Analysis
-
max time kernel
142s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
10/07/2024, 04:22
Static task
static1
Behavioral task
behavioral1
Sample
334826d3cd760a9c99c4e93e7624037f_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
334826d3cd760a9c99c4e93e7624037f_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
334826d3cd760a9c99c4e93e7624037f_JaffaCakes118.html
-
Size
56KB
-
MD5
334826d3cd760a9c99c4e93e7624037f
-
SHA1
9781f011df282fdc5338a393ffb3928f7e8e791e
-
SHA256
da5f3033f5a3b563e09bde76cac099e470fe4f9d148e0af63162969e0269df2c
-
SHA512
06fb094cb213f417a5326c1e6dcb0fadad3a34655bc07a5cf969e69c804d68817fa5047e431fbf3217b9ad52beabfd88da4d96b2a8cbb4b93271ffad09703526
-
SSDEEP
1536:gQZBCCOd70IxC4dJ3faf7fjfhf7f+f0WfFflfyfyfPfufJf4fjfYfWf8fhfAfOft:gk2V0IxTiDbJT28W9NaqnmxArQOUZImV
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FDDBBBE1-3E73-11EF-B4D0-D238DC34531D} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426747204" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000fb9970fe15d7eb836a5f16ca56de22896d4f76ac22ae98889b66a68589c39a21000000000e80000000020000200000007839604446bff59805614326281012d039d30d6ee231e8439f6381f994296fd890000000c17f2ce2cf6328c712d772a01dbe5f9c79b31c1e02198b60ec772360b14aace4b9e2d270202fa314716149885a3be6217c3126a80624e1471064d63ac598215624b4dfab56c3e43573be138f910644c58687d672146d116653d4eb1cf798c4cb2b45b8cc95fbde8e1ef7463b92e7ab025c7d9a59d4ad14fb75aff602c3aa613a8981adaa0a04e79cf503f4d48632b811400000001ae523d363b441ddd48c0ae8ede4daa04f173d79a7f095a8e16829cd2444a20c0641ef3d24eaeee5f3b2e5632d17f7c55ad1bea062c9bb9511250bf60a7771f6 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000e1e695ccd9d3e30bed6b18ec5613b1167bebabdfce298641cf77bf263f7976eb000000000e8000000002000020000000baf3b3b1756233efc51e10b084aa20ab677a5903669abde813892572fd861fcf2000000006be240b203fe64e8bc06120de73e1dfab0ce3c9894f383924dead8c7e688c2a400000009569fd2fe9d360e4e5ea7ec0fa7006b78b69c261ad4db2b1956dfe0181735b04c6c0f1b8fa5361064ae210ddbbe42e50b05f7297adc4842d2d1433fc50035c2c iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b048cbd480d2da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 540 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 540 iexplore.exe 540 iexplore.exe 2492 IEXPLORE.EXE 2492 IEXPLORE.EXE 2492 IEXPLORE.EXE 2492 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 540 wrote to memory of 2492 540 iexplore.exe 31 PID 540 wrote to memory of 2492 540 iexplore.exe 31 PID 540 wrote to memory of 2492 540 iexplore.exe 31 PID 540 wrote to memory of 2492 540 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\334826d3cd760a9c99c4e93e7624037f_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:540 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2492
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bc79b2b08bd7ff91d558c47d2bfe68d7
SHA1a2bf602b960badb52da7a3bf761bca3bca698821
SHA2560d310b1737f4550d1392c55c48ce1b08fcc2d9546669a6474f84efa1a8702c1b
SHA512ccd55c9c0162915a67d58bcbaf0d3663634f67db58cdd529f2699a98ffed3d29ee1b2cbc28fea941a34c4526deb08371922239ec6e109328ddfb86dca6468b8e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5661989e5d6313b998021987480b9edb5
SHA15bf8e6a14d3b68b9c4591fa900a5be7d305aca99
SHA256fb700121548d1bbe0845b5f194c40563c4bb9fe00d1f965e16845b014f75bdc9
SHA51232e7c5c3ffad054e51fd9265e32738a1d80ed93b9c655f8a988c5f64415daf77d155b53147a291c125eea9a7d8c537aad6095e8165c05863161eb09bcd4be7a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d337b5508b7b8f4a079a6aea246e26ba
SHA1ccf1b0728fc678562f1894dd801b460f4c4dfbb3
SHA256f029ed658babc3b313b29daed3a0f8d140fc7ae20f5fe7ebd4714a0dabd3736d
SHA51272284833bc1f6eaa103bfaa3ff6655211b53d967983a8a52a47576bb6735263c1ab86f3776258874d8682ff14c017f24ce05e84ab6b382bd2aeabd8e74efd45c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57ce0293ea66250b849f67157d92c8178
SHA1b460b9d12b7f1e5268b9d18a834da4f597630f2d
SHA2561c645ef4ab8978ef526bc95b1f122423d56b0db71f4a5de87ae3550bd8ea7243
SHA512c7c61d0f61e1b6c8c3bd45affd4634f9cd787cd5cece91697f9a11d5af7698527256f5fb4736f1f0dfb97cf4751330f6f7573184f40fe9e4baa075ae980c4087
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD517b1f265373c982a9477bd537aa12394
SHA1bae1417d5b94d1ee6dcf8dca52af814c010c2fe9
SHA256efc2728a63e5f32db59bfa7555b0a4573daadcb26b6eaec79b750ccff8281280
SHA512c78658b294bc2a7bcfa5e324e5ef5b253109be948e1eb5ff0d2560589ff970a1249361004602f3cdae1f583d2786f7a26f40d84506515a62314ae26f11eed0c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c3d9ae323d4c9414fb8a06cec246c73a
SHA14d8114d1ea57fa04cb06503b4c7dd9938d5729e8
SHA2568ab4a5d5de79e02687eb015a473195b9cc271bd7414661f89d57e8a5a86fe15c
SHA512404959f8df4941bde10e77b2ade5ef35b22b3ce0d80406d057b374fb6f651ac4df9bf8a665cd311f11448b9b7503d29f0a0d851b649435b09badf292ca5b2571
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c182b633999df2bb47de963dd45b9690
SHA1ef285c1b8b5a690710d67a076755662da3a8990d
SHA256cf1be42dd6b35956cfade6c4fb72be35a76c53af2d910f77ef4bb4ae5d5d24c9
SHA512933a926d325dd28bcd2a93ff20a8081017d5fbb228327bd073a93d241e31e34af286a344898c011d3259cdfdcb49b594343bf20f7c9905698e1a9614cfce2dc5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59c6f9308be58210fb28da4a3dbf762b3
SHA164409361cb5eb1987acde2f0bccde9a3f2c89bf1
SHA2564bff660e1bd8f323a6adb650681aa25e20da9f56cf3ca8f9992df3010dfa1f26
SHA512751871b82c54f7b4433bd07430fa199344d6c721c7cefa10d7327d86363a175c03dae80228976bef1ea496d5509effd59c6570175561368f33e61d7c2c1328d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58a2e510f9971c6b4b8ce8084747a1bc7
SHA17b949ba7d9e74ae293f65d165227af459c682e06
SHA256b4a2e257658262bf7cfd7d9babb8ea2ccc777444a1c66b94c6f18e71f3c9782f
SHA512b24b959639f9ec363a6d5232d3055ad1e3d1b8d7321596fa4b9999a62f394696ef8f0b28cadb6bd199e38b8df6de416269606671fbd620d66dead1faaf9ea051
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cfbea41ff14b0c2e2599b76e381f0920
SHA1ac624ed79d7ae0545efbdaf7888c6640e92e41aa
SHA256cd250238efd40a3621b3adb17cf9ad0228bef92bce95f2c601bb8e95628999ca
SHA512ded7c63d70b1c3ecb19f032e74436510abfe020c210e97621288b390b14a2785994aa3b502ee90438e6deda988ff2be702cf1eba1a3a22e74bf8eaefdd61ff15
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5342e54247a1f88cb316851af84c94b50
SHA188428fa2c32ea8c799dafa18ed3958ac2e9ec54a
SHA2561248f5798433c8ca75cdd8668609e28ded413fe5b0949fc98058fe4ce4dd71bb
SHA5125795992c244ca5b3d2d26f806921023d80b8bca6060de49e781ac36965ec08ae98f9e700d3d25da328403fc961d207a2a73d5cc6b2e15e94ba59c97b0dc13a65
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f731e4851262c7cdb63a654d8a3db9ba
SHA1f57e75034e43042c4dfbea3cccba7071a9bcfea9
SHA256e0cc343ee0575a994ba7773ef7518d89115481ab42500efc8eafd81d41583cb4
SHA5126718b04529125f4db8008c105855a00ee06f565cca3a1ddd43fd1fed59b41716bd38840cd05f735b0cdf4104b40b435bf34738022c83f3a5b4fee2c8fb827e57
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD576666ec681909c3e8c65ab7f31a53ef2
SHA15e2f0a24b9333926f124e125edd1d788091eef49
SHA2563942c9d5b25ecd0200f724f2fcd2e8c22836d81bf05de8333786ad212acaf589
SHA512ae7e44eec447122eacab84929ba5a0c2536b09d726bcf1664ee8e1e51cd8cc7f01a6893636b4dfb4cd8cd7acbc16f52ea3e3e07dd2ee6fe7f9efdc7de3c559da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD515bc522a95a2421db6f47a48ef019af0
SHA135a932c7cf8e557375b8ba244172c4abf39506f4
SHA25684b42c960af75113332d9455b10dc2deb32a1799bd1b7586a88c7ea7de59f002
SHA5121eed25388ffc10b5c5e20c626680280129bcbc19f3cf63d5d5db1656dedf437637f91847e6f1d4ec3d6bdf5092bdfdf6b31938644265ca99c782dc3f71c1a335
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5183cb54adc79827f24a71d459b3bce51
SHA141bd08cc2421ff71d79adcf14c61ac314301bea1
SHA2564d62b105459ba8bf93aec1ab66c0efcbe0a7cc54f94f7740c0c49f69217ae74b
SHA512fd2411b2069449ec40c2d2744b1f9ab440aec24f0be5905e321780b0baeaef590adafc24166f1ee280c9ac364bd0aa1e28bdc944bc8a7ccd4405a6d053aebc3c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52dd77dcb6bcd30b9a178dcfa92f2ee78
SHA1bdab6a51fa3c1fe0b43a1622f4018746673b525f
SHA256bb765b2d4a14880a806be20cb7fa48393bf741b77c7a616de7980caccb4d7746
SHA5122a4d6072b21d0d68f19fc89a5c07364100df4f34b806d505cd9533d1cfcbe856e780c58ab914619be2a5edf543acc47cc2fe414ab3cb6aa49c6b7966dce75e0c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d58f9148c571bd0b229a0c8b07d6cc2e
SHA115dfb414031440c00e19ba9df7bb757e487a5094
SHA256ef3b96ab8b2810725a92a498d9f603656f7b28b89d6c99d345c9348272a523c1
SHA512fcc0406b7b27958036b76b79221662382f2906de273ad183c037c15b186bd94dc06c4fe8a397add1941f8e5807036622d8d0d2a868969e0ebf5b21f524efb5c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55bf6393cbc4e3a98616e64b1cd69abc7
SHA144cd921338981adc6067e185ed77b033bd3f4d58
SHA256578606d9023f8b5eb11cffc7930997e7cd9ad089a1fc1b05f149610e482574bc
SHA512f0d8f4913cdd70506823732054e6cb241554edad01f9756704ad4e331b80a83a5ce195b573fa1360511954aca03ee1849986b360e81dab4cac75179aa6b77108
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD515c6c586ce605dd8310900b144f64d30
SHA1cd2f33ad5cdc211c6a171591104914cffcfc8a53
SHA2569c5cede43898da91648ae401d4dc490a1bca35550c81cfbc2b96d91770893040
SHA51202b2cc245d806768a3d6026377d935cbbbac0fd63c7010824fc7dd7954ed83e320b15024cf583bae89246e700ed5bfcbc72d7d83d69945d655df2b56da645373
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b