Analysis
-
max time kernel
143s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
11/07/2024, 13:50
Static task
static1
Behavioral task
behavioral1
Sample
396599c8a59348a5e0cacdd8f4f16211_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
396599c8a59348a5e0cacdd8f4f16211_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
396599c8a59348a5e0cacdd8f4f16211_JaffaCakes118.html
-
Size
111KB
-
MD5
396599c8a59348a5e0cacdd8f4f16211
-
SHA1
b71fcfa03be6199901e778f0c3b6870d487c1736
-
SHA256
a6ee79afa504765f8027f7d20bbfab67856737366e415c1309dae5c531c60122
-
SHA512
bc52e1aac2ab4b6029cc02bf76735774226696ca07b2c816159e2db23b407087844edeeb00a82710aa07d5191487e298513404411b3778b330a86f444400394b
-
SSDEEP
768:STODQAJll6O6hD+GkkjmnGlqTAePXmLbF0lrUPwPErxMvqUdwas1HFXVRbZZi:SDq6O6hCZEkGlqTAlFc+wPOMvfe3XDLi
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4092d17b99d3da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000ee9dd40595b03ff50d5ad06e927db03af5d8d5af7e67a67fbd53e5bcb2a963c9000000000e8000000002000020000000f2148940ed683c99be3649c5c559469a4eeb5071e1e46d39e4bb9b1237baaf5790000000823f11213ac8f0b63089d364f227eb73926e685dce32544fa424bbbd7ec6808392fd287caa86cc27938d233e2c9f338c790b6880f63a05594ff5cab7bd62a65d1d39bda91a5f8058da4a10865f51f491f26a0eadbbe1f85a1f9a786db57fbee4b63fd02d1935b7c810ad38fa7aaf6c36c71050345d6dcd9d09ed0ca35e09b0483860c0c0425cb6718e4272b57490768e40000000904b9c5a6297cc128c6fa3eedde5845f0f6320a632045b41a45949d24553f333d402a9c4ec2aa821b6b2c0bd4d132ee1a3f2ee7e0dd6ed808677667781839096 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000dde2038eafa666604b94edeb0ad94680721a7a99ec676f79bf305d38cf3c436a000000000e80000000020000200000008791d8a23d692e347b2d9ffda843532a05fb8a7fe5adeb47e7e227f88242758d20000000174061ce2a89c30bac23b963d8a3d9502b2bfcab07bffacdd50eee53f4d22a244000000070972a062c7d2ffaff56889ef24d78bcd81ac0e63d122fb1177f76edc351a7d889dc23ca5f6765e4c55cbb92c5993366ca24b186632977e64aaf86dbea69e06f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426867726" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{98A52DA1-3F8C-11EF-8FA3-EA829B7A1C2A} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2612 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2612 iexplore.exe 2612 iexplore.exe 2388 IEXPLORE.EXE 2388 IEXPLORE.EXE 2388 IEXPLORE.EXE 2388 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2612 wrote to memory of 2388 2612 iexplore.exe 30 PID 2612 wrote to memory of 2388 2612 iexplore.exe 30 PID 2612 wrote to memory of 2388 2612 iexplore.exe 30 PID 2612 wrote to memory of 2388 2612 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\396599c8a59348a5e0cacdd8f4f16211_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2612 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2388
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c5cf074bfefaf26cc6210a4607ddcf8a
SHA142e89dcf4bf746eac818b58b06baf441c51eff93
SHA256648d54ef6070311cdc90bff664cb3e5dc0be5ab3ea74494953a6277363eb0bbf
SHA512bb781052d55fd2efef54adc658e9c3c718cdb535ef51612a02b01b82b669f40824c85ca052860ac95dc047e68185488bd17a75b21bdfd3364f4ab1b1b2784c44
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD527c27505dca6e7eb68388e06030e10f8
SHA1d122ffb871f25bf53b421fed5358012e1e17a478
SHA25654e671892e8e5be9081f2a4f91d934c2499ed8fbe07b109596257bea44fcaa42
SHA5123990d9f8b0933907b11cd63d8ff71b1427b1617dc21850956043c0cdbf580adaa2b0ba992736a939b5dc221bb93a1cfddd500c266a66566b6bf97ebeacd63331
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5181ca9d19a550999692ccdf8dc8e5c6f
SHA11f7f62aba3920c211a72dd2d1f853ce7581040cd
SHA2565244a37c947dd622e4e2fdcb74e2e7b87693e8c9ed2a547b72bbb45cd3788f6f
SHA512dc48d0c7d29bd24fd81e81246f9b3d5db3513caeb52521c89dc5bed9dd6c037362330b296302707cb76d528e628437e74671517d23379d80b8eddc34818dea7d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c52cb418c0945816dc34aadfb19315ae
SHA19387d81ec8d38a638fe6de33469dea939071d5ec
SHA256113c291ae290619b7ab9ea95c03caac393f4f2b320f227dfab74efee0211949b
SHA512f25db724a7508f43d9f079f543592612f91ca197a76cd7f76ef838cf36afa5f745f2154c0ad1d27e33b4a1d9e4f55aa869c70dd14ac05e79fff7af5107891074
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58fd870303859682a77e02491e93e2db3
SHA1c3ce8fd93cf7172bd81b042aee08db2ca45fb9b6
SHA25685f76038064cd3d4d76c5a5a1347aa18fb1dba0f1d0d38c23de64692a2018a6c
SHA5129777670fd6c6ee7365dfa9f009aaa2de44845d46116cdf8f90717aeecbbba8c558f48252f5dd68c599c5aad908a87a09f57d04cbd2418132da6d35071d480e9e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD578f701e8d6ac2e63df200c4e0d543c7e
SHA1939c6d2875fd2c1dcc40c137051619b3fb8ba745
SHA2565726fd0afb0428f52de60bffb127cf4bab91e68de2b348f6e3d61f20dbc6bdd1
SHA512b6e61ef44de6fd3128b3dc2f3db3becb965d04070b94e9636c5a7069b97f283b20013f78eeda4bae3072619030973ccab31d2eeede5eb4e7972a4c8d016a9ee6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55d6bb550184e1c1d23851fb5f9ae6482
SHA189f3dfc392e8f5b4a35df6d680fff3aaeb18b7e9
SHA25662197620662bcf0dd41138c4f300d568619f0c1bfcc1edd8975dfd5e17de277e
SHA5122b20d2e33e33ad4c4d94faf9078af12712f3a4a3bb407e59e77a3a98f6164945544a86c96b78447d05c6f348704b465453849edf623c63004b6098a8757dbc42
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55c2f6bcda9a5fab95291fdb33082c52a
SHA1ad3e19ba84b6d20820690791994f54f48b71491d
SHA256d2e0addd84071724065d1d15a87c0e8d3efce41f93b9f30e3c5681f6d6acb0fd
SHA512919642c8fc746d612266a8023b7b77fd03d19f9de778a1139ff5134b94a3c48ab2b7662c403dbe8bfcdf996bdb34afc1fe36c288babf9b1349743e8273ebe209
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f4c98cfd16bcda3606bb85dcae9654d4
SHA12519d503dd443cab73bd745f7986df8a6e08ce18
SHA256c295a221ed0ae37369b6d6b939b49e240c01e07e316a0055e4e814d199f9b08e
SHA512f00a383d857d2d0aca0727226a057ab1c7f6aa24418c55e7398946fe9c42e24c46f5b18ba74fe06508d8fe4457592aa0ee6663e13f139b7871da0c3a0ae6c53c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a891f81525a17bb05e3a076eadb47d2a
SHA19c7a654b59282644eef5a65ffda0225e4f2ced86
SHA256a6bf1f549d8b820d78547bf8595cc1fd25e4f1fe183f9fdcd4b295a33ba5c444
SHA512a653294bccad8350f1469b861e6a7d3a32fcbb26d95dbca4c97d9f48ff7244082ad09dca1215b437b3a98c7023307eccd7bf87499f0a2a94ed4f6ec91bdad365
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD547ba4ff697fa6a2c0d2ee79a9b034efe
SHA176534e3fd334aba15656de84a442e9ce644fc059
SHA256cdd020b98f53c8f8d397b005d9c105686d8880493d96c53255fd01fdb203fff6
SHA512f384dda7e1a52d2c3dbc819e21f94f98db6b3aaf71d92992c079276de7018140dc0ce037e0408121de9a1e1cd7c95169101bf565d00ed5eda8b4f782115ee0cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5637939e9f94ecc190dd0821bde5b05f5
SHA1002c70acaa8f6db40e9552933f701628262a482b
SHA256d8436a8b9560b157adb57fbbfbab95c9b7e268bf48fba7c1296e2b07bc308f9a
SHA5127e9e6331b46f283d3a161e2338987fbddada6267ebc25ae0cdd6595fbebcd25ff4abba48a13dccde6eb8af0787f494a21659c9f59b27b4e11504c0a02df749fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b0823c306f67ad5fc010ef0488a2b8ef
SHA189a476c095581d4b9eef85d460bd27562220b191
SHA256f72bddf2a7f224f73634cc558f0354cc6810d3123933018bbad89331e8ac8a9e
SHA512e095dc6238d83b02750d8f94b65194cb00cdd7addc54d77751d386d6476f553bd755bf2a766a0ff7773c9aeccfb8a4d265e4f547b4c41bb6989b63ed9afab32e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a2168f95a99bccc778e036d3fe089226
SHA177c72ab34bf4b15ea05ef7a3daeb0b424f9de866
SHA2560c103b001f0c7296eeb4a0583d1e7006f06e5e9f06ddec8465749736cacf8fb8
SHA512b49a110e4426d45d58416297a9caef3289e774d6009137b7dfdc5a5d729a88a3ff6853deeaf18669c6ffb59e2141d700bb96e7f164f78c72251a06c5f4129a66
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57e9ae968690e3bcdeec4c37ad515001d
SHA18573baef3025edef11ae13513ac181e941848f90
SHA2560a210ab98b88f2a40e2f52bbf0daf99af83e620b907700df7e72fb6d73c66643
SHA512b77c1c4f7a38c26fa4e00e6bec610aaacf966e2b740f24ba7cc6ca7e4567d4163b879297d225b696912e8ce780121e5bca9c67ced776f36d61de7a0167bee9d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dc9baea0ee4162f2a7b02d8469ad167c
SHA1ebf2e8e929e6f51f38196cb111dc5d8a4d8c1019
SHA256c5f9bded7e394a21e17987ea128f93f1c810c74e7212e742bfaa93f8aef928ef
SHA51258346df0a1cb904a7b8ea4463ea23dcd3bdf6f1527bb2c5f4697aeaa762b9ad6fadcbd1eeaa670f2a94cda4dd63b8f579025a9caad1ba432c9e1bc2f25a081f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59c69bb847a6cc046bab79dba9964bf9f
SHA16ee508ffd6e147e4164cf703933d4d952a63c727
SHA256bbbe79e974e4ca7c8c05f849775574b56a89afd38a2576730d42101527001155
SHA512d233b19a497853a7acba987a397ed03e0dcc6649472f7ddc819e01868ae754ad95ebf5115977078b3a1ca298c8ab0588719747048d0898aae85c594db9ec01ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD506f44d9ba51567628b838ab3984b70b4
SHA1ad8522361c9ba8656dc5ffa966fee528fb4a63a4
SHA256ee5fecc0947274055d77fd817bcd1e592fc5a00d6a9a74ab6a6af462abee21f0
SHA51282fdf4ebdc41075e133a3dfbec923d1b057f8448e1c7d01e835977a37f54980ebfd2139feb9a01f18d432ccf9b7d1efa663109818e60d462279a85fd0cffd551
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b