9674fb7e8f677163c677094e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5800a236b1b9adc5f0aa08d9fe66f1c4d
SHA1eb114dbf662af789c4e8e7e6489bfc15f1072455
SHA256449aa0506625b2a7884602f288b6e9950c452b931b9c2e5598f25c58c49ac06b
SHA5120e9dab19418aad5979526ab4bf9dc6a50a04767acf09b8314cef79227d511fb6b4bbe61bcdb9d067af41667657a7893197a12ae194b27a26a9320d7b85c01066
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a0bf70613433dc1b56940255c4ea4b61
SHA1761eea4c324c823dcb492928b4e7c7fd3ab4fb9a
SHA2564feca5c96849830dc85e029f4aa7f6a96f6508ceb3962a0ec92e0e5522f3c96b
SHA5121557943d9dc6d47d42f6e752c0459abbad08923378e42451a72e4875d3616721fccac076ed97b34a0ce1bd65caf5485940ecc57ab2f9cf21cb57d91da18283fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fcacb42223765206b14f340a0c9b13b8
SHA1722850227f4a443e49dde272340f4a37c16c72d7
SHA256a2f2e99aea906092af0193a7275196daeda7fdb8f0f9a26bf291c9cf7443fe99
SHA5126ff6728d502c5a06124a8ed75de862c3db127a80037f9d1e7904b3b9b13a804c44386393f9eb4a3fbacb8f7ffda36e927e3dcbc82697532071dad9d0ebb15766
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c8040364217f11d8285c53a55fcf4a97
SHA11daf7b250329620ab272850a991c9f580f3f0d2e
SHA2563d6848fd9915fbaf17f9eadd5703e0a227f823a8a853e8c46ad003ce0199aa79
SHA5126ab274cfc3d00b30f2d80518a1fee7ab75ef3f170c86975054dc77fc843bb9754cac498e2bb8e4e46f974fbe4a6c226d38d4793061c68d21014aaefa1e8f661f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d730a8a90788648adc4f072407ba1d25
SHA1dfe1ffc3dfe1a275f38471fc8ca343b435cd4ea3
SHA256400f5618ea0f867f6a856b454ceec2b61e206286627725814ac564031726d5f0
SHA5127c9f1aac6637c71699e73522eb70245912c36ff8dc47f95dfca865889fcf4abf3e03d43338cd369a1bbea4bd36c8c24747f0115603b0b235884cf69209170f1a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5565b62b7508138a68c4dceae5443bc78
SHA1175a35640919f40b82bb6d5dfb3b66a053c856c5
SHA2560ff80e13747aac6bf48e903abec4230ed80497dcbd65af9866b5864827eac298
SHA512bc668413fcc534d8e1a2a87af30aa73ee8435e255682c39577e1acaea539d55658f62dd5d47d8452d7b5d07b3603f1e183ea9700264163ee045c15f43bfe59f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b36d91e7f0f2fc42bb265031f6e449ea
SHA16752ebc2ca8269dfb6631f9e3b8d6e4d3c1a5fc2
SHA256a7db0e446f8bb66b817eda4b08fab37f9ddb50b63f5488aac09df67f9dad1551
SHA512d74ef77b1f8a7dfb4a5222f44854160fa340210a71c12979cbc7d9abef55d3fb2f884f4e81fdde9cee3bb0da477bcc50636117fa63bda1f891ff2e7e81c81f0f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e5b039b60e5d3fe89ec6b15168150c19
SHA1ee91243881c06f202e82d9173260ada5a2bebf13
SHA256a1df516f6a080cab9dd686d7ce1b14e473b357e80f992fed60e2c43f8a7edba2
SHA512524922022a6194c39fb44d57bd79646eb1e00cc923b8c98b9c01c18c18d0ad9359f56fbba138f82b4f63203a669b6d73e765b90605b25cab6afb20beda435ace
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD590c2eb885e0b3a7af81d4eb3428ec80b
SHA1b576f78d23d0584396e3cb6943e685ec132b7044
SHA2561e656b008cf8a01d67168e976a9a97292852d8189b01301d139aa899b09a5914
SHA5121303f95df6dbdc8aecf6d32ce3fb486387622e0861c78a42c3e41baebf7826c9881022639666299d77a634e825afdcd2d2b7821d9ded13fd61e9ff594645ea75
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54d952664bf9c618d54dd8df75a13a51c
SHA111c788b940614270be5f092f1dc9a919f8c6049a
SHA25654cb35133ca71f7e2a63cc44a9c5cbeace91fa7b75b3172e04b30811d1754919
SHA512784b3b634676d54ca8b93151376f2da6b1218fb7718873dedd4a49337d53322cd5f4bad6447625f083a346f7725b5eb5fd2aea5d771ef6b0312c1f69e2a5a840
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51896679bea3dae90cc3df43d9d2c8d5b
SHA10070c34bcd7cdc261391e521997514b24a8bd4df
SHA2567e85969463dbe218111077637fa8bee93b44249cb5242f3ecb0817fc3d774501
SHA512e98887afdd05bcb1403ff6015b4d2c59c5a2d8dcf2fcea9d7790540f6a52e96b0dd5ff56a6ed09741162c8203f0e1f37bf3858681f45369055521dbf39387cf6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5418ff51951f6a2c5608967109242a9e1
SHA10d9d8a4ff38fbd770ce65c0204e630983f714d28
SHA256d6c74ac478ebfca95c9d701ce5e576651fb1cfda73e94dc40ba22bb245c6cdf6
SHA512e9ac52d5adb69df4f063843ae962fc76f980fe73a0b36aa8cd343d55d415c08d1eab60c1f51d3b600ad78d8e38cc3b4ef8241e86aa96196ec54186255d8d9123
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a04c3a789ab1f6ea082a95e684129aa3
SHA19a8240d44d8d925af66588cd9d55761fcb37f3c4
SHA25678c765e5799b9646bba5ea146d31a073f2c7379e5689764fdd292cc2aacd42de
SHA512e0851929acf40b24104b41f7e54a4606e685b4c5164e6cbf436bad9f331f9825d77f53d582c6517f2a7c137b39cef82e2486990359e5e35bf143b8a953aec0ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54599358578d109dfd95b472cdb573e27
SHA1872a6865516f5b3edc287acf4202b36bafec361f
SHA2568d71877f686e0d31ab6bbd2adc4d818d359db036c52202ed395d88a509907a87
SHA51296edf592a7514f6703c0e654192a5afe647aa2cf034ec2162b55aa253ed07495a311706f18cc86627c79f07b085548a6bd705fba8df450ec8b62b1179788fec9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD511473795a2017147dc9a0a0a1f8c81a3
SHA102fde1116aa67f6d2f55ba44b944f418a3684f84
SHA256cb62129a7aa807015db38bf2df1d9624b2a5bc49c9b28ba46ee3620188164eae
SHA5121ea86ca812c1ee62077cc1aa7db6a856b42ce6c50fe6cfb8c5e530b042dca878075a5fbfa24d9e26e283b12e5e1dbd2dbb90d17d0315d86e5a5a5f58664fd19d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD535308dfbe7813a65a477db923849796b
SHA1fd62a98c40001d52e01ff2aa5d722409a58169b7
SHA256f5148f5664afb42ef84d0497e53ec541ea34349bd8f2873fd209545e62f2989d
SHA51242850eb0fe25cfcfe8be39b0b0d79070de28588637eb9ab9b957aeb2780ced084054518f0d31cb97c3fc10855ca7f8bc17496d125ca36c50a402b56f1251cf4c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e67eb2659798babd7f02ea9699bed1c9
SHA17f224c5d2e8c3231480ba13bd69fb70982acb293
SHA256d2b3311b05c9e996affe8dcf6f0c838d642be3c39e8fed860c4af37812209190
SHA512b7f66d7e674a8458b4f328f9fef1869ea9c2dbd2d630a764631ae656a6f4800d00240616cea5e9a030e0b5841cc217d61e3d9e36a0a55edb7ed195ad990a72fa
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b