Analysis
-
max time kernel
133s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
10-07-2024 14:25
Static task
static1
Behavioral task
behavioral1
Sample
351a2902cdcf6d88b9dccbc06d471165_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
351a2902cdcf6d88b9dccbc06d471165_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
351a2902cdcf6d88b9dccbc06d471165_JaffaCakes118.html
-
Size
53KB
-
MD5
351a2902cdcf6d88b9dccbc06d471165
-
SHA1
b1e0bf8401f331f513389d3aa20ecc04acb9095a
-
SHA256
d5b692684c08bd31ecf584f12f5ce852003bef54b378ae903f5513fab0bfad03
-
SHA512
2c9b5743b3f7f005e01b614541d3b379212cf30e7f16664fa355e344c25ae1f68e2c6340d1e73d74e0b69337f3a023d2e78527538dffbc35420aae22c5a8c860
-
SSDEEP
1536:CkgUiIakTqGivi+PyU+runlYj63Nj+q5VyvR0w2AzTICbbvos/t9M/dNwIUTDmD1:CkgUiIakTqGivi+PyU+runlYj63Nj+qH
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f00e3227d5d2da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c7000000000200000000001066000000010000200000005c9b181b7673573e9b1e6014816e7ba7112ddd6bceb59253d321d7e7fa1093ce000000000e80000000020000200000008c39e5ada548fd909c9ceedea684426594cd73250c253d32689aab8730dd07cf90000000dff71774adbf60be65706319fa025e13be81468b6ace4d7649b0fe54c24eb73b31abf9d09f7dc33df4265f147adf223a5c56b4d30f72c48c69cc90553b359ba9874f9dac805b049b25702ef4381c918a5ea077523ca6f19d1db4fb7cb0256ea4f3ddf220a88553e8d7574f86c10b32cbe431d7f71a2e18e0f050c6755dc0c9b5d487c5ae1c161bad47354fdff0e194234000000060d0388d4a6203437f5d6dce2d3a3de8498077d8b15776c538487d4f290071b1cf658306b33d32b96de6ee81578bb2939a27fd73950e64f555482e5f650d0051 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426783420" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000136980f3a76e22ae9210cb0cb334b9a19fea97ef30fd93fdd726dba56117d03c000000000e8000000002000020000000fca93fdee5fe988d7bb25280adeffdf7f8fa2d9ccda619794166615a04f941ae200000004b912b6f8735b539a443b7bdec7e04580e4cc7d12f8f8db51ac5666d4e043dc0400000001582d6f3073c6acd451eb583813690a03f2b2a12c0b2d1ee343f8daf9f35cee311b601ad1bf161b0648cf070ccd1d7f9e8392d76926ba394767799df15b3a45a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{504485C1-3EC8-11EF-9E2E-D692ACB8436A} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1060 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1060 iexplore.exe 1060 iexplore.exe 1688 IEXPLORE.EXE 1688 IEXPLORE.EXE 1688 IEXPLORE.EXE 1688 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1060 wrote to memory of 1688 1060 iexplore.exe 30 PID 1060 wrote to memory of 1688 1060 iexplore.exe 30 PID 1060 wrote to memory of 1688 1060 iexplore.exe 30 PID 1060 wrote to memory of 1688 1060 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\351a2902cdcf6d88b9dccbc06d471165_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1060 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1688
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59e99e97b38978bec190650625fd99079
SHA1a70f0c8744bf8b7a0d373dc3bea95783ff891925
SHA256a85040b8202949d0d32a616863f0a84eb695eae52fa444d590fd18f0f46a3db1
SHA5120875ae720d61713ca391992a466b2dae455df309a16863e2d16b879385105ef25d203a2545a42cb07686f6d7503d908bf2ae35ae3d33dc8085cba78f2cad0fb3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5106e09471806ce10fe6cc486e55a0829
SHA128f4fc55a93d6115305a9291a3e4e7c509acf99f
SHA256fdfdfda068e69b21a8ba318892e076832ef81cdcc0ab7685e20b50165c9f7726
SHA512c5cbdec5984e4c5fd5c54f82d90ce96df41437fa5572dac1d7d12e1781137a7e3ada73476b7d2131bd4db7d3beb0033392164b6df2ae57e245bf5cad05d8d4bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5902c5154a0268c7461e91c52b3164a1d
SHA1481376477c22e63c086858a7259aea902eb6bdc1
SHA25668555861f9b14205c870b1d59e51fc9227b00864e85ff02fdfa4b00c8751f222
SHA512f8e263c87d9b7b341da2186e8ddff32c01055429ae3b400dcd69f4ac40d59930a94c44fdf96f8d300281461e1ada272a6de24899b1b679e583a2b85a5c18c346
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52c9c5ca874985804b0096ce98477b3a8
SHA11ca5b8fc3e96888066f5682e67f813e4903bfd22
SHA256c06341dccca73b18507747753d71ea02c738f411d6e5df30511375c0c9f930da
SHA51213bb02bf881189b9606394e5a30688f69d36009382db5d1d0fdea96fd3e437ac8e9e618224444860b893ffbe4bf2ce988735551492a71ebf163419d9744aadd3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57259b7402735f4c49bedb15ff847023d
SHA144df897ab212907c1b4f69d3d75905a2ca3257a7
SHA256f0cd4a20eaed821a7e628376511881653deee3ea58bf82a5fb7ff2e8a305bda1
SHA51201d8c407be9b7c4b6e9c0e22e63d63248e3f385b7ed287660f7ae0ee17a9b2f37df3a866101849d3cf479c022169108d339dc9f4c3a59beef7f133561fed932e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55b62bd8d5977054cb786ae9d7801a01c
SHA12814319a8649f648fdc27c354f73fb20bc4b590a
SHA2560e88e8581344270349235026eef59903e767cd79f304b9f546c16a9e1509263b
SHA51235d17149be118da5cc453976ffd6e16fcc68c102649fe438e22179a1c0d10830b1995dd90275c75bdb44dcac2e4b5edb493b64db649584ffa749ee08e6a6a2f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dc35251c2e93cbd9780b88b1b89686b9
SHA1ef0ba858b82ce7df9af86636e224094853011b9f
SHA256d816b5ed1aa880d02bd0ffd6ac53a5c89b31cf701106e094e41d5de02d666e73
SHA5126024ed5786073be89f817be1ab5fb0a51d6f741461701b100366321e8545894eb12abcd336e1f6838ad07e3a5b4857671eaf1add91508c1f0ef9cc419dcb35b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cf1e7a4a4ee02fd0cbe6c0848164807a
SHA1f92d815db10272d3a2fb53d69464554119e465bd
SHA256a66fc5216fe4b358cd0751e7b0324487f7a2fce1959640adc7f47082befce42f
SHA512fb72d6e4e47188ce9e4e9cef1776ca45acc1461583460c697bc060b0ac12e64494b88af0e00c60b7bb62a13f33cc8e8305ffa6b40025e2d298a158c6f82446d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD544a96df47d7b9e586488e5519d6ea71b
SHA15e245f26abb096035951d995df581c7f45f687e6
SHA2562a73d2d2ad7d6c01bf9a33a56299dc955fac91d779fb357dc73ebb3395f641a1
SHA512713bc95d6106babbe0f56287a7e78f550464623c97ee7d6d2b044e6eedff16688db002f3a8fa3e36052d621db39f1485588cc1edf23483ef75b2c768f2425f38
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b6fe0c9f248e41bdfb80ebd17f8bb630
SHA1ace7e11a84b7ccc7973d867022bb616c86bb083f
SHA2567adb8b69c5cb0441fafb875dbe162a8cb6df53244000896be977389e682b395f
SHA5124b4a9a4d47f5395ea1b9c0becd6acb6cd0e0ec3da4d92e9851ce1b379c4bd93ce018e199d70bcff4764260db657f2a606c258e6410a5d32401a129b81f1bc546
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b1cda10777ffccca082185b04908d40b
SHA1cab2435737a64ecb675bcb8589c1e61ed4086c4d
SHA256891e9e1aa788c13d46b9ad6b3484e4240e623cba06a0cf008b1c126d5d37ddce
SHA512d66a487e842aa185c1f069e4e35b66795f3786071034f21aebec1b1d8f4397bde77a3bee16652f0d449959fc940e61736b145c5bde52a10c4fdeebd1158736be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a69729ea40ce21be93d5566e9af22aa4
SHA1938bb524bebb1bc5754f656f9f1274eeffd6cc4a
SHA256cb47a6011bc6933f1351c10e61a3bd6595dbeee458d3303f8b5d92368d9e254d
SHA512bfeae659d0bdacd9d72feeb720916c557f10a9f702fe235e48b2784571a67caae7b7f78487e964f4dec1dfc29bc094928a593ea538f52fd066a49ea033b48d42
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53fa59cc5975d509315ac233010e5d45a
SHA1ecb3f616304863f67a3d434774e28b43cd5f9505
SHA256a5470c01537f240485f32f6a1ec1876a1c7d7af4c935ce1b181937d3536dbcd6
SHA5124c9a9ec234241f69cfeeb5b2af4e4af1ff60906b49a17a56861bb8919810389e48047287093022a3fd6ed3c0f683d62d2e8740234358c13b3a9a32282cfab716
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a78710b66d538c042d4f7e4a204fe0c0
SHA12ac9f33b4b3cf826cda023d91f02fe5b1fb5d053
SHA25629a69a25a7f3f9d81c23bce119cf92728d613e973ef2e583ca318b7f3660f918
SHA51224bf02dad5f46a20fd8c1bda469ae6d8efc372aa1327282d213915f3b5e4578db20ae559de83c153d47a55bf4434ba866dc1f9fa8a918e944c3163fb091a77a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD525aa6077aa6b5b2cdd39993bfb165360
SHA16f36b8bd9c89f78cef78bad20e43989b90376834
SHA256b2ec30be43221b16c069a0f4d4ea5792b5ce00b51fd2baf1b6fe3771878e34ed
SHA5123113c2ee363ddf6bc3307f4a96e31eaf191a236dd0d08f124dadee6ad1a10d1c81558854e9b716ea3b3e9042b25542b81dd97922acd4992823f4ec07c4934a26
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58629e8871fbcbbc76beced9eb3c140c8
SHA1d517f5bfc1ef7e7b856867927c236911679ff04b
SHA2567b4cfad843f0360e654c0408ee328d5fbc1eabf846a3ff06c67569976de3b69f
SHA512dee350854553c0b4eb40e8bbea584b98119cab3c2ce176092e9ebc8a77938214247d52e297357f1fc578a7d2783da7b3b42dbd708a5d424d90202fe56fa5d449
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD571c9ad10f020fe860db631bbacb1894d
SHA144855e3e3e9b58bc47634b779c259768d3244a0e
SHA25612fc27a3b11fe8d1c8ac15db44f04371c9f732078344ff97bab885a68660955f
SHA512da113747ea6f6d81bc799c12e4db306a7ea7180aa513fa9a699cf734a7e93031cbb65eb4398d6b610a7b77583bc60f8eabab4220b6e6d813084e191944ff6e42
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cc239bcffd49d1e9dcd0d177c4dc144b
SHA15c8cfc3e4e85039976913945ceff0dd781624169
SHA2560ba5f6356534500164a380d89f6f8b3c89e4debd177c0189c6a2072805538dc9
SHA512340a3acb3123b5d635ee08620082502c97f8db56530357748452f627e1b303bc6dc4940f558f08be651e3e5cf6b47b128b51dfe4391c9663f3e0e1745f005d7b
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WNZH54VQ\upshrink[1].htm
Filesize706B
MD567f3a5933c17b3ab044826d3927d0ba9
SHA15957076d09bacaa6db8ddc832b4fd87ed8f05f8a
SHA25697e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64
SHA51203ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b