Analysis
-
max time kernel
121s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
10/07/2024, 09:25
Static task
static1
Behavioral task
behavioral1
Sample
34243a90d265a7035f0942709a19c699_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
34243a90d265a7035f0942709a19c699_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
34243a90d265a7035f0942709a19c699_JaffaCakes118.html
-
Size
9KB
-
MD5
34243a90d265a7035f0942709a19c699
-
SHA1
2fbb5def8c6b4a903c92d1b3f295e860e75f4eda
-
SHA256
c036ff6bc9913ad91cc91d7936d0d143b374f3ea4995c592051993150dd6de9c
-
SHA512
fea04e9a4816338befecdab33ea3beebd9dc5ddf2851ca37e58d509d0d58d52543a4c08be36e7d4587c345d6ca763a2c5c4e1e47750ae8ab080ad6f28b748972
-
SSDEEP
96:uzVs+ux7LyLLY1k9o84d12ef7CSTUOGT/kUNpzFlVHcEZ7ru7f:csz7LyAYS/TqzFPHb76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b000000000200000000001066000000010000200000006ae3ee98028d782b7e99e674bde44069a88d46983e29f13242b19674a1595004000000000e8000000002000020000000156ce91d8c7601168a75a203df81e0eaeae706acb05d954661ad84c60285e39f90000000da4133d9833d8de96249a82b4e178d4926b4e26fb0f122b94c7b6105e381a8721d74a1440d9d8280f190da0ac6c0d5a243deb851cdad028efb93cd65168eb35f5efe3519023f435d92a916248952a739aa358007c1587ceda8c7945ddb7c759626f553c7e6c585001e2981d700f25324b61c9314ae2f964986ff239768acb75f679ef54f6a37ad0ebb5f15c345cbb7154000000091ed8a361fb52051ccf57e0ab040dd628f128e32abb9332a3892fd7b0f38f19c4423c07a6b468212fd3004307fe7062289a9496ece82fde8a2e4cb04b6100179 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b00000000020000000000106600000001000020000000cfc25a587f779a231c3d1095a34e8f39fb188141fac8b4d06bbae055a2242fb1000000000e80000000020000200000005aa87c57bc52f2acd02bb8a9ea7023a0b27d56067595a662c90840fa4edfb5b32000000029b5f2ae81ab7f0af16ee640dd4b12a25608eed6ebfd536c857d4ceac9fd476840000000ef8d3831aeb79714019bea7feda7f4cadb89a4932d7b2989db2c5796226c370e330f0e826a36028b88ed155dd9d725d96028185a257a2b2570bca13d1c0e2951 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426765466" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60945957abd2da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{824900C1-3E9E-11EF-B4E9-6ED41388558A} = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2796 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2796 iexplore.exe 2796 iexplore.exe 2916 IEXPLORE.EXE 2916 IEXPLORE.EXE 2916 IEXPLORE.EXE 2916 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2796 wrote to memory of 2916 2796 iexplore.exe 31 PID 2796 wrote to memory of 2916 2796 iexplore.exe 31 PID 2796 wrote to memory of 2916 2796 iexplore.exe 31 PID 2796 wrote to memory of 2916 2796 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\34243a90d265a7035f0942709a19c699_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2796 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2916
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fbe252e09200604523219aef492f7818
SHA18a2ff36a17a889a4967270ef4992554bbf70e0b3
SHA25651143b936bfa73ab7448867bb13660eb32a8b5b92bcd2427a8e3cc5bf60381a0
SHA5120adee08ce0855064efb92d269836c75234b96f4e10f6ea38dd188b1dd5712d95c1ea0700ce59e9681157f788bdb3943c314c5df2463ceb6ba4ccc794ae894b7e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55647d3a60496ef34efee43e68a38b775
SHA1822e16da4acfca078ca1eb3b1735008c2404f48d
SHA25609d37b360228d94cb1e4098fe1312f18db479b61cfdcd0c864a7b4497a1aa4aa
SHA512c303ddd0c707eb5779bdd29053ca5fb64534be8aee2ab77fd837f53d2d14535cb61a499833327b9af1fb4b5d84877289f917f720d5da6c9e23fec51c59ea9ec5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5975c7adfb315fa5306c02a8473d252a5
SHA1bc7ad6fac6330d171501a87c8ffa480da6eb5874
SHA2566f3b89a98f845aa9826ac1bc559c86cf57fb4547c284bb664a2043480421b021
SHA512187d78fc25591e2b4af076357b38413efde4395675f59b8062ce223fd1f0722140c9288743fee9fc8d061502e2d6887bd597971c45418fd6948733b6af161a9e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50e242e14319cf140a7939023a00c3434
SHA1c91254fc94a53b17ab21ad63c4b1e8ea40aa4097
SHA256d3b689d05f31de0d711941d88878bfdde2bf0c169eddfd7d9e219306518082b2
SHA512cc8aa2946b7e740f5b0e5a5842a5872480542c71d84c51adcfaecd74c1bbee764ce56a294de52e560795e2a09ef3a38a7edf3ed06d8faf80d93189e4355444f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD562bc6d644be1a2c793a1cd0af59f71e9
SHA16c6c2337f7f51261af59e98e34effa4d77257883
SHA256e204e8317ea6a3e2a26f118f03b878b7731df0c76f0943ec79ea195caa61ceb8
SHA512e1f43cf42ff6a8084e662357e992d6463ae2376235b197ddcb17aa76b9c4e10cb1ead29b37f74d1b38cb9198aa9622f67c62893fc543ccb128438e3d3c8751c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5466e1ab5f0e14f1d90c534fa1e2d1a08
SHA141b8d0bc271c0872815fa71ab46406c7be5b9565
SHA2564581f257d78f88cb0bc2e34fd405dc9427a67d0b48999594ac40cbee0eae0760
SHA512476e931a3d8ae952249283a7fbac1fc384083445a96755d7ff51c2826196840fc29ec5bd1dd5913c587eeb57110d8508e6d3f811cd5428accd1152a857ac7f6f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5437afb253deab6249682cc06c1641d5b
SHA14d74c96aecc6a231d4ffac799c40fac1c519674c
SHA256b86ac72c03c23f331299a95167a373f8a3c52697320ec58b52965be3aa32c99b
SHA5123505406fe5be445271c90d4fa37b9ffb5ad06a2a4bf734116d1b3a1e688332e6a76f219131f92d0554a704391b13b9edd3e33d479425389617d0306ca90ef5ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e0571b7adaf6cebb7a590d845d762b2c
SHA13064fdae37b5323ad28d237bf2540e7941583b20
SHA256a76dd8dbd54f53232069138c47244db668539156d83b92e8e2daf0b69c96473d
SHA512dcde6b6bd9a4e0ef4dd54923b09b6c714bf11ca3b5df4bf14e8d205dff1f8978d606c652885dd2c01b470891beff9faecfbeccbe86c12eaff7c68117e16066e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cac7240865c26ff23cc7cf7eee537f7a
SHA199480c0ff856801d7523791c4eac92e4f94f3b32
SHA2562a0cc0c1f21e3203e98b16bf7dd3a4d2ac6f255b5d90e439b042da84f17a0840
SHA5121b9df67fa22cdc0f834b42399d14fa3229d14637c16e305a181bb1156d70fe6783c4dd8c3e5d02fe159f189d6d6c0580e6f566286d8ea0a308f1443c3bac58d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5027cd40cadf5791c9a6a7b56920af4f2
SHA15aaf764177b5d16c896e2d27882ada154d78c8b1
SHA2568d7c1c9a81cf40acf1ea4da96d6785fd3f70a9b91e58352ecc76da86613153a7
SHA51263e3b3eca5434af6e5954c60a014342406066f7a4b95a7b0fd6ccc244860ff901f0a7b2a7b918031ae9f06208d627ea5fdd2cb397399256e3a71dba13b9bce13
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cd09a6ae79616af9efe606f30612a668
SHA161347ded42b31cd0280fd6fa654c0ba67e8d7c6f
SHA256e64d5765605f6db9ea1042d805bff48a0338d0d3cc7d8ed464c916d6cd411f7b
SHA51291de5d05d0bad6a0461bbf717ccf3675f99767eef3ace7e09035d90ab718a8f3069dd9d70b594a4820dfdabe5fa5d3f20071e9cc73750dbd7be45ee4bf35d386
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5137dd11f82d65e0fc67f0cdbe7a6740f
SHA19008a9d4f49fc14f2b9bd1c4f2b3bcb4cc573115
SHA256f94f412617c9161ba1dece8146562c704029581b951ccca48a5faa07c3f61bd7
SHA51229a9d944ea7951b38e51db2e54c4f96df23f83bcd1ee615b8d12f37efe9c082eff914f28913d89d20cd6cfed51c53507e7499fdae486a763996404e90f081b25
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD585acf8a373c9bcd71dd279044f6b6506
SHA10cd7017548cd2c01ac124fe0fb0e2fed0bd65349
SHA256999604b9eaab71fab59abab4b29304d6e62b2c086494f4a254b19d9ae5b0afe0
SHA512483407541e7571e367b9746553b908396bf6da0aee2039cb6d90c2718ec20ee6b729ce6d4ec6b305c19361ab294e1f8fd750778f737656ddd127e7d6a572b198
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b9b5caae9b001222211eb1b7661f845f
SHA1d3a8d6c00b546af98cd1b9445117ccbc7bc8c783
SHA256198e01dd017eef659f24fab466563c3eb1d827d2d266226dd2207b02aae9bfe8
SHA5128ced5a48c91b4dbbeeb809a878a3265547e8c37ab7d672abab9c9d8c59f018012a31a2257247ec9577780ca40d512dd9f8a8d6f1ed4b38673dcccfd386f05e54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5906d4ef78ed6e1bc6a2edd5bd07d5ba7
SHA1ad3bf07a02503951ef23659ade845e5a4e82f76f
SHA256b419e8ad999b318e080d9f9f844c2749587b1763a9f892813142a6c45b576416
SHA5128b0a6341aef9e80ed6c46f695e283b72fef0b5833f86060650bc357777660607a003adb91f505446b44bf65c781b76fb4a95b6ad3a8a7f326e84eea751a36bbe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD570a980b1dc3c8bfd26b1f559e83d37d6
SHA17fe48fb309881c9649f6b0df85c569509de26d36
SHA25601ec408a33fac97377449bc63565302d8ad14a83fdece6d0ac22406198b48e4f
SHA512acebf3c36bea7a761db9165e718efec3216106eacf5aa613623e7de36df7b1a1e41a165424be231ad4b0427a2df0e55d324174bc0f71c1d0cb8bc805b60f5344
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a55315184dcde54f2bf823e4f9a2ebfa
SHA160116ce0cbc910254be9bd9e95883f418e084386
SHA256426f00680152e31166fb1c309c2e59132fd76892e1e3639659aea4145cc94c51
SHA51296e51b2de2721b914866aaf1a4d6e5e7af026e8c8db2cc1fbf3190c10b28c2c8d2b1618e02211a29d696fb96b81b53cd083f516383d2b74a0e26e77ccd25b081
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD541501519341ba09cb0c2448edb7c24c8
SHA1dad56692cac5e5198a906262dfa81191b7750bf8
SHA256e9d621a59b6812084234413ec672d6b66b77b353228ba55ea8d3a3da38ad14be
SHA512565055955bdab10bed0a9149a88c82e2aa107d8eaf61e6d024d4a4546c42ba44585a35949e5d729a4ee389d4ef14415f4a0d618798e0a2f54ccf5ee3c73c2b83
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57104050d9057fddf2626960c0e4894ad
SHA12ea4c44f745df5f27b922910d991d73d22af9176
SHA25640aeb9ab53fb83852eb1018a70aaadfbc8408bc922de2fba3187460df6008994
SHA51215f4f33728b8b5430a06697a95fd4e2fa796641b35ee9917582aee24c92848f757042f088156c138899119174812ce04347fb47bc0b5eb248c52fdbd30fd61ff
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b