Analysis
-
max time kernel
133s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
22-07-2024 15:08
Static task
static1
Behavioral task
behavioral1
Sample
63aba2e10ae5c543719d5d19f82b180c_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
63aba2e10ae5c543719d5d19f82b180c_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
63aba2e10ae5c543719d5d19f82b180c_JaffaCakes118.html
-
Size
10KB
-
MD5
63aba2e10ae5c543719d5d19f82b180c
-
SHA1
1cb69e4fe7c97a98e4dd88f57193ac44ac96aa8e
-
SHA256
15f97e42f8f151540d2f6843fa5e98f95165213574946e69e9635c401b056a51
-
SHA512
d3fea71705f62941f82c862a9be5cf9d525117138c4cf40257db04d29ff0bae5cefc8c3afad4d8329e9ca9e8c5f312094e16c6a29da8f08c8525f5d941b11411
-
SSDEEP
96:uzVs+ux7dkLLY1k9o84d12ef7CSTUAGT/kGHp7+RNssJiusJbsJylVHcEZ7ru7f:csz7dkAYS/BSu6qxqbqyPHb76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e062cacb4adcda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427823511" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd000000000200000000001066000000010000200000004f150adf73bdf0d690421decd4e3adb7f1dc5c2d79dcd3dc0ecaa74b1a909bf1000000000e800000000200002000000005f2d34c81318857da904f111bce08f9cc6538a940d51a36b092e6c41650afff200000004dc5a3a94ba502ceb80086d05f115a3115de0dfc709e90ffdd44f2879e84cf844000000087411565f28c2e62f0d722fec60a55f9bf60ef36ca1d3f4bc5e8ba243b5d626a7178a4479a74fe876683f1420855f46b12c11f11dbe1cc842c609fe962146176 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F6D06481-483D-11EF-B34E-E29800E22076} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000bd3490b968a96b8fbb2b274cf24592cacea6f0a0a0ee70dfa2fbe84c9e898a25000000000e80000000020000200000000670d77b917af6459df9ff311b4d88652ea689d29d3407cc6b394cc630febd3a90000000bf3d08baed7225f74c325f0c2a0a3ac6013b16d4c162b0f7c5b621fddcd126ddd6907c9666f7580471155d4295f597f0bb89c3dfdc220eceff21b31277d20da2203d8b95dfaa3bf01e8d4f28df8bef3250e2c61fc70c6f53cf5bb5b5e93916ee2a9ac6adfe4c68efcb358ffc747fb07d8e27ffdfc37153d549fb451803569938f416e52dd06d0f2ea76afdae6da51e8e40000000cda4773357fd519abaff6aceb988d8afc5bda38f94775430605de8597c55ad201ac6b7fa37b8e801fea8d101eae2afb05bb5a2762fb6e746977740da72fea424 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2932 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2932 iexplore.exe 2932 iexplore.exe 2816 IEXPLORE.EXE 2816 IEXPLORE.EXE 2816 IEXPLORE.EXE 2816 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2932 wrote to memory of 2816 2932 iexplore.exe 30 PID 2932 wrote to memory of 2816 2932 iexplore.exe 30 PID 2932 wrote to memory of 2816 2932 iexplore.exe 30 PID 2932 wrote to memory of 2816 2932 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\63aba2e10ae5c543719d5d19f82b180c_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2932 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2816
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ab0b122c0ef03c80db233da6c2cd36e4
SHA168590d3355a811b705042fb9807e6c78c2f64450
SHA256c991b9e2f8c165bea06084df1316cd5409b3f2f25527a69a169d26e7184bb723
SHA5126e17cc6b812fc370ac4ada5b8d51722d3dd0433ecc257776f43b64e2891c87204c5af4a7a117f4c4a18b085bb6982e1eac1d755769cf41ee0d7ef238466c760e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5920417cbb1b8c5e26ed8b7398bfebf80
SHA101d4670d15ef160613700ff58c0bd6774a0b23d2
SHA2565db1820542bab5ccee39c3794fdab39b6f43b9011ea396eca1e187aae242edca
SHA512fd8aba8d23c5f194aff8749e6d59d647fa636e7c1a0059d0a9dc0a0430217d3bf782760f9a78d6534f11c9ed7084c594ef90996a9b4d569707bfd450ad2a2fcf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59cce7830b02e763902ff3e8159fd5be0
SHA13d93425431c61156744908743b07959edcb0332b
SHA256b094ccfbe594ce479bbaf6326bc97ab71ea80debfea171ff028c8277a442e7b3
SHA512abb593a0d957ec4aeb66f42da45ad7379f06571d40332f93e40dc61584fdbe01555134cef9e401f84a40a509511d2d939424cdf670bfbe6305624ddeb836f92a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c7fe8b6e4c3c69a2372a525e425fd0ef
SHA153719032aa8500f4c7d363967a18e74dbfe3dde7
SHA25699ebdf1e1c61e48a75b40e764725f3d98d01b334792bee3cf6d6b8fb41bf467c
SHA512af93f773cfb444d86af1d5ad72fc497c9d90ac8fadc7c481b542bf19effb3147bdd025b3dbe7a9ef71e944a7eefab1cd44a372a99c2ca07e57f75eb0e5cbcd61
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f03d5d7dfeaf0a5510d7d3141065bb31
SHA14ba1a060fe0d591e3756c14530abd278fafaed0f
SHA25670efa680cfa12d0486c879bbb22b640b3972fbd0f26b80e5ec0eb10a58833254
SHA5121b6a2100ec16a8a0e8fcd663eb5f4d612850b8ab09aa5d5e319936f140dd9a1c878ea656b6453cb4949d8a874dcdd0c004c75730d3d24583323d0604b625b7b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c61f77c7c50e1f68187f1e08c2f61edd
SHA14925942625962be42844bf5df5d1daeb36a3b5c7
SHA2561c74939a864983a3d73c6a3e7727cf0aa8843b0fb227faa5357235b9e2e3c449
SHA5126434fbe49a803d08db1bd07e0e16fb423cac7b9d6103883c952543c89eb475c0a0731071374813ea8e4ab635d2fb0e0b7da3eecec9f5b88765deb740a5a779e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5392acbb7c1425c3f5cdf34e7b6ad39da
SHA125fcbc573752485c66c93bb483ce75fe46697d05
SHA25639c9fa454c233b20a071978c15962d682660224ffdaa00216fee423e559c6e48
SHA5127169b9db2de282bed326620f20811ac1aa9639f64c99f8a971a75441436ae1befacbdb50c5aef403864d287fbd08233108eed987773211aa7fa7d3b9f515bab0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51929dc22a574b04bb7cd021905f62c30
SHA1f55243c831fc854dcff2619b7d6d099b30639714
SHA2567fba0e8184f21d6fad72c426c00863921a02cd252d217cdebd5001e6aefc019b
SHA512655ca05e4e7f5ef7a373f4603222edf55c21b991a056146faa472ef5ded41761f5371ae0923edd0fe24b2d6b28f8f296e3222fb84202c4b27cd89bebfb0a21c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ce4e66dab4ad9b9c430a3f2cdf636b8d
SHA1b3d9a65a2493e797336b6f2be47e1032fadaa001
SHA256018e25d3ff43f4ed61399485d2ee2e6374dc3accf9797158b52de42866f8d308
SHA5123737670371ea8f14d6ee2a3e3d8da9cc223c114c3852f44a3a27c786cebbe3578f94213255ba14abf0facd0bcecd2c877b8eb7681c6ff33fae3ef6221f64d363
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5220741b7a3ce6b5fdecc451cc18ed455
SHA12b6febe6e7bac730ebd2844a70427915689c1409
SHA256e3910e504e9ec68627cc3dda8b342344186ca3a1cb07b7cc4c015dac0d913e21
SHA512df30025812e722848ef933f18fe112b48081638441405d1e94471758652a0aa8858014287739c2d8897e73870125e776c89a178c9002a5020c7aed452986170f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b9ce6d875b0a2747861d45e8ea83e8b8
SHA123be3da9b198094ee2dbffa2e7dc713eb43930e9
SHA2561cf9b691a63c1992113ac31f1583f68da1647d562b7640a16e189043cde533b6
SHA512484478b193b9f606fb696e9216e5ce17430bc0ad0eae7698d07a606e3095fa73256bd867ab0c51d023b82108385c4311bace55c0d575c7960f45cf68d884e151
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56dc96863e1eb5b4b1d035338bb5a19f1
SHA11999fbd2785aa3349d17930383aba8149fb002c6
SHA25610c103d6620bf3478208860f6a90115f536b4f1e8e7c1e1609158cc41707ca0b
SHA512ecde4e9e19b8274971411d1045edb3142518e8815913668619640842e988082e1f306738efc697f288cadbf42dce042cb06a3a843f0ad5cbe307202cfc62a8ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e8d9179088a6a44df494162df11fcc3d
SHA11a9d143fbb24895c5e9a53f5402d1d4577bf44f1
SHA256d4c1e1a281b7af85bf0923acacbe7e328bd8b8b65ad285bc61d4b997b058c07d
SHA512b33f20eed142d8d8e4d04a7cbc6b38609a0cd9db73c1172c83a5bbf698de4cd285026fe2855aac50777583ca76560c99448e2956a9df0c109c66adcdb5fe6e5c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ae7fe79cac9510eb3e2044c740068d4c
SHA14c69ee7fbb1178d1938690d979ebed3eec84edd4
SHA2560e5e7041f9e7452ddcda675733a4a68328ad83be2a0d87335295bfb7dcfca152
SHA512a71bc080212d47cc6fbad4c565641d8b025d5915cfb6fc1a86b1a5b9b85215f86ea91d822d8c051c2d984aaf90b15626be3339fa5f1737d19aef86be01dd8773
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57eb2fafddf2d7effb182e2f207bdc8f7
SHA10730f060957453316ebfc31d83bb3a63837ae036
SHA2565f054b40a94ed2fb9652969ff7d63da4fd1ece214560d87927f1f1d6b1d8432c
SHA512e11d931d8f806c27fc6bdb1e9ac40c758d44633cfe280c93fa0d2c658a4229e98848006ce9719d33e7d7bec0d75848810b78f44e5b9c1be2b7d060690ee40015
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD596004594a3e3b766e039b338ce151013
SHA1f2cd0c89153b8f63cdc95483493cafdaaf47b556
SHA256194d221312ca6ea8a818264d7895721fe0638007503cdab2d521bf0e1b555115
SHA512e207c4abc8fd92d219ba89ce0da95dfc9e2da337bd0b36f8bbb71a400ddba7883f3069456a0c85c242e19bc6a549c967002df61b7d3b2353e82df1d20bdd073c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54f9cd923e586a0a786f87b6ec8d69cc8
SHA1745c933a657342757d7f6f693d11e3535d62fae4
SHA2569a10550f5838ab1e5050aee2a867eedb1f4dcddd829ef3ad4d0b5a5486cb5e74
SHA512ae47b10e1454e0348b9cb3d36c0aec71c85c70c82c786ebb9f82b1bfeb1bac70caf719540242ee01ef8cfdd84c0e302ab01740545966bd6204c074b53f3029d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50fc9741a178f39efbcabff5c5d35648c
SHA13319074934142cb5a6f636b18e948f06f1cf8fdc
SHA25663cd95198777755f8029dcab7f7e1ae6253262d8a6bf9722f7c3400da1210ff4
SHA5127ee8e1f8a7a69f9740ce6229f85889067b4c20d77423b229936b4d88ca927d8b282a8a4d672b9db32b7d9ecab4f55e2ba7c0b46153b668843825a0ca4b73e4ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52a199fa81de9a64d33becaf3996bf108
SHA1ef77865d2d7bf3415e704ae156a9d244911ba25c
SHA256896996ec79477c1d8107e3559a0d35bce7b2c54ba2f62dc7d336984f7ad82f9d
SHA5121e3260af1691a06805b70b653bf47cbf6fca1acb6d5769986fff09248fd0b84e37ac1a2a3920b2f1778982ff0b090e5b45d14d594ba464312206ce1e50021be8
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b