Analysis
-
max time kernel
120s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
16-07-2024 01:50
Static task
static1
Behavioral task
behavioral1
Sample
4c516c1408a8410affb81574d4023003_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
4c516c1408a8410affb81574d4023003_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
4c516c1408a8410affb81574d4023003_JaffaCakes118.html
-
Size
37KB
-
MD5
4c516c1408a8410affb81574d4023003
-
SHA1
fb2f582ec7a6add3c0f379ecf421c1225858cc4f
-
SHA256
424ef7a426b4d90a3092153b7183a11ef614ec280de4f8bd94d7ce3f417356b6
-
SHA512
9354be333c10c23be79f8047541b6f740c7b9b48b1ce9602eb3d2cb3e95e6da3ba637d951f8f974c6b1ae1befa01acd764d46aab8495129cad2090f9cc8e6012
-
SSDEEP
768:S4EFcQGhBvkofaPWpi5AN4FEKerpQUFuju+mkH0F9iy8fMdJExolQJ:S4Eu3+mkH0iy8fazI
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c000000000200000000001066000000010000200000008d262bfa0becc9994a42796a7b7c82100367034e71e1a19337c0d20df031335d000000000e8000000002000020000000960ed4b534bd750fb058756176c1a2cceab1f62c82edad5afd19569f13ea71c1900000002ff6d8a8c8da03d04360743120ae1e5e7fb2934020f6d697dc78c6e6b3bee2e801f7e11806e874d809367e44d30581c6147a5f014dac712d5d7791f29834067ccded4e82d2dceb642ee06a9d5d9a67e825044f889c2b06581dd482fadd58c720eb1aa05f7ba2f228e904b17f2b42e5c0c0d21f2178cd5239579f335125aac8f5211e7844c9ea6d95bb55333fbffc75c440000000277496904909f6bf8f91eab5bdad4e57c0182e6284b30ca2ea623a5fe420e4321c2aca0a7d1b52b9007b4e7102943b7f495cb977c1bd7728f12b674f6431a29a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427256481" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BE096661-4315-11EF-B3C0-E6140BA5C80C} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c000000000200000000001066000000010000200000004e64a52582f0e738c600a6a63d3da11b4fb60905574aa6385c04126026dbe829000000000e800000000200002000000099f368f6ea5cadee89fb2f63145cc294bbfe9905f26bf3e47bf9e21c64daac202000000005700dfc57a705daa605f915160894ad42b439afbbb686a3e72c7617e721d45040000000a8f55d96558dc047e83c3a5123bb315fa8187986e73c4b776d4cdc597ce3fc90cb516a7e9276cf7780b59bde8784d7a79b5e75f98af98ddd23af3dd1dfbbf82f iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0d2389522d7da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2676 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2676 iexplore.exe 2676 iexplore.exe 2240 IEXPLORE.EXE 2240 IEXPLORE.EXE 2240 IEXPLORE.EXE 2240 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2676 wrote to memory of 2240 2676 iexplore.exe 28 PID 2676 wrote to memory of 2240 2676 iexplore.exe 28 PID 2676 wrote to memory of 2240 2676 iexplore.exe 28 PID 2676 wrote to memory of 2240 2676 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4c516c1408a8410affb81574d4023003_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2676 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2240
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5b79288db72724315999cb7f93db84fa2
SHA15f456576525961a2cb37232fe61919542973b052
SHA256d86479c43162101c59493def89fbaff4f6adee4d3913abddd2354b9a92170366
SHA5127e7c8dc97b4236b7a5936cd2276095aaa2daa55cd51a2520265e0455edee118c7ad3a5215e0774b378383d8248bff58f7855c674990aa4fba8db2376ccf8b58c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD52211013e47a42db8bc91c968dd6de68e
SHA18da37bdce1b6d963531ea5657f997dc1929fbff0
SHA256cf5dff0a60d83ef3db0a78cfb7b700afe1e2fe46ccc00e5243d8cbf1201b9a1b
SHA5120a79a5ae4e251fac11b69e17c41b96f60c32a82eba5a77b8e25b38eb2762866c6d0d1349fddb96843226660d3affe405df6fb007c009f9f35da51fea54cfe893
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5a0c753e527f98211c40e4a10ea1ff386
SHA19b03ec63d286ca78d78b95aeaccaf998d42dfcc1
SHA25655f1f99e2e286f250047a9c2c4375ff608f3f96b84b70d7486f1e4ec5a0a7c0d
SHA512d4ab5b0394d0409955f91f0d9a616d45d572e5c9ea3694fd3866d7f8e87f0b3697ee8937cbd4f32c69001c49a1e1f48bb2c8139830e0ceab103ca84089fa1ea3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5a065f8de9b879b0f67836a5ead52ed57
SHA13eecc1fe81b3294ea5f4b3a6a2c733b432e4b2a0
SHA2566600f9f687ee8522586893e96034ae6bb1a08a1736307917dfa9c1eec7deeb10
SHA512c9c86392c0970515e8962e8347efbdc9cf47de62cea7a947d3e83e2795de41034be1cd0e938e7edcf4ecdda22493009cbb2fd98114c77c35ac844ea7fa3174f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5e47b47aa02d6628de121cc272cd7f8ac
SHA152dfab8b850e759520e84a60a3ec15286263a7c2
SHA2565399e6958a4c4bd8edc4d2daefe073d1f0e3a5ab360cb5a621118f42d99b6c9a
SHA512f6ec1fdf30b9a633c0fde4d5e3c79a858622d34ba2256983e2e52b056ea47e87a1efaf9a69b950c4c16d822d99656fbca9823c9cc47d25722593cfcdba4006a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5ec5c31c904ba8244b28a4f1b91546881
SHA1d51998a5fcbb31bdb5dd80b2828087f53d302694
SHA25609261236c9455533effbb6c886d01fbc8c9113aaad28e919f5c589e6eece1a10
SHA512dfa7112ef3bebc3a065ae30db56887c6de0be2d2931d676d124bcdf8ddf028de35c87c1ba6d87009a256e257b7df757cb8f6890037c3b2c6cfc9934f05713cf0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD590bb13a0437d24f36934fc37a3f51647
SHA1cbe313f9d6f8c6559a0b326c5ee2321cc9ff65b2
SHA2568d5b2bd5ca834fb91392f9ca152be64d3ae6527e218eb68f089491523c72a19b
SHA512c22583d28fa1b7fdcb41ebb0ec27b283a3a3e41f052a06fe9c582185e2e3ee44c2ceca18e0ec9b6270713d426188142d62dff50e5658e9d9546d6c4a9ff9d67c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD59bb905267cd9e0c4211cd367d66a3c8b
SHA11845a8e16926892aaf989224c87ff52bec820dab
SHA256e0222ae34886f65894cabe1a7b685c4881524b93de8df2ab75eb0a5a9804d7dd
SHA51299b63b8bcb44c886182731c58a323bfb55e65451f80041629c15cef1f1c96832b1e36194b47e70a0b1d2a9880387f1da0dfcba8e5ab0d4bb850d9205dd8920d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD58d58ed03f268361b44d3bc93c843d718
SHA13319ddd997edde9f7241560d451cd5c61b2dfeac
SHA2561bffabe1c0e2f4fcc9dd3b776a6484752248c9a1fa07aa1cb9b08f5e7958295a
SHA5123428898fd1d4706f8cbfa6ba24824fc49759aa300a4c3c458799ce213f4a2fdc8e7d2aa3706cc99d30358f2168679e955800a44e77c0897dd478f049589d8652
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD57a8b5acef5a1312fa6f609230155edef
SHA13ab7c22799e2ce8b6df10650e8a56811b8cf495d
SHA2560e264ad30fc7faa8ed33bc16fe9d81d39966c942d150ecb7f2a45a89d3a3d4b8
SHA5120c94f7c9f05ddaca047829da86b7c248b7f8864013a9968b1d683a34b901d3669b2f36a82f06a6a435faf5d0184e570b8094c2171fcc12a8c3b541da0687b7e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5a8cbeddbfff423774e230b1153eaca3c
SHA122724d350c302f5aa9a84d3aa5e8466249dfbd54
SHA256cafd68150d53698af191b3bda66f50fc16440ba46f96b9d49b9c70463076eb9d
SHA512ee47b0cd4b98107cdd4ee6d762be9c7c15f4242ad0c1bbf4e07175390b81c390d49349f0b0bc8fc1ad406a595e8662284d1908c3262b34074f32fb1e69bec68e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5320f6139c5b378d95b650dbe67d8fa8d
SHA14b063db8e90452ec00fa702efed3d8386942a732
SHA256855bf292059dceb1775378c5c181578ea3ebe577463852ebd67381267537cfc5
SHA512f19349bcc939d5820d8f254492e7da139cc7d7bb7331b666816e27eedf7087a83443bf9eea515b87ca7de3873c897fa11d6647cc7b1c114b2b6e171fa11f936d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD54dbd08dacc6c288adb5aa6f81154ea76
SHA16868e29bbfab1047d9836f614d1b2a2fceca1faf
SHA256e8bf4b673c3e376f80292506b1dbb0cb88647d162f1d5f1bd19a6b7000db175d
SHA512336c05dcaaa040e477e0fed2360c01cdbd7372a65f71fba40e30e6afbbc12442a8620cb28c3c690cb50eac204ce3bde4e70e64b9d07acdabca9de27df67fa4e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD543c65ad115853172f04ae7f3c7dabb9f
SHA15196a17ddeb0bd92ea229020d7244b158eda6e7a
SHA256fde06e35a7c6bf798508ce7cf9c6b7423ad5fe4a2dcfc77504803fb6eda71f00
SHA512be48db2dc41a80867f40c0230d6b85e46031ffd341b886a6570e7a063b06411161492bd8d67d02c4e6007bf9f679af8d941297a90578e54ff94b0eb1625419df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5135760a2f3fea9348277abbb9be56367
SHA1b3237a523d9c49691b79c406623e1eafb4655fe8
SHA2565e739d8868eb0adf09d768ec295fc4b0a2412f013cbbe124bb32d0bc393284c4
SHA5128733b49ee272a6afce83aa33f8ee9409c5f3a0b18403ffa9f61cac87fa090bbd53c5fd9e09ba5b922aa701cff3d9458dad73333f29354bbd8c7be758969e0f93
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5b5c337504bcc4f03e352709f0d624f3b
SHA1b140ba10d9c8a79bb821b630a41209c3a1e3ae56
SHA256c1c0a96f1eab44980cbf809cfc2b3f2682840c4ec355b11aeb235d7ec6e07e29
SHA51291343f07647fcc9abdd871ad0dd9ed7bc172dd958e777963a53d0db0ca05784a1d2a921f2cacf3105e2daabaa1002fa17c9ff358816cf299fab8b825eefd0228
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD593c9911431f1090e3ad969748ce6a6a8
SHA1038eacb40d44c986fc485831fb8217b430023c25
SHA256d457f4f75a2df809bd96c15a8d1ceb67f5c8af81e7d68b931875beeda5b2d112
SHA512e74366151aae9625b17dd5c1cef755bf1173816acedf9a06274bc65111779c039fb5312509a342aae625602f0695897b9d9a9a33493474adabb503242c8979d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5dc56c3d18ab14ece24ed0ca6e52b805a
SHA16f60c8f0361fd6a967f0e33aae1202872c3cef14
SHA256d273defb3f392986db9df7e2d1533217b15f8c4e8ac74adde3e5750722f4a64c
SHA51282cf27902cabd452beb464aa89ee83090728ab4fe315feaa67276224e2523811c12c4d225a08221869431c71c919529994a9161ed9862d9e6719ea68286ad232
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5fcc246af4efa90dab469dd8f796ec5b4
SHA1aefc3fa75726f6dfb0b5a9bb55abc1beaf5d9864
SHA2564a4411424106be8c7e45fa9d9d67f5eeda3cf2a4e699999482fe6eeb3864a1da
SHA5123e67b6e741d80e7ba2d2937ced13460732445e22c8e436fb39778eb46e00f2ffc34d94f2371b20c14a38d31d71f0e177d1761b67334ef4d61bdda77bfb28cbf1
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b