Analysis
-
max time kernel
119s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
14-07-2024 16:26
Static task
static1
Behavioral task
behavioral1
Sample
469afdab6dcee1a243493cae3221564c_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
469afdab6dcee1a243493cae3221564c_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
469afdab6dcee1a243493cae3221564c_JaffaCakes118.html
-
Size
12KB
-
MD5
469afdab6dcee1a243493cae3221564c
-
SHA1
308ddaa6dd33223a3eb5411459f63d6c6e5dc2c3
-
SHA256
41a0769682a30a542d6dd022497e80259f87e9fe780f6024d68519290da4d24c
-
SHA512
14e5f96b2b828b098fbb089876906df7f6c5d64552994cb011c13830987d6b309a94749dc7b339940bc4237ad46c118854902931769c93ce9ee126d5813e48f8
-
SSDEEP
192:yRfv1k3x3UPo0rdOxLCA4Sjif1tO0hX6Ghd+skF:AkB3UPo00xL14Sjif1lhXmsY
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D17229D1-41FD-11EF-BA91-7AF2B84EB3D8} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b700000000002000000000010660000000100002000000065f42f1306e8d9547fbd2327c70813893f794b7fca15697b41f15136772c1cfe000000000e800000000200002000000067a635a5143eefc3155e6592da81923659ba9aba8a145297957355318ca424932000000068cb0672851636bc537edb18af19062ebe0e34c5eefde65935278c72cfbba9ad40000000f66572874276a3449b5b9b213b613ef2373cdfe622b91193a2501ce37c242203f56c763984cfc20acea3009acc8dccfcc5538a76728a6c77d0c61f07e9398678 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000d4082c5eb12982dcc9957d5b5e45d3987e0013a27d27234048a95e0a9240e98f000000000e8000000002000020000000e2b0d0199212ccee3dd6ad3869cdd29c1bb76c144d61ee23a9c0f463982cea649000000065b5acc624f1759dc58f59eded60c55cd94569a9402e480189fc61e8a8d7af1a96c685a263392caba201383d7a6002152448f8512382f9c416273d49cd83a9a94006988da09044cde2f962055a34b6865926fe1b768d07f4081a3333b96dc0bed537d54299283d7848405570f7f646713fa44632399d461a5a9c0430b63b92a4195da592fd5d1a5152a5429952ea4cbd40000000aaad68b0edd518e96a6a998a2eae6a9b65c0db4ad417c8fdf80f8f29fcd0f3b022626ee06405583f2dc722f1f8e20fec7fd85c838a71fe92135833d9a53796fe iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427136255" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20d25ea60ad6da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2192 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2192 iexplore.exe 2192 iexplore.exe 2272 IEXPLORE.EXE 2272 IEXPLORE.EXE 2272 IEXPLORE.EXE 2272 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2192 wrote to memory of 2272 2192 iexplore.exe 30 PID 2192 wrote to memory of 2272 2192 iexplore.exe 30 PID 2192 wrote to memory of 2272 2192 iexplore.exe 30 PID 2192 wrote to memory of 2272 2192 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\469afdab6dcee1a243493cae3221564c_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2192 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2272
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD535c883497f7532677278d64cf81dfe3c
SHA1331a9f2bc2dd9e6169345b7e554297c5da187a7e
SHA2564b6fd3fb3d30783e5bf391b6c8f4774e95d72f7a4c5ee2588c182cc7ca174f7c
SHA5125e58301a0b936dcfaabdb0396476e2defe9312efd85d3431d31df501a59a91dc9d7017946bac9504ec226ad69a309a97faa7358a79d1646eb845b66491d66907
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5355da30f6a8db508cd77b4dead658694
SHA1220223fa41b5fcc4020dca69e588c0c7ea1fa8cd
SHA256443da86e8047bffd268b4ea3c126b9193ccab2eb1ccaf98e6568e8e3a9a767d7
SHA512af5da0debb2cbe826c3c9b42bfa5473e72287e101e15b618eaff0d87e4110f5a0750f59a0df085301e0079196352f7287872d33de15068db788aac8fff5984d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD584a884f58c3208a3c60be1f3b77fbb59
SHA1bc72b7f023ae738c14d97ef5751268abe774234f
SHA256e3b61a2c82e35735f44f117b5d7e58e0b7473acbf9f13fb43e677b7330fe7856
SHA5123cb3d2029348e1458d83b28849fa5dc74f9e5137fe69821caf1f6655b67fb029e3d5cfe4d4dc8f3aaecca8f02a73450e0e439b5d61a3f6cafe290dbaac1b4335
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a0452ea1e45eedce5d094c3c7983b59f
SHA1b347901c7446e42b55916627f4652fa376afcec2
SHA256e9fcbe3d12613b7544e78c4018ddc20bfe83ecd7978f569330e3dfbf94b6f100
SHA5123e7512dbdbf6a0206ed00207791daf051ce8ce5a080df2bb7f5a5d82c91b58f57c5794e54f5be838c3c56354e2380017c5471c759cd4bb2e372f136a6b1ed541
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e8068bd7c01fa124f143730817b2cbf4
SHA121d143560ca386e0d0e313e50efd248c0fe8be67
SHA256c76e3d3859df745b69fd530fe83f4617da8b54946b86ca01cf84b04fd795d20f
SHA512dba16fc6aa70092eaeaafe2392ce0425b43be1c7bb4ef99f51bcb63d1a6faa637ce7de1a359e2694e24d2ec584dd80e1b647db2f90fb5e46900de7c25fe4469c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e3734c6b08c5cffef68745866fc62b7e
SHA1ca5f18654cb0a9b6558c5c5818941a3f18c99f23
SHA256bb68a113e110b3c0f300eb585be69f7b4cfcb64f6363405fc803c403d28b6d44
SHA51231fbcbcc6663a4f70c65e5f6c7197e645eed60b0f412e98156760b52e1dd4e037028b99aa12403ac0d2ee7a7822d12b9dc9b26b35ebdfafb5f881ccb21a53cbf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b331019ad18fb12102c99aadb96fb158
SHA151f8ab1b3f604ee44ee44298570ba3d611014807
SHA2560e932865ee31846df89c21c0491533af5e8a4cf458e16e33a368b66c5d23e382
SHA51296831892fed5f3f55eb4155e2bb7bf0942a7c9bb946246f989992d67d3271f20393789062fa1790cf41b7a02cea9111a9a313774b259cbfb683c23cbeb869a45
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57b354004f6b8017032c56a7b5dd48783
SHA16bb33b0d2f201810e8e529479a403e9a0665ea9f
SHA25645aa1abd8c44fe1aa11156f392865885e5aff3a114ab2e54ed95b46ddeaee479
SHA51200e18253cccc724acb0ecf6f2b2f5af4bc68fb0eef6edcc5828410fc3a2bbda16f67e1c39ffd08609fe72bf18c6c4cd1cc915c1199199cbf0bbde62bca8d2054
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bdafd2f0d09f82b7308512300b135f9d
SHA14691084f22ef5b3a01a11afbcd150e3387438632
SHA2562560c43a3421002c8f89adbdb2b53114ed53ee1f4a4bdaf791faf3f36d66d36b
SHA512fedc957dc5990bd30f19a1231b2644bb69bf42c391145081457c4f8a28e21d9208dbb0b5c92f89f06340c67cb60bf0f030b1b823454121c9ff22320179876b1e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51d6994019f4b42e431052c3e5c44309e
SHA142eb87a75860d47fc75481f066b80de55dc9d865
SHA256098109e1a55e2c888eed9aa03335bc5eec9bccf96b8c510eaf72c65061b4cfad
SHA5123bf13b87325938e89d1b2b3702709f8bcd074bcd958ca927fb77483824fb5db54d42adbbc92817a9d7893f9a8a12214e80ee0c235a8f28b5900428268517ad45
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a8ff6ab4a1ac1d5c00f28e89658a59d2
SHA1304b62f4600b07bfd8d152202011428b375805ec
SHA25688daf093a8cc52ee4ceec04748df39b3ad065a42220d7397257dd8a2bc87d9a8
SHA5125b6a9aa84aff08f4bb9adb592bce7f1a6338098b366793d7d7680af1c5f8106eb76a90e3fcf6e0a3474bfef03faaf24338d78b1a06cfee8368eb6c94e3eb6a1d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54f14505de1f7ac43d6d13cfd264c3cc6
SHA14ad62353ed728f22c70ae982718f5ff0a0c8be17
SHA2566b56460d2cee0c08dac8ec10a911e4e6056144758c3c295c026b1738070f409f
SHA5122d81f5388a261a17f1b9dd56bb7805c28a05eacf88ef13747ba97dd0ee5c0758e89d957dbc90675f9d2da59b3c96a3d0e9a80bdcaf172acf15bbbe97f8d44d9f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD586eaef2e0ca721488f67e628972b62cc
SHA1e99c85b27b099ec61cd3a31977077c1e5359d865
SHA2568c88b85491fc543990ea536531064798e2dc106c2559a12ab567a98c608db216
SHA5123a286f1262e08afd15ea456a1d62be86344ab9a3ac022d43c5717d6d24364066b910bf0ad1c8e97296474422a206fe8f575c0f5ee812bf937c596bf576ddfdb2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5870f421e4f1645133fd121b341a27e65
SHA127d8eaa4ab52efab2cfbfd4bb900970f433f32b6
SHA2562120f2a5d40a83dbf1b265b131fe0d321c0be85e75277af41980f73365a4c743
SHA5127afbcb38b7f4544b3aca4b35f959bb08b316f40b4c19b76ff19fe69ceeb9740aca05e5eef24ab3c3cd0d21b8a8a28c374773da75254f568729e43e497b4ac999
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51d8af2cf9ec54bfd3e870c7a5ffa448c
SHA16f73f90016f2cd5b56a1ffe49db0a6183652ed0f
SHA256ca7fad4b52756990204df57d9c908aff25d8636ed448a5845b24d924a82c2e9c
SHA512c70afc4ead0bf6802b7fa27b1da8aeffb0f35e5332b96500626eda2ab5afd5dadda22469118b5dfc0d00b1357f904dfb608fed63b2f923557522748fe65b5597
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f28523d963114f8fe8d0fcfff04dc2e0
SHA1cec4cb77fcf9d8cb371ff8bf2cda8ce7b583fa01
SHA25651ceb09883d4a68c9a4975df00a87a8ab8b2826bb161b22c54e5cefecced8652
SHA5125e19853b22fb26568a2b4db30e052c365733b804f16e374db1b83d1c6e0b41aa60f91fbb572587822007228b204a296f3844700ca1af9d6dfdb4b345e9c08c8c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5807256106323002adc6e8b0b32ecc95c
SHA15edf75d908c3b0aebddcfc8444590fa66e80079a
SHA25672ee12c953908e132330790246d2fec3a4796dd6d371828586dccaaca63d83d9
SHA512adc67300b156b25dd961b3070a3842860b77d8871a27d679ee35b3cba5965e36642b5818b16702491bbc2ad1d8daa82af47f4299bd59b199b1254008b87a0561
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b9c858617f94479805334f909b8a6d40
SHA1780ef20ddb406a3c42b4a7bbb9db418cb9fdbcd5
SHA256809c2fb3db2c211bb6b8dcdfd931a160a51337590169756a84a069c636def7ec
SHA5122a91a2cc9652ad5106b76a4bb2b64e7b35bb42e3b2ed52ac2144df2a34fccb0fbb603413a667ce271d65c0d3675e766e6d3905fe867534cbd951a561f03a8528
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e51ab7acf51b3496a6f3ef9fb6534397
SHA1f6cef9b81ff2dd6aa8ba3148c8b742bc2d27881b
SHA256f559432e4c9256fb007625d73aa0a6b306b1a2b6f9ee9c2f19d0193479e49c59
SHA512e87610eb02bd99f419ea5480e806b196a8e25eb281b77cffd30f39ff18161f8722be7cca34f0bcc2460e7a29530d8086bb911a2a06e5f8939a7cf1bb182f83d1
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b