Analysis
-
max time kernel
143s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
11/07/2024, 13:22
Static task
static1
Behavioral task
behavioral1
Sample
394b902051e2aae0de0d9010ee770b92_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
394b902051e2aae0de0d9010ee770b92_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
394b902051e2aae0de0d9010ee770b92_JaffaCakes118.html
-
Size
57KB
-
MD5
394b902051e2aae0de0d9010ee770b92
-
SHA1
c77d864d1c403eea3130ba05bc006dba1396af9f
-
SHA256
5bbb4c49becf905bd10421216d4bab09f5f961dbe5ae590b4c5b78da3aba4ee7
-
SHA512
f48ec7700accd305a572ca2d1eb581f5b6c27cd9686a9133721c176d2484d8c8c5694933781ef65fddec94c6c062423ddb460f74a9ceeb616afc2f81ee651ce3
-
SSDEEP
1536:gQZBCCOdn0IxC6+bZfDfffgMf2fZf0fZf/fqfefnf9flfnfXfkfgfCfUfBfHfzfJ:gk2l0Ix+rXTuxMxXSmvldfPMo6M5PbSu
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf71000000000200000000001066000000010000200000006165d82893f9aa7adc436683bae9fa8e5fbc62e81d230db0740ae86cc5f0a8d0000000000e800000000200002000000053ab08e565ece6403abd6ed0a4bc80a3ee581ee0e741596e779b520fb2618d9820000000bcfc075d7fbbfaf298b28fbc294689c04133742471707927b624f80b981ad2fc400000003aafd43d3561b3452c2de8147c357579a3539d213c57cc76465d6cf0c4c37beae9c75332a32abfb80d262c75114f73b6ef10e25c91c7fb310c223691cda960cd iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426866034" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0ba2a8195d3da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A97B6851-3F88-11EF-932D-5E6560CBCC6E} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf7100000000020000000000106600000001000020000000efbb50bbd24e20ea89d8f2886c4bdbf9b355123020edb65d2b324e7a5fb8d607000000000e8000000002000020000000e9ddc9769a992894ca13acf0f9077c6c2db4d9e15ee690d8837cf6e8a6e59eed90000000ae22644aa55e21cc15ed1c06ae60658f15c68233aff420343c126f6cb5f6fe414dd27ab1bec5c106d32d2471fa6055a16cdfa8d74ac9dfc7fdff413c45739b6932ebccdd35edd627bbb003982f19346eb3a5868e728a01aba03540051061624073ceacd6af41d0942b3c34d540896acd110bd99f97eaf8297d866d0e2a6acf9686d4f9ba48b51ca9cdbb2a4d1e2a01f240000000d2c6e47c4b0ea55de5c48da6e7b4436ef1dd8daceb65a9b8acff81ecc5e6d1c5af6f8ae16cf5262500097cd4fea246f5685f11b7fbb1cc610f69e909ef3dcbe7 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1948 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1948 iexplore.exe 1948 iexplore.exe 2256 IEXPLORE.EXE 2256 IEXPLORE.EXE 2256 IEXPLORE.EXE 2256 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1948 wrote to memory of 2256 1948 iexplore.exe 31 PID 1948 wrote to memory of 2256 1948 iexplore.exe 31 PID 1948 wrote to memory of 2256 1948 iexplore.exe 31 PID 1948 wrote to memory of 2256 1948 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\394b902051e2aae0de0d9010ee770b92_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1948 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2256
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52fddcacfeaebb66ee4160602e8245531
SHA1aa9568972cc942f1cd7490176f51c763bfd55d24
SHA256db684774653db8ad0027b63bcdcf683b09bb2aa21956584a0ac7b41b96bf41d8
SHA51246dd657f394a222ebb95135f634120886794e7d5d7e09b30575dfe2ca030286b7d8ec4cd7819d26c15351520df1afd99d042a6173d04121cba42a23998a2be44
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58aa45f4eab787763a91de323b8021aa3
SHA10b1466188197cda9d083040ecf51ad42cab8f00c
SHA256c83826dbadbe41b9fc8d6ead981aaf9ad42fd8e894ee3e1d3d08a327585a2c3e
SHA512f5b8e8907e5fb1ca623da736bc36264d94f2f7e5472bc244750a0c9c468aed76c2b2c92481fe7ff655dd7d4b6ecf2fdb36c120845f404522bec6078146fe7d08
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD544b073fcb5cca07e252ed936a467b9e1
SHA190527c9cbccdfa2cc7f7e38228ecbeac2ec9bc73
SHA25697fc458ff1cc947792d4b33f7f88008345e891eac331dbe8a36f50feef69283a
SHA5120697bb2aff36cb4ca54ec3dadd6a94d0fb6fdec642b1f0542565cb76039fa63188d0443bb9672529390381b20407586cedd6051fc94f5ae012981e2fa5258068
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51ecd15c1d44d9f80e5858753d66225b5
SHA13a97edf31781c74f9355ffa705df81f9d804862a
SHA2569d1cc2ece9fe58a3289fd7f720488618f838bad641cb4e9db37b01e20837e2ab
SHA512c172e9ecfd5d0f21623ab5d954a3b66f13b414d39a4d5dfd7df8db77e92c035ff50e3823acd8e122670b3cb02da254fba1a429cbd3aa26c5aa58222adaa83a9b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5de641c83ef39be4430b8db15a33c584f
SHA112a1b4bf1490b6ff3f12118532b93d1d342b8f88
SHA256acc346619087deb53846deaf88245320cee96480a43f6bd49bdd4736fea14479
SHA5123e22358b6e02a77033396ca5e262556ca9ad4711824666936cb95e75f5c2af146b672a61be85426c64ded1644ab180a30fc1c0c555cb851601bb74eab0ab1f9e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54a97a38f5fcdbbd1932da08b90725399
SHA18af66cbdac77c3c226483b9f824ea5bfef630c6b
SHA256f9e070e9e82799d448f9bcafd2bd5e073e787c87772add5c39d43c4dc87888c0
SHA5121a75d102472c81d286bff527a9583ebdf1f99ee143aecae8831388f44f8452c5f587e22748d0ab004eeac910e1ff16203616d3449fa9c6a71bd530c3985bf4e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58f7642224a09a4db65bbd47fabcdecaa
SHA1ee6bd6941a3675dd22e50988a2241ec9e4c0e4f5
SHA2565c16ec5107ccbbe7e493c4e740d61baea3996969a45d2de87ab959b6b2feda5d
SHA5127c423f1e2a4efa8379ac99c1ea64a309ee4a72d0766eae816f3136ca2d6834179b1e1089326761e9541a003193f784a5ec362e1fb4a38f496c3d2c5c4f7560c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e4e42f4fbb13ecb2e637c7eb70211204
SHA1c2e843b489ab33032361a07459fe31b535fc5be1
SHA256f5b8a4ad80ea2e580a1af3e08bdf4072a97afabaef8806517022a9f952b43f7d
SHA5127a45c46eb3a6901d28dfe93134345090876bb469a6dea4009dbe2360109643f1c3a048fec00122d70a78372a7877fb928aad4eed3b546181e617790bd1926407
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c1fc43c46129484fb70a65f24ae27a47
SHA1cd89b9aaa8dddeae528c70681ad0bb5b75134032
SHA256ef0a3968204e61834045884600be96e40335074e83c4527d915eccfe84e0ac64
SHA5124db8d529341fe36d16b93d9687b72f427cfbcc9b172d628dd1b84ed580f44e41d91085d582a22966ae46f4a35cee4a12f78a5a551aec31b6c459c0cfe5000473
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57529871a2008497eda608d15c12eb149
SHA19ef75986c9d67028872f16be4451022692e074f2
SHA256332ff41ead53773271d9efef591d117d34ca087ef8e03f55e8c4ad340ffffdd0
SHA512c677f1b95fe5fbcc8bced8f896724fd3caeec7dd929ddc23740c32c3056d18b69d423f4f0ec399040d5391bda0f0156f5dc879924bf681dbac6561c5bc4b71c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD530425a1f1e4aec54c03c78a4132519ee
SHA18206dcb3445bc0770843f321e8b98a5cebc7cb99
SHA25654242c11e9dbbe6ea3ea44dbf68a79ef15ec3bcb832c80e84ce7b9fd00adbe6f
SHA51259c930a803bd0ebb68860d9444a227d0e0eb426356b293f069fc684729bcbc437b4db5aaae62ce5676bdc8c664cdcd7c842160f325d5f9f1715a6f70293231dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55c23af1390f60ed909c14a94349df96c
SHA1ee3fee2dd528c94fd771f8015a230a377706534c
SHA2569ee2ca3d200df230f78b3b96a0aa5577c953774988d3ea8bac124fa7d33223f7
SHA5121845e91efc3de1a1a730c8cac009a34e46424377748cd97218af4448a5f2d538cf9e6d8a425f8dbade87d32ddfeadd718257d0bf9e20e8aa28861dbc727bbdb3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5866456f8ee87139b74a97e3a8ca693dc
SHA156cb8dd6ef041332992c942bccd05e5e688df6a0
SHA256ff606f709224bae27e16bf501180b01efb4a991bf2dc419af8e65abe2cc3c091
SHA5123f37400a16aaa97cdde94121250030fbcd860c79efe8877d28dc661f60404ec4d4f4ffbb030ceaa9dc6693da47abb980f244a1f224798a8fbd72f29799935143
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53fee2fd6261f32d7b742ad998bffcf3b
SHA11e34575ba0dbe43af24797619be7065035d86de0
SHA25634a3fa5c06a3c5fe11cf6945c427f3d4be8c8f607c7e64f8ab85fbd4f56d032b
SHA512f52e1da8777985b1cb45fca86e48404c581cdfd8bfa282595523665dc83c676a9a7f42877bc8a296beeca2f3065a8114eefd59b7d4911066f70a02f4968c7d9f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cd597e86384ee88f5dfde8f37918d684
SHA197d158a785716720e60a7d648f44334981aac399
SHA25619d784d4ee630a789d7ac577bb5fd68de07ec78c08ffdc5c4e32d400de425fde
SHA512191f5c1a535e5d68197c21e9f5c38220a2aae2f8a047242c5e4795def66ee3511ab72fb49861e591e0fa9bebf39bb1c822c274e7182d9ce6a70dcf72d6738697
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD568caf4d86eb6ee06a4c2500b59a64356
SHA164a99c1fcad6e60b595547c5f94c749a2110338e
SHA25604436d257306292184b8274b5a843a209ce3456a0f8e0ef2360b5ad86a6c3ba8
SHA5123de675ba216471c740751c451d7d41d64f126331b5a41565ae76ecf43ef45b252038f7909e6f88dac8e0def87f773d3df844d8f55cd9a081136a7ef39e5e7948
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58f17ec82c673510a972b12baaf619736
SHA13b327716b5315e09f844a5e8d895b0c4e27bd1be
SHA256b628d566bbd69979790679107aa1a2ba91d8c654df4407a332bfcbdc20bb50d3
SHA5121ce6c93e5d8a07bd0c5f8a4af0f539137dccd55f7cf62e51846db2e0cbc839968aa53f5e6ec4cb6eef786322a735adebfbf0abda1e09e3066c36691ca9cbafba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53e275a5e5f6ef1d33329e9bda44b58e4
SHA1c4c80ecd38ed2b9a4a437bae2842c812794f77f2
SHA25671243a8811dcad1699ccffb86cd6a3d0203e26a04222020bf4d589629deab559
SHA512ead2727af25e99de9b1c58e6273a538ea8b111606676c6808f4d5d99b114975acd20d7789c28673195f6c743ae4a3829685ba3ff29dcda5b75d831e62c922380
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50e3f75fa3a9b23026bb499af4e8627ac
SHA1b6a37fcce094641c3d69c069ed9c54ce4c733def
SHA2563d04c0fd9c095e7957b644f1bc15d26362a353b726c22fb3cbf953a1a5ec5e69
SHA512fbbbc728d1607697bf03b4f194d55522cddb266c73e847a950584d3e5b417db5ecf47cb85a5d9fb7ed7e0d293f95dbb74f1ef98579e3ad3f2f0672207da8edf2
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b