Analysis
-
max time kernel
142s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
23/07/2024, 07:16
Static task
static1
Behavioral task
behavioral1
Sample
66a05390a0835563b5dcad18b268662e_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
66a05390a0835563b5dcad18b268662e_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
66a05390a0835563b5dcad18b268662e_JaffaCakes118.html
-
Size
11KB
-
MD5
66a05390a0835563b5dcad18b268662e
-
SHA1
99bc279990350af2a37baf7fec04d14111740219
-
SHA256
d262026f6a1bfbecfc3b547cb8adeb54bfc22cb8819dfdb983a0c158f812fb1a
-
SHA512
f3c8f9cfab3044115644ab96674e001a7c40ae9330ecc7d0835fe4a231eb62fb27d203f2a3d1d6cad3865d54a93cac76e32f92101fa194200f1cdafe4d1a8ad7
-
SSDEEP
192:2VvlIsr032L8k/w1wvqyDBNknwdrPlT018LOXuBuLbdU8d:svlIcu2d/gcDBNknwdrPlT08LOXguLZ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427883932" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40c658a1d7dcda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A3FBDA41-48CA-11EF-AD9E-EE33E2B06AA8} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000870516eeb30b58741316bc95b50026638afa4647ac630922dc4fa64f732e51ac000000000e800000000200002000000012d7b0642d74747d420ceba615252ffdac25a0542bdcd7d8f82d364e8afbe36690000000571b1f1d825a5beb73142eb9ddcbec7a44782cea3d5c2905df56ce05f1499307a2f6100ee5a91ccca2fcf936729828334a3d8b8448b91b76b32812fc4589a3db0155f1934cd90e768e1d249a85ce71fb818ba305b4c36638c3129f49058e48616e20c9669fab3099e9be5d235fb3f4c3f2b377bea74ea0c9b97506ca5215f18e3ab4e1acc152adb188b6c86944a540da40000000c81600e75aaa1c0db6c1f1fe967e429774b68e927516f516ebaa53813d7410aafcef179291c9fb3ea096cf9aed620a34e5c7363088a20be2be7da07be4f9f55b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb78000000000200000000001066000000010000200000009b1c18838a1000dcd1a4a9d69f23c4776acd3c82f932d5980f64c003ebf3a496000000000e8000000002000020000000301e50e6669a1e33cf078bb1d9b9e160c829a2a58996ed96d21ea4b42086dd4220000000701f4fef2c985fe2c666733a06931dae8af84b51ae7ba0ebd40098b5955072e5400000005221b65dfcfef11b05134b06115e2f298ad40dab76e8ae1f34b229ba870a28c2d5838970fda6d168e0d615860b95b3396072a54f2bbd0bcca36542429f977a7d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2644 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2644 iexplore.exe 2644 iexplore.exe 2764 IEXPLORE.EXE 2764 IEXPLORE.EXE 2764 IEXPLORE.EXE 2764 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2644 wrote to memory of 2764 2644 iexplore.exe 30 PID 2644 wrote to memory of 2764 2644 iexplore.exe 30 PID 2644 wrote to memory of 2764 2644 iexplore.exe 30 PID 2644 wrote to memory of 2764 2644 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\66a05390a0835563b5dcad18b268662e_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2644 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2764
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52480bada376bb121d9b3c90e44a613bc
SHA1983d912c56bd8a95f79c06594192f7a1c363815b
SHA256a28bbf235d76e698e7d1d20f026a16056e08d3b03e3c35ca1f8bba9d42986389
SHA512370bb6186ad2436abcf5eef1b51150b4f1d423880c50f2c021378906c5f1e4f7eda673fbda2d4a45966fc10ed54645bd078f74a61a01ba80882f0899e6754cda
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52fab364cd68ab12a510ddd9b28636d7f
SHA103b73b7f15946c80221fcc9afdd00a2d8704898e
SHA25603b06ec40e7af9f43a3615d1d31d6b015f735cbe166233efbd80e962a9e0b7dc
SHA512c88d0392f6ad14c26517ea1669c29d230c64d064f0a77ace9229c092613c372dc2518b5f048e98cc09279a8621f18c58a7dc29ee9481b9bdbaeba973ea03ffde
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c528b205c0d7d1d1a2c652b2506d81bf
SHA1ee85410af228f55ef0f354bf762b3e64ead994a4
SHA2569572d33b680ff90a51b3e5b152aaad344184d8c8ab7ab2be09f7ba1f53071937
SHA5123e29d656a34c74335e5ad5e79b111799c97500efb99d2a50dae9ea043c7ea702e49040d945bac527967820aa4c1ed7d2d7c1b7240aa34edbef3662d754daf599
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a534eed5be600818a50f6a0a0477ed4d
SHA140bd2f63318626f0356d4d18f53a477bf40fc5b2
SHA2560fe859a3d6cac74d2aab6e144a1675c2e5b0ba050fae984ab289e2e861a5acee
SHA51207ac6977629dbe123bbe4cbcaaaa79aca87c4a5d34f65c0bfe3eb5dc28af9c1cb042c361125bc63383d2867466d653a1e7ab10b29f01e8895c850abf5cf4d8b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50302670fe0b313b7425bdab921c7d250
SHA18ceb26f21fc9db27c8260f9a72454b46fd089cd2
SHA256c7ecec3a1a2e2607ab05cbbb95dc5f5fbe524e5ce938c03e3b948142e5edbea8
SHA512c50ad1557738e1f42ee62c17eaff2368d7d826da4b68efe8da9f919cb3bab778d8add32afb181c017509e07b6869b58ab0734c723cd677fcd065a4810087e422
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5096cbab41a841dff115411c85ea71cc3
SHA168da3ea89989c4f059a7ef2f42dee2bc24b1c75d
SHA256d062844aaedbe5c9c053796b61f035ae8c703e01bd757e02fcef39d3d0ad34d6
SHA512239009d859e9ce7dd6125671b330c822686986ebdac158243aed3c8f857bb297d2f570b61fd216f3ef6baeeafd0815f66cde31b36348a0eb1101c0e2a7d1fd3a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58e37b8f2ae99b3fa1a6f05842cd9ad7c
SHA1974b974458e39b287c853de55a3ddeb5e3b06fea
SHA256b69ec1da907c5c3eda9c75aaf6734746f7c8149354531d5b703d3c2c05ce0817
SHA5120d60e195bd77523079fe9b3eed6116d5152dca2938448bae0c2d6138917102661f65da192c0916a3f080605342a71e3ee39e9dbccd3fb75b6f6e1d331a88fecf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD565e9edb5c6eee24711877a8b6a1f7535
SHA1a58fcbeb4ebaf5dab171a706a487c78f45302049
SHA25636c4ec3c6f3427e5f2d5ba515ef51ed931ca1fa19a05260928a957e565b618b6
SHA5127aaea5b038175518473ff483ab2a518426a2977fa676b0f97ee56f78a3be40fd1b03801580f2c5e98049d8ef0672e4cf59ac95b4bb3b2adf295d3a5d3d0a631c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59064c91c0cf202c9fcade45091b149ab
SHA12aa6691932d2b99700cc56e7ae092a1ee657ed2d
SHA256740927d6898f53167a113cacf5232b296e2cb97515251db3f9c5d48b78783761
SHA512a41d1df4b66a62a9b6ae257af7467ff6c5e9ed652740e421ba2e04fc3753a1e357666525f40fc1d07f44655b227103e2b57d1964957e1cc289835a93f68bc961
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c7051673d85e0a81aa523e59b1306a31
SHA1b7f326fe3db1125e02b4c0a99e800863bea68f1b
SHA2564d3c61c9921995f3fd282d2c67a045b3f6744ae9477f8d14c349d49e172c40a1
SHA512a802cf2b1dd52a4f6dd9a44d0417d130f5694aef531d78b7c558c7efd032f7b077936bc31a0d3ee5441aa2d546b55cb200eb01863d0173335897d5890e0c5597
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5150185f5d537233249d47b02c878c363
SHA11348beb0c801879b7022d382ed9dca2aef537357
SHA2567dd60dad75193186a2980306c1b6e52450d103023f8c22fd3ab4ce8f71734092
SHA5123c13c747e988479dfdc8cccdb7892e9e96d0f4e6a6b87a0829bf61ca722603e0d954b7201804293a5c12a10282407ccbb5538f312dda0ad1a5ac8eee4a19c05e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55b7858c53ac0877b6751952c8881af46
SHA1e441c85a51c47ada87448b26b3e53bd0b5ab8436
SHA256288c659f6ef18615178ee6467a9379f038c9e907f8e0095691cfba27b0733cc9
SHA51233b34daf05955b1e33ec8bca4c7887a8265622d4a868166180ae34177ca91b05527171c616fee936e6a70da7f6d9b6a29e422a3decb2ef6b7f76e25789fea41b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5910f3c28c0b03d9e188df256384d6de9
SHA13bac428d507c42a303f5be5cff73b12a63fc0b1c
SHA2567c3bcf4d702273e2aac41b2dcb36f42c4d26e473923d16d83f09819c7598e7f7
SHA5124a2b1d993841f669656eca259f48fb9f030a122f6bd95271dec59d68510aa20417aca0903c77fe190b5993f9e01ef741c47b482063428baf965dba2e8a09d9f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD521a1162f94d0c949f9e1844b2c9abfd9
SHA16a3a79bde173589a4f143ab4b668c561df85c0c4
SHA256af1d7349c1cb2f64befe7498cdefbef9cd729b54793a635de5bb31185055f038
SHA512316aae7e073bdda23e3fd48d8d050ea97c75b442ad5c183f6f5fc25a33449f5b48323470a628a2ac5990e2cd8161fd047778f184aed384077b2f974134e16b5c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55923e432761c1978e0bb8250b6aeee76
SHA10823dcc6ba7877fa7b1dba4293e045656f46b75f
SHA256afea0cf431077704185c4432605ea85ae23d45c9ff2a74238a9e96dc6097963b
SHA51298c1095cedc9f8a393a226b7a7a03e275103ff6974911118124914157dc6838636ab61d9b949fe284a4575bfb15c9e54716f2bbf48fc7df339a681edcc0a3bf6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b437e0446d7913044a0e49354188cd63
SHA1cf8fcc454717264fedf1c43fbfc6109600045b3c
SHA256759fd780361788c7261d24cf1c0e4b592b842c144a716f12edc6c9b4823666b7
SHA512626816fc8790fd1090c8f0d2bdea2c1ac00402ce1f8b48633bfa70acd322488672c28c4acd9bda3429764b0d4a71e61b20240f640d89ba51e16834d7e4406436
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e2cc093cf58ce145ab484b527e931c5a
SHA190dda7be3e57b737a69123df926718629c3f1f82
SHA256d1c0bc0eb1bb0ed6ddbff8315ddf0e39cafc443c5913027ab10f74e76de7e764
SHA512908eadfc6e22ef007146c437f7c9c79f244ac0d8c69fee77087d2ff930652c8a044ac86fc21f3d5d0edaeceb7a6fd46406953ab244dc5a68ae0903cbe32df64c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50956a2514077b25049fa52e15b1e4ef5
SHA1e10456ac0c6b9948b8b6b4ca2f0c543baa6aeffa
SHA256ab8a04e28d7433f4c86bb8428ed4ac6ee28d08cc40826324f581e0a7f714bffb
SHA5129afa4da98240f9164983dd9f49e05b9cac729bd378bc9697f06fdae8cd53f37e173d3c11283ac35fbb5633e044b33d1a2d5bdce6f7694c797ab81a408db7d299
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5acb459c7eb640e442bc216a66ea5f7b2
SHA122223fdb74b419233a881383c1bd93f2c3b4c30d
SHA256be815c5d2eb66795ea7f807d7653a51a384072cda058c8894d2566b9ff03ec2f
SHA512bcd2ae11647a8fcafd34dd52d5d10fd00af632547ee05e721371b81ba0921ba6f5c4e939a8237808f841e24ef474a7f7327264b49c0a1c3643406064f014f4f8
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b