Analysis
-
max time kernel
121s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
22/07/2024, 20:41
Static task
static1
Behavioral task
behavioral1
Sample
64ba91fa09025d18fd1653d7fd52f458_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
64ba91fa09025d18fd1653d7fd52f458_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
64ba91fa09025d18fd1653d7fd52f458_JaffaCakes118.html
-
Size
21KB
-
MD5
64ba91fa09025d18fd1653d7fd52f458
-
SHA1
d2fc080aa3926ad54e67cc7d89f5fbf1dbecba56
-
SHA256
4444600bc03a37a86f4975cbae7f38743aa61dfa5ea51a491a5fe3ba7bbefb7f
-
SHA512
22ea13329a71fcc1116aa8e994ff688345645ee41025f517c4ce81d32fad84b27149e0e74d73b8e3bc3ee1b6d4346b464910b332a28835fb91669e2adbe63cd1
-
SSDEEP
384:2FQF9Qgn9cV8zB9cV87C9cV8Px9cV8NY9cV8nb9cVY0Z49cVTQQ/BoaSLT9cEn9p:2FQFEyJPPmfeQi
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427845051" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30d9a6f17cdcda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d9909000000000200000000001066000000010000200000007322aa9b498ec4cc603d350fa1af7d61474bebb0a3f00d3cbaa5c23255b98a1d000000000e8000000002000020000000c99d6a250cd2e36ff264541bb486efabb69e76d852f20c2cba40b648b29a24fc90000000e129f58daa88b2c6fb09ea975ea5f918163a5acee42e2ea8387e67f3c4e4393ebfa60672f4bc013bd4cf4d121e9f0f4ba6b1ab7765ae45d94da29166a482952329d4448da901d8b78bd9668176570a717c7244bfeec2b727c83258cfe8183c0a6979d9bdcb82dab48ec8e632277a5da710a90db46b0d000adfcc584477fc265aade5d46fcfdb8e8672c80b8599a36aae40000000c659aadc059f7ec9c6710ce0465e29e6ab14398b67ae2cb396a8beae16465580d359f8a49f880b9dff68388c9171a9262605766eeb07d7233abad91f0694a8e5 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1D1E49E1-4870-11EF-B2F9-66F7CEAD1BEF} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000782ff30064afb6ef219c383583537e7e8a2d1a45c627b21210dd3bb2e3f32c88000000000e8000000002000020000000225ca744b220e41cb9c8795d56f199867a671e27e16b617593ba5e45b8928a0620000000b03244c0c1ecf3eec62c0a379735a6c20e5c467aee45023f7b635df72f93367c40000000d64c739d6eed8077ef33b4f458d8fab295e372af27b24a3d6ec1c67f7d2341ee5f47d68aee31c825879faaaacac1f616c8ca36ec5c9a9c6e0f5021b1093d5bd3 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 348 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 348 iexplore.exe 348 iexplore.exe 2408 IEXPLORE.EXE 2408 IEXPLORE.EXE 2408 IEXPLORE.EXE 2408 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 348 wrote to memory of 2408 348 iexplore.exe 30 PID 348 wrote to memory of 2408 348 iexplore.exe 30 PID 348 wrote to memory of 2408 348 iexplore.exe 30 PID 348 wrote to memory of 2408 348 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\64ba91fa09025d18fd1653d7fd52f458_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:348 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:348 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2408
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f692ba94bc44aa7e5041f1daba9be79a
SHA1684ee72c0a1a7713a454f0ca6fb3531e09e360b0
SHA256766f613c21a59b6b3ae40f8f68b916a4494bdbd3370b88531d4548f30abadce1
SHA51211ba3218a3bd1a7ed33ae7b4a5aa7833044dd351758b61b3051f93086ce21de657d433ef162c040de02a6e31772ca0dedb498ee21b12508a2aa5c15835c50d0c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56c231018f1cb64d1710b0e0e5941ad58
SHA1a3e3922aec649a0918d81d1ddf86a8596ea1016e
SHA2563001c18be11b5c1d1857309322faac71fee41b81d8399f8a10ab41ac85728413
SHA5125962cc7a510d4a539571fbf8e8d90f00cf19a48c624da8078e75b0a68c976c250a828ef82c2364f9c5fcf847bd1ab8775217fdc492049b1140fa1f4fa3af1b26
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD516f81359bf94f1e99f9b5f31ce5c72a7
SHA114225415c46f43d9b3c176d837529e3ef9bed644
SHA256ddb77945fd1504b311b70bc2c484789c37b8217edeab8821b39bc07ca6bcebcb
SHA512876cdfbaaf235bc15507d82b9bf3cb74a9113c0a65639a06412871e2976cba205269c8c883a8d3ca9037e9579dedbe7890c1fb9fc019916cab7ef53cb21d2f4a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57cd8508b2f786b67e99fb17dfa9ed078
SHA13c2dcfbb944140c08b6588b147045f195c630477
SHA2569a0acb0065f7d648294f912a1d1ade8cb45501335da3de8b3028f08de0b153da
SHA512684cd1eca3cb546b9f887834607f689182e07f34f0751600e204a303d5d790f8a3283ee9bf5a6241bf0f7e571931b3278e51abdb2c0293d93e3e10746a5a0ea0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD595f7531e88c0b4084c0f93e4d835be4f
SHA113abe0e8fee0b9d43a993cdeaf5cb6ed6de2db6a
SHA2562ab64b1f9fc66fcf8102ac31a724be5f298b92b4f83165674f382c0475d18919
SHA51270bb25fe25aa9f9645c9a274787a5a62ba662373fdc355ec89977991ef8b724a76a7d5e3d9ed48bebe1fb827ee41ca014720bf20cb5b5d9edbdf64d35dbf8b44
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD592153cb363e64c53ee3a9c94353973b9
SHA1e40129e6fef455e862606cbec96600fc5c7a97c7
SHA256466b68d37b1c7f873960e43132cc970e3f0bbeb9416f2773779f39ad560c3dd5
SHA51200f2beb1d4435850daf7c9766cfb72194947c2036b11209feaaa41bd8fd51a0405be545877cabaedf70cae1dbc243233c519e81c0c27a9df43abe665972d8ac0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58ae0dd6867b0fbd09d64371725677ee4
SHA1644427bae31e7c513176c26621c69641e259c48b
SHA25642f3bafc2dd8da74e91ada57de13edc86cb144e79334343f17644c7812ad9918
SHA5122c7825974ceae3aa914b4596a74f113825e9afcf7608aa5318ea35e8973f01ec5ecbd614d33ebb469579ff4de3942b6f306830767ab501ac0780b2609fa4f5fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53269b60e5c13c8106dedb50fbd0834d6
SHA1571ea62b62556733b2a53d9c8aa9ffbefb88e33d
SHA256c5a1c59be57a4507a678cb01f3963ae7bd993dd13d94f8762597361f1e4d93bf
SHA512e51594352b282e91af8d72d031a60bdfdf05e342770faa09a0a5d6cd81b63ad72323c480640a17103dc0e8f9a22c1f8a673709270d51119dc543d5757181182e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a675971a12ebab4345f8f5560a63be76
SHA165c4aa699ed7e719a487af424712d3052cf7a1d5
SHA256fa81931bc08c34a85948a4b1b6a75d33d583c99b6afece7911966f474559138a
SHA5122c286002731f09e75975cdb57bf5823e11b23fa08853ce45b5753c5ed839064f93c6083f2efd0e1b5969e8005cf72c08a11adea9a0e220d46ad91da25d547498
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fb8abf69dc6887c7bb5d08424eb17ff7
SHA156f26dc4a3f5219ad7227d316b6b3461529aa4b1
SHA2561bc648c10c7cb9b1e910dd2097005bf0f99d1eff1a55ad1d14e86651fd060297
SHA512a597c9eb4d60cc16a4dbe8b0e03601f16a45d90b537939770f19ada1906d2ab38f560548a6cc2eb3fcbe46d33b15180dbe0cfe387768711cccd05a9e98b5b1a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c749bcf1292ab182cd7dd8f4bb3cd8b3
SHA164260a3b5bbeb6a2154e4faa7b837fd0972d3005
SHA25685dc521d17d6b60053478a7c98794a5e7c249087ab80cbaadb727110f02decfc
SHA512ae2f5a25dc324fed3d9089efdeb1707f1f40002dcc50f52f94dbab66286311b4511ca7418a41f22994189a436cc24944799dba08614a516c3bba92cd6cc551b1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD524b1484fe668e62c638eba220b1ea72e
SHA13601e57a5408b4c8db6801555ea590a949e73811
SHA256de3679e15c60185d7fae5c0a5066f4de3860d350cab9325995394ec70d938feb
SHA512f066b4e933d2c18acf905cf2bce4cdcf6b2d08ae2fc1226b6f71bbe960aeded3afbe42366c4548f7f96220b1c2d21254a47993fb0b906fd528a9612d7aae30a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD583713267e6298cadaeaaf1973df0303d
SHA1b29ae11c9a1e0267b92d54618632059d04a0c677
SHA2561c2129ca939d8a9de9931e778b83cc99e13dd18d20d41d79ce3cb997eb3fa048
SHA5122faa159e61015bfae62b969c1fdd3b948d150499a5466b6587fd3fad9299df988fafc38c40e65d7dfd552fc632738ce7cbee8be754393361d383d013646b51d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5836049c1f1ae969e7d6e325e768f60d5
SHA110a91624a0737e29a95a481c5d96bf95159dce67
SHA256a668c2bc9d6354fd7c7675381589a74e0536712a3493672da4d175403257cd38
SHA5125b4c1fed08ce8ad1852e6b4ce7b34140b2d327d92b404dfa7f81d4ad09847f412a0d418b3762b0c6d452d6394ab208a9169b1a09a7084870ceb7d5f8db6c49b1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f414cf02733e836ebd64a9fe2dad8f78
SHA12b3b499bb7acec57446472fbd429fdba1dff86f6
SHA2566ccf99ac845ffcb3ae603620499458ff57ce7dc49f7864ce6da67fe7d4e5f84d
SHA51200854ee5224493f9464cba3a0a208861437b27111bb449c1384958ed5d70124b8f4583b3f7cfb47c0e214070e88182bedace346016c16b48ebb59c6503cfd807
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d170458d1cef3d0e13ac43a6ace505df
SHA125482cd2fddd6f6ee1dbaf2e1f436f56f2dec0bd
SHA2563759f71e40dde86b8149258766222c546994c3c3f06d98305384517f9e739da8
SHA5129f4ea676dfe74d702446866dcd17fa03b70b815ee496762d2b05b5091237715ffc913525a14d15d6cb2bf4609ec69d3790897388b745beb0faa6fd7305e0f1f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ef97e5e4f6550e55c5ceed8d59535a71
SHA11df51fbedfb4a97806f3947d379b2f3d6155fca3
SHA2563dd1d0543c2a0f78ea4f06a393a19c0b7c3d9de5f53b6728d850162c887a1b6b
SHA51241fa51cc17903e175fbbcfb12de15b54d0ed14e591f05326fadfd69363573215a27912ead12fea318f0ba88ff87d9cf29f30650ccf4f2475f1d1cd8d244e7268
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53d763a0c10bfe08579d5fb81a44e47e3
SHA1a8866010b797315dd583a086b24b1aea1d401052
SHA256cef3b5089476e561cb12aa48d012c67882d6be742c577209e9da4510224d6f6a
SHA512ed48efbfe67d90447878cffacea858517b9f2d6ea6399d2f130d786aefb2a5c8a7460dfb0af49415d1e98447a7a384df62050f575132a71e35c4d6cd504d874f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50922f93e15cb1670d56fecae2ec3aeb3
SHA1ae7ce3cc05e19d839d16ee2077f3cdde8a79d84e
SHA2563dcba35f619f70cca932762efd300d0bf590249d8484ae26cefd6b3061e7ec6f
SHA51206f690d07eb60fe459773b357dffccdea34a4da85532d72fe2697b270c9ac1132460291a0f185ad4d05b3562b625e794c858200a0cbe5dbed413c57759c24f76
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b