Analysis
-
max time kernel
130s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
10/07/2024, 04:07
Static task
static1
Behavioral task
behavioral1
Sample
333e842ea3ecb895c699b0bad009bae5_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
333e842ea3ecb895c699b0bad009bae5_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
333e842ea3ecb895c699b0bad009bae5_JaffaCakes118.html
-
Size
121KB
-
MD5
333e842ea3ecb895c699b0bad009bae5
-
SHA1
2c81213957c12ec5f51584c0929c3ec5fbc81a36
-
SHA256
4a3603f4bfea86cd31a86e19fbee063fe25b438129f03269ed08f6c23edde8d8
-
SHA512
88622acd4bc0a56dae71cbd942f77ffa017af6a52528d2798eac5f098808639e767c8c035f0d8185639f61aa789fb88782a9d5d11a862fb668f0220dc6cde671
-
SSDEEP
768:HxhalULzh4FvE7CJCveoksIY/dIufezASvNWzCAGvRBVlEkY+AgD4zR3:HbQG41Ct9IYVIufezHvNACAUBVl42q3
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4C1122C1-3E72-11EF-BCE0-DECC44E0FF92} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426746477" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb000000000002000000000010660000000100002000000075b45f4c6e0efb37fabdb8dbeb0b53d6520e47240514b33de0ffe1438a869b01000000000e8000000002000020000000f47512df8a0a1db740b5f5c09bf1a9e235714904ec449689b6992c3215951f1420000000befd54dfde2bf2e72a9a0be61152599c792a15d694476eed7868b4fe16f3cd37400000008e73bdac4483ab90ac7f9ce133100c3843596c0e6b03444e0d697dac5543d2bda6f783ad8aa8069f733a9a5f49c45e13088429e3b6437517a327a1a761f2c4e0 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000bf619c0c5a8db13076a85171eac8793d9b210ee2db9710ff8b9f620fef63aa4d000000000e8000000002000020000000b3c66391b0b95ef08b8575602a5ef2ba07e81fdeec2be0af6b5a468525b094b99000000082cfd15a6fed4251e91453c5580a236eba5429321752fd0e3cf6389a20763395614734009d97fcc74723f8f9333755acfd8ec83f77d70c5460ed68cdf467c4ff0b2264b62cc0ccd461589c3f86159dc7ca475788417625d1754fb9ee854d4eb10c87906c71220fc32227fcd6dcebc089f0e082f8c3b0951931f27a8547c9511d12e6cd9fd4b0ce0c89a046ae9bc581d64000000005741af042b424077f8e72b76809b2ec569568148faf49321714dda27ea9e3d42902e6e8a6dba99044ab9c3020951eb4e0ad55a0c54c4ee470f818d7f2e1dae9 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80adcc3b7fd2da01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2244 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2244 iexplore.exe 2244 iexplore.exe 2404 IEXPLORE.EXE 2404 IEXPLORE.EXE 2404 IEXPLORE.EXE 2404 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2244 wrote to memory of 2404 2244 iexplore.exe 30 PID 2244 wrote to memory of 2404 2244 iexplore.exe 30 PID 2244 wrote to memory of 2404 2244 iexplore.exe 30 PID 2244 wrote to memory of 2404 2244 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\333e842ea3ecb895c699b0bad009bae5_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2244 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2404
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59879faff5e9bfbe2c97e9724d5714713
SHA1f8c8da619948eb179bdfc9b7d43145b92865557d
SHA2563b16ce20240b874f4af598051122f1fa7edd6b1e4dd76291f095d8965aefddb3
SHA512ddb7309b67e1a88057762808041847c4dca92a4bbe61e92b5329403213a3b4c2e3f5a87c8ec54fbea1f851288618e83a46d62d7644e95109cc15fca480d485c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e6158cf53336ff567b9975df27257711
SHA1b810f14143977925bc08b5e83fb5eebe4db7b6ff
SHA25669e4b5e5665aec144cb4eb6757e6e8d7454760eda56c3f5f955f60cb98df9aff
SHA5128afa155fa479eec4a6a479cf2a22f7c95e74c3f65c64f0323ae778f54406aac97b5816217b9059c34d3980479f2745e58dc94d5d1b702b7947c8082f04763c0f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fe032f82f36839c06aa6c1b62f29337e
SHA1f7a0f3accfd66528e507bc91a767ba3c230f6d6e
SHA2566f651501b93c83f1161809eb8015b3e6fa9c58314373b95fbb23439c2e287a60
SHA5121f426503d0b44f5aebebabe2c0a585be36556ecd7834a6de271a59dac5fb9832fc6bd9da3693ae2da67fb766c7e67e841becfa378646b203f12babb2ece79c1d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55ab517380a46ff19159d9fb9ffbdfc5f
SHA1dc444b11b38ca21fbfe291fcf7f124c95d81dc0f
SHA256f252907ef6487bcc5f44b59e5e35b91c1933980ab33f3ee25fa90139edead8ad
SHA5123ce36913ab54519879ef8a78ad8bfd754fa78099705e38abec094fa073a9c749f0e1172407639f1b1c2b8144932ca10928d1b6d47499a877a51b8e729500c0dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5df5104a37686494db92b6f064de24ff2
SHA16759dd38df79a8eccee880aed7c8ce5c89984514
SHA25613734a863bfd408491801a272cdd5cd269709367080ac9686de2e24fe0e6cd7a
SHA512f7ec4707b2981dbff9dfa936b1f62345bbb5bcc1e80106fa73f56096ec4237da7bc41a65de514bfac63e95985d1936192c86da6dd6f1a39539e96c0d058605e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a96a90fd22bae2a3aca9161a93d9c39e
SHA16f1c899752546a37a63afe7df3a6735e48351df5
SHA2563606922eec583f2434f3c623c7f04f56b8f9710c4c591a904f31ed6204b4d0e9
SHA512dbb829caa83d25bdb187a9f9606241e355a52cb8bd21f884d367a2d86fc4abb64e6b3c569894b4bb76d5cdaa1f670de0d10fdd8cc1428599a06436f4ac24a948
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5267df221d5385559e56c46bb238c0811
SHA15d8622b3d166c60dec095bc82b3e5e03e796b0fb
SHA256672c563487225ba841279093143089f1c8c587989640198bfe438c752cfa0bdc
SHA5124f9885f2058d5eb4d46c833c42e4e234b7edc4ac1de7b96a50e611bcb36891100112b961be5ff8edd6cdfc05250f38dda680ef3dee32edb2a1968cd689f8af43
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e7f97c2eb319fad7be57548b47aff52c
SHA12780d1565b9e75297dd02e3272e416497509f4ab
SHA256b6c0164b68c17b05b99533a5ccffbe7e84117f87fed1c0a3c3877c2dc532b0e5
SHA512eb55c15596a1a3107b930a8e618b95092a818d3175d7d71fbb1e3ee42a37d3ae08dc6aa7007e492310ec6e2fcd21bcb932c75d13efa7eb25eb7001b9beb7fe81
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b17ee4ca60f82051014894d28577dfab
SHA1215ef0e0d749de264e8ad8f76a63200d76c70bb8
SHA25672c03aaa2cf3b38d0af4bf333ddfed75c74873ff25569b15583b6ceddcdfbd0f
SHA5127b51f85d6480466875b22b3ff4eb6b4774eddc84be8f41d9655fe389e881a24305a8856ac040e2b1443d6419b963bfccf2a695ebb2eb6b5e232ca517960d105b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50ec638eb6e172e050340238b20aae12d
SHA169d1d05ce3f5cf78b93a429171e0a2d3e063f73b
SHA256af6991ffbf1e86313e153ea3f1554cc305a32d2511e6b93f9b0821c61115a360
SHA5125dd5ef995cbd7cfc26f9bf49ba144699abd88114916294fb2961a5d11b6fae59fb40b40b6ced35bcd3c7ea4add6e9cb70110c44e297ae57e65fb2394f025d2ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e64215ef18a87feffae442cae6e224b4
SHA10d5814488b831cbc87bad4668961021d374a8690
SHA25655189848146eb9c64602d37037559cc0e37090ef08812ddb1f9641292f671b8f
SHA5121db07af845aa9c5a4825c0ceaa87d20f4d6ed09dc3c241a77f8f9b5476ad8fc2a6270235e76076a1afb1f1ff1dd08aac8694990aa287b620d401ec68874299bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD575d9a2bbb0bbd9a4241f307a27df016e
SHA1c7202fc86a06e8b8277eb7d3470c98add9d6d4a1
SHA25639064a46e8e30db674e893325f3d7d389e9f42de96ab49b59391a2d98c357d5a
SHA512cc57451b773dce578c2f387111a20e46e51926e673469232ab8f323d189c2e5c34e8efc41cd063c466ea14a15a4322d2558f1c8a0b259a78acc6d3e3ce846bc2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD564b13ecd3caf5bee047c205f1839a1bf
SHA10e275937db97434e3b6bec0b8d20495804a96638
SHA256213b35c2f0cf120875cf18fbd58d591305be283fc55badaafad1fb28f8e6781d
SHA512280391b14751e06321b71b7ce7dd369a3946161e16720273a6bdcca2dc61cb3c51fe013c634e9479d5fd9d3bf8f854d70c250e45b08b9e43b3fe6c48caf10feb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b7219fda3983e8f38955a05f1e1baabf
SHA137be4699ba2294bc7b3badbda0cd8c6c0228f3ff
SHA256347d90a9d2c1a0eb1160f052b4dd10d1072ac04bd75f549afb1302eae99d9c52
SHA512c42fb0aac9828d9a134defc8391f5f92d2e7d63b6287feff50b8c325d7fb2876a4607d38b49b076988b059a642504c5c078c4c445483c3f048831be65c9de2e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52e9df83fcd97f4c3a31fc4c5934012a8
SHA1f0cfebf27784804c0fb124cb0047af8e1cd45380
SHA25607053f6e5a550dacee9ef97ea71b5446eddf610781432e53c5193b2177b8986f
SHA512db40ef211bec48030937e950a68a15cbac018ab73922e383e4b12b03d26c4f6467e3019e9279858f1f5c39208a7adc3e9468adbc58b7cdf2dbed23040de32176
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5af0069a247f717626ffee62399002904
SHA133a050201feefacbfc7c456e2b08cac2dbedcf9f
SHA2561180efe1a1daae5fa3f3909320d724e99292142d2099d37d9734fa7c0eb94ade
SHA5127343dbdc547e72a040a5ca2502cc837342f977cdf16f0b7e29995b201480f32976ea7eb8280f4b8f021a4756288db5c44e3d6416c381c9f3e3fdaf49e0c165b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5df02934e8920922e7fae7c9962456a8e
SHA16d3a8f84a5565658a11c699201f136adeba001c4
SHA2564b9531a55a8130ca83bbebc5da3fa88e04b20b2cf1a95de45fdb8b5643cd8de2
SHA5124cdc2543dd61f8affb6e12ffc55dc2fb91bb81d86cbb31c311ee2b38d3b4dadd30ecc0a9a8c421f8156d172a03d61a3692b730b49ef8bcc1d6987577e2d45b9b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c9cb701258dfd0760586078be3beb335
SHA1a6f7a057ea576017de7e7b72d4067b81b626448d
SHA2560fd7c1c0d0c57917f02b68b0387fa5a8fc8817f364df461b4999287d1fdca467
SHA51272cfcfe269cc5ea90d16758fbab4613705d95ac49d5054fba89e88b01edde66ef079b013a4e991721d87c91ab12b6bac10e9a907491a6901f6d34069f0446b0a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54be21587833f3b33e0db6e5c0b44642b
SHA19fbefa3871770f401003a6c25ba354f00520901e
SHA256c94eabf591e87417ab1b0db26d515137cd652a7852b004ebb1f96918767d866e
SHA512e6fe83853da55923982c12d88272fc2d0763b38603baeb57fa67296f967558536f5e617cbe51dfe255761d2b8a55ba612630c2516c9bf9f1ab2a6600fbbff351
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b