Analysis
-
max time kernel
134s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
10-07-2024 13:21
Static task
static1
Behavioral task
behavioral1
Sample
34e37e2f710f2f504165a73710c90684_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
34e37e2f710f2f504165a73710c90684_JaffaCakes118.html
Resource
win10v2004-20240704-en
General
-
Target
34e37e2f710f2f504165a73710c90684_JaffaCakes118.html
-
Size
7KB
-
MD5
34e37e2f710f2f504165a73710c90684
-
SHA1
007092372b12c3a1cdb1aca6ac2b32b17f165301
-
SHA256
95b4bc898cce22f6ebd6479f6d0e8bc3e36a7934e43aa3ab72db56c44b55d63c
-
SHA512
632f679aa246fb8ecf867f426be92484d35f9eb9c87ce0b8d9df40a72046db5b40175df1b8cb5dff088f57122a495ee9c8e0e47fd1003b51fbc077a71ccae2fc
-
SSDEEP
192:VRWVAerinGrS9/PutOZhN57miBGBceNjM7iVBjZ:VMhrinrPuoqiUdH
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426779906" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000b59ba1d59737c786a147eb524d8d16424778cf59faebf2a17d1696f0b18e77e1000000000e800000000200002000000053716f541bb6e97ac6f605c17f59b264c732481ca42571c3138d2b21dbe695b090000000827c40922aef8af16572020007274dfdb7358eb6cea0c514d549f82a0bf51167218350a764e1437ad5b1ca57f3430830bbed2f957874889133b835523a17aa9f97c976f8460ab7b4f275e7866a2f8fb1b195c9a9355462e022179989217e90056e711ddb9191210eabe1929b693c71215d938e3ca04e8fa69c2e4fbcb071995a762fdef0e250c8504548ef03bb04a08a4000000098e5ddb43e3681f74df968c0999823ddf7a6ddc7f2ae48becf2ab15601e5edf4fbbf52e0e8390b4a15e5321c6ee5b3a425220969cf156d4e271bf7c33981b699 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{213604F1-3EC0-11EF-A446-DA486F9A72E4} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0858410cdd2da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f0000000002000000000010660000000100002000000061db2eef70df6da5d945320d9d6f4d9b687aa98e0f1a96c473d9445285b565c9000000000e8000000002000020000000fdb904c9fcd9c8e09c0bf71274f0e4480356a0cd1dfc3337e198a3c2786551d0200000006f6bda08a5c3947a6aa6c32e87d4da80b1f1ac2a4d4e83a4aa53dde3fcff19b34000000041b944914f110764e3cfa06dfc21524d87cb9a31b6aad167baae0a4030b6bf3a0537d6e7a32c68469c62e9476136130f82aff1a03a2a6c96a6bbaa241a7bfa57 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2860 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2860 iexplore.exe 2860 iexplore.exe 2128 IEXPLORE.EXE 2128 IEXPLORE.EXE 2128 IEXPLORE.EXE 2128 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2860 wrote to memory of 2128 2860 iexplore.exe 30 PID 2860 wrote to memory of 2128 2860 iexplore.exe 30 PID 2860 wrote to memory of 2128 2860 iexplore.exe 30 PID 2860 wrote to memory of 2128 2860 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\34e37e2f710f2f504165a73710c90684_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2860 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2128
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD573a63d0d672b0cc68838f288dc73a8fa
SHA1b7727f1c0714eede709cfd9168e4d3019ef44ab0
SHA256cf622e8313530e5217872234e88c59b96ad968062b664d36794f9d6e6829e8bc
SHA5124bf4a98bd7d3348e0e71ff83ad93c2164bd5f1815122d3255100f30adae2aa3fd06b1dc8eb4abcb1a3bb24ae76b3d6f14ca20d5f64fda2856dac9f2c49f71375
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56fbe2ef417d629fc7fbdb8fd81e993d1
SHA1567f6fe2bcacc92229b7c6be446c39f51cc5838e
SHA25660fb278bd797ed3ba1a17aabc3af660faaeee5f9f783894d9871c26a72c1d216
SHA51285b7166d8b03223393ac787b8de0370cdb53cd6a2b0ad05fb79ce9e3ca3a4cce2f34c6167cc8c9bb740ea1cb07377b134eb02bda9693fccf14dd756f85ea8d29
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b9f2e348974394c15bedb8aa8b1b6614
SHA1009623cf9e766af9300e927bd4a5e245708561bd
SHA2565ebb0416ada5647934ce3143eb6cb12ccb8d6e013be8fbb22b193404fbe3245e
SHA512c767e96b461eb213054c7f0f37e4e6cb3348fe2f98a94be67e01f2b0e2f1fb340c5d058986c1d87734f9a281a6be791edb9baa1d5868e2854c2429481292511d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50dce1c7afdea1fdb29fdc04e8022a325
SHA1a9118ddd3b07f4b565b53208a023132474826509
SHA256365e1c10fea2d1d7b5b7a7727f043108fa335608bc26945d3188c1ef847eaad8
SHA512a9c0085001abcfeb4586918cf090de85315c86d0b98ed53e4deadff04698086e6ae2218a70473fa119702d3c2c20cc0dcaa66edaf70a7b4ee1775875700f01e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD554cd39abfb9f8a615e04434732c3d84c
SHA15e3cf4cf877a951d2ccc2d088f65ffa881770287
SHA256e51571c5b80a94041c80a59702d0fc2457a652973be33283deee04a5bb7c9ec7
SHA51256576822eb8f9ad31aa64e05ec59a6b84987abf5eb0003e0de0dce52dad67b8bb2d2ca57774fc4db4756f7bbffefb5def458852b87cb236847181259fb101848
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD554b6be46d0e3b06a38d92b1eba5c1620
SHA1a7c29a032848a18c24484b946ac62ac9570fbd03
SHA256dbd8f4abb2f5ddea4e394b0649deef67c779e8cb65860a5912e0a6355a24eb3e
SHA512f9a16e6972d3ac032ec200a76ee28fc7da203567fb2f69108b9056ddc2f0e7ec387a97d2135b74e072365c9c59f705db62e3c4bec3f1fd7d50fff7ae21ac9047
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD510980caa56ea4c420346256725573ac6
SHA17e1fdd70355b6889c836a4d4c81d88f399812073
SHA256b67c2587980b278540cf6f550295f2bdac9260e6684ea9517f690bf6d1fdd671
SHA512d0dbec8d589abee014245a5802165b98c7013b764a2864401711da79a2a3266545ab50f702a8570d53bc3a5b0c6d4cec1dac997b7a73df16a6c5e89286f2482e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD561bf32be1423b05775e69c69bcacd252
SHA1383c49aa662c8217e7414a4730ad26bb43fd9bfa
SHA2565f0f07108e4b344ff7a3d2752bc49dbf106e496bf8f04b41cef1e998d7ae900b
SHA512748bfdf1afc12d35c8a41ba3faa0a0cc3af2e49d1781eac645f9a2dded27cfadd586c6b488a728a89b7c985136964b7d013c530b429f818c529b07f6c077ecc2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c6ba47db211b2a88111c22e261e69da6
SHA1a77b589c279296e9298fed43de54f1a6a0e6b1bc
SHA2563004acc02874bd916eaa940567b0830df7347097d9a86458595f183736bdabba
SHA51200d0f545e3e293956d480eaf2f5b895d15020763cf7c22f1a87b6479738d3df598275fe7e0471c3bfca34d33f402519bbf0da18f7ed355708743f4664058e6c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5721f91d209e13e6fe2294e142a40ab4c
SHA18d20ddf29a381d685d3d549859bbb2ad46b123f9
SHA256fa9270d032f6842960972de9fa99b04a5d0f40a8695a5e53f5cf13258d2b045d
SHA51248fa286c7daa4b35939d7a761f1b8c81ba973cd1323cc222fe749e2928d8035feea89741f622247d50780736b1c5eaf37933c3ca425e912279b41a2fcdde828e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51bc5fc2c1e5fa482ce3132d020dcbc1e
SHA11dbf25bddff146d21b7cbc6d11bb9bfc54a19beb
SHA256444f57947aa6a6956e016b2dc1318cf7cde2db32519712eefed63f9c3bf7f03e
SHA51283ca42ea4e9e4f9e29d509ca0ebb532bee8b729480ba756a9c7a7b2339762fe6c5ec8ad32e7a91d1d2629883e09b336f5cdec32e9122d1f2b3b4e6634700bb10
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c18cc79cd0c464a4beeb1de10acd07f1
SHA14e58a78edda679b9daac6f5df143029a6a516bf1
SHA256bad4c14da778dd8783e77abdde3482310d922f914fbbd1dcd6ca2711b293a3bd
SHA5125564339cfb26bca71049338731bc2b22214f45099af74f3dd01dc30c2e875f363cce49e31d9e7c9811a484ac7dad74da62f1c04ac654fc54f7bcc782c55d9635
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eac142058339ed239a1578e7ac2355f3
SHA19ce160ae6df33880020fe21a604b7f579aee6d3d
SHA25636a6b53deccaf156a60e5f16d38261750cd4a18bf61eb52da27725dabf840510
SHA512090cbf91925f921588c173843d94cad2527da1284d7d7ebfc02a53f94653ea917cd60702b8ca3b363ae37e368a97d3f86d45b02db1f6c5d25aa07846cec328f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD504f613d7541ac0dddb2d0681532fffa1
SHA11ea8666af7a8d4feb8f1f5d3eae596bec8f2ef0d
SHA256610aaa00aaf5471aaa6091cd08fa568c5071d692e3cd6d117620340efe43beb0
SHA512099d692f84ec360171605f23cdef4d148ee577307e6ab82f14f0cc84cf9eca0eae0f0e18ca01353acd3e1f451a82e83095eae559cc1026f791d2a0fec0f35bcc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58874e9f4a42fb9665cb11252bdea1c03
SHA16171fe6046346ccab433344ea696507b73ca5547
SHA2567b27479dcb5455a07a09b3c12bc88f637fc2f0cad2b07c186867ff6e06aeb951
SHA512169b319a937aa65767aca8b7bdf23ed4af119f50775b827befe6a165cb596e50a1b9091576c3134e5e3cd8601527617f27e994a61b0a8bed910a8f2d3516ec53
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5abe7484b2ced7912cb129da586f38808
SHA1b3ebb988fba3c247af5280a02a641e4495325d07
SHA2562d9f3e6fa07b759b35104e74f58a11cae2aa4fdc61577c9c0e4de92a677ea934
SHA512f1de674650dda15a647f84663bcfdcdb4921217a6cb47b0e5e346bdfdf3987edce5a47379dd99609092be70234514220e1b998ddc56104b2904eeba3fe639e1d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57c519e6e69758da4e95d76202aee7b05
SHA1fca2699e8a07a92a1f5d04c01ba7c32296ff325d
SHA25626e4f413795c3f52432be70a0a5523570368a042e0e85ad8dc781e15bc9831ac
SHA51279b595538b7d8582884be7b5fcbb7cba130b3fc73babc58d91efdf7f64e7e5fab617aefa95e4184935dcdb5323f560066d277b7c3a4578bcebc187ceb06019de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53e02ffd7eb639b8658c39f33d9acc544
SHA1ccad6cd061d8b52bffd9a50a895b6a2fee21e5a3
SHA256e82fb49955c3bc494f3e680bda00ac71709b4dc99324560514f3c7a34b557904
SHA5129481c8bd8ee768157bcf24fae459ff2626bab60241b496c9cb49197837db97a02ed446911b76c4ba2d5f0dbb19452ae51e761ec8a53ff26241072bc0506d9b2e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5890ba4ee550820bbd3741fa55c78857b
SHA1fa31467ce0e0d8b585368b1fc0a3b59decca55a6
SHA2562540f192437e7af432691a2704ca61e7c5b139788731635bb80dab5c0f1756ce
SHA51276415f3a2e00dfd754ed140632c1e1c1537397b75c3e4b7b873e8f45b584dd6bb87f4ce6435db4cbb0fc93220f5d0ffa9a50dd4dc11679359abc49519792b531
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b