Analysis
-
max time kernel
134s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
23/07/2024, 14:25
Static task
static1
Behavioral task
behavioral1
Sample
67eec1bf7d613a6dab0841e42d65588b_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
67eec1bf7d613a6dab0841e42d65588b_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
67eec1bf7d613a6dab0841e42d65588b_JaffaCakes118.html
-
Size
16KB
-
MD5
67eec1bf7d613a6dab0841e42d65588b
-
SHA1
36c3cdfdc39e0214327288cdbcbd243f6b6c4512
-
SHA256
c113effff5cf7afc28361cd7588c512c35ff8e2060b270ba8f96d97852da8edb
-
SHA512
c268063f229142f4452962d204771416100b69c81a39c4ac8de0966a05018a2f519691b8f072efe17a6548604ac674d705761e2aad97fb83838183e491d7d4f3
-
SSDEEP
384:EEUFhAzH9IkTsK1OZITl4ibIC9CwfyNIQC52ByQMxDK6ecJT9S91XzCv:E7F2zH/AK1OZOT/SJa/VszCv
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb000000000002000000000010660000000100002000000076b1ea7bed45e3012cc1c71a7e4bc41efeeef95b434084086b1c1bd3c6df6c40000000000e80000000020000200000005a442dcaac9731d86182cf84f74b31bf7c24079172190a3445f9b1d981620e16200000009ccc8eb7f033d27ae0773adbbb7dc5fcc4570d1328e49da8461ed8aa3bacc9d940000000e0703cc0e600a62b88d6b608987846badbea8818dcf0c2fee44e894a6280ce07338814e5cc66ca9d02cce837ccb9ab09822f51133fe92f8c9cce3ba44b4ca70b iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{742C2061-48FF-11EF-BD1D-D238DC34531D} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30e6df480cddda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427906615" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb000000000002000000000010660000000100002000000057aa3a1c3fe7ee6a99b35299dac985d894dd507a60a358ecdaaef72035dd07a1000000000e8000000002000020000000d467bfa944f7a86f9673c581dea5e3dc881685816dde2672c70b070945d2d2dd9000000034c2d3a67c06605f2a278101f3e8c85c0fe677f622349668b3daafb82d1340846d110e31d7075b1f33337f018a576985b40b2535705f65e7bca0fb32e25bc031c9b95484f401ee910e17a7547cf4d3f2862ece06414fc7ee35d2572c8bb84e375b3c5ed871411aa67d92926d57eaa4705935404ba7bd4f5fdefb32639aa571cce687db380ee6955e47e6701dba1a02434000000027ecf93fe47f0eb07d4817044edf8fa5e30b7e3503f64f52be74a95b3f063a47ad733ad7ab72f740e5f36e9cb374241915a207e2cbd0a290c21c974187256efa iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2884 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2884 iexplore.exe 2884 iexplore.exe 2900 IEXPLORE.EXE 2900 IEXPLORE.EXE 2900 IEXPLORE.EXE 2900 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2884 wrote to memory of 2900 2884 iexplore.exe 30 PID 2884 wrote to memory of 2900 2884 iexplore.exe 30 PID 2884 wrote to memory of 2900 2884 iexplore.exe 30 PID 2884 wrote to memory of 2900 2884 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\67eec1bf7d613a6dab0841e42d65588b_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2884 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2900
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59ca941a1d93073961557009703a81d59
SHA10fd622d92fafccfbd88c22c2c8da094a2c062a3d
SHA2561603e360d42fb570cd834b4b19baa38a0a5494fbeaf0332a15e398e4e77b48e4
SHA512f86f224c322a9d21032a7d4d87098e82e52d4e546767eb23f32788b58baa0857b8121f6258a6252aa37b346b81a6c977b389a6d98d31610d78151081aef806d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a0c4447bb9d1ab1b0b5ecf45dbe9dd1a
SHA15864dd62b1d77ac0afde677cbd25ef619acccb12
SHA256ad3fac86cb518fa2e505ce2343351d3366b883b9d5661d6c64f41ee45c7d91e5
SHA5122bb21dedd32449f66d705ee98d56dfbcd1a5f2b897679e670283beb864b7af68445e37f2aeea01a8b9980e6746f047f3206a2adcddae91a79c63083f6cae9ec6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bca8141e749e3cd992ef57fa5bd94f6e
SHA17772ab1975ff110b86c8ee0d86f112949fd2d4da
SHA2569f6978f4dd8c816efe759333c276a507b1171c1efa8f217129eb233bf913d3e5
SHA5128844891219737a356de8539fa8f2deca0233a1d2da21873b30bbdd94a93b2e3536e81863b24dd33de637fddd8bbad119ba7858cc589027137fc8ce23c66fbbe5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56d2057f8ba6a9e5dd6e49dd71824ba99
SHA1e6b1016098a2f5cc7ba0b83bb0fca31ce59ec3ff
SHA256ee7d05b26636f672a22843803bce6cfb357c2240edc27191a31ef8cad3babb89
SHA512252b2fa1f1bbf85b15c9fbda425a9c1a52f364dee7ba8f32df0b11bb57e505305346050bd5447eec04a368f48b40be299fbc71902192d38911a077dd2e38bb94
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aa90f2ea6ec8cda21ff74130e6135029
SHA1c0b5208e3827ef7e5a0301b5143c633425444d48
SHA2569dde842f4748e20350cd236c38eaa8d8a4bd1b8398239044f71703b5c4b1c4ac
SHA512655b3191a8a2050c12da91c47d8ee77c2de0e77f3d6369fd55eb796286122245b174f6b9d9449e5b5b609d5411ceeb8f3f4c2459d8f0e7f6579afb850b9740d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fa7fb3b22322422bd30e87aad2cd5ba7
SHA1ec5fd85efeb872d9628e279e1d031e3571db7ec7
SHA256bbd35f0ba0f0d827756e9822ea534ae6625c307000ebc8a55c0fd7c7f2ffc23e
SHA512198a72bff6c55f535a8eeec4a156c17f93d48bb79ddcae474db6d3c61405e385161b0307031df605ed14862d1552573c8f5b5736480082b4fe1d15ca675b1af1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5104019189b437ec1d6bea219928adb39
SHA1de78cb2225d961eff87c4b2694f86e37d8631936
SHA256186b914ba7477634940080852031be2d25f1d536951dc90ca9440490ff3f65e1
SHA5123af5e8ec5f2f875db1095fe95ffd4aa2672e260613838f516d5c9e77fa6d1efde420dea1ec1d56f88d69d0b7efbe727d98287d1ec070d541555775472f4cb89a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5226f46fb2f4ccc5a6efa412fc8dcaee4
SHA152195390c1259d955b33accac45bb57a41cbc70c
SHA256ce3dd2126e6669f1cce388a9089c06abf207f646c353c008e6e5a2e4f8f628bd
SHA512f979bfe4ca6874ea1815762a08fd5c72c2e40bd782b02910b781729268830b8223957d3560e109030c48fb70a6fd3c05fadfaba796a55276800a3bc67b6be9aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56b9a2714909a2ea95906fec349bbb3f2
SHA168db12b676b00f6f6e64f33baff603062ada7e59
SHA256343326acefbd9266d9cdc3ac86ad0120523a51ae0fc1251e009c0483e34541c8
SHA5129c1368c7b3d292e912c7ca8bb8925890c8314d2d27977d57239e34853b9d1f287da806e6118b1bdf1854f63fe5cda5c2e971f0cd1d77bf4bd1004c1659788db9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55d64779838c922a64ec6f8fbc4375d37
SHA1c3c483f87acc74cb60463cc640e938f25ea32a1a
SHA25623ceb11c5cacc29a2021eaad33162377d2dee9abcad4b5b8737b18b80f7c1a66
SHA512f00290c14a2d3aa58898aecd5e3c317d8203a0658b47e14d5780a0362a6164224aface2ae37d03d8392133352c81baec6e9a14a8516c01995aed7076ea56ec22
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cefd373eb519d8ade65c73221d945d0e
SHA158dd96fb596dc45d2229e17a5619dce1e905b070
SHA25618a6ab03192c45f1fe8af2e9bca904d744f4e9983d5415b4bff91b1f7d755de4
SHA5126abe5d1dfc44ea9810f50ad9e6061b08c7434660abc1c4ce0621388136d8bafe086f68c91fadd66688adfe6e31aac905c40cd34bf317c7134e8eb08c690620cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD508018060c99b4a5dc7b57e6a06de00de
SHA15824a8b98842c79bd78a78d3824c9a5fa9aab971
SHA25645d5673701dc7623ea046464f856dcdbd403a5eaa93e4cbd9560bfcc080f6670
SHA51258a1bc2645593997c8457e8b18ccb210b7dff95981698b1a292b10e35b10fc2988d5457a085587bcdf8520f960401ec52f71092db10daf4873b22e5bc1323d32
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD549d7523ee7276809fb708f77da6ef7f2
SHA118dd55e8336d301b155a7df5a96ea127e55b263e
SHA256b633fa0397927aca530cebbbc5c3fefa649b6cadd78b6eef545a018662378312
SHA512763572bff255d6ea6cddb61aa9cff863c3c0ce58a96ef30e6e2e4b7871f2337093c31189cb12dfe97508609d006d8bf3f5f304a52ede851e90dfa0a630f358f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56a11f7b1459a3fbc6d2c8c4b8cd24457
SHA13da2245c68f9519fc22b810662989189132c2e96
SHA2568ac8e861398acdf7ac114e3e9ccdb49cf67d27b121283b7ab70e51f80f3b6bc9
SHA512129ade229254cac324b126bc8a743e64bedb1b7caa70936fea999d60eeeec9867c4954fa1147506eae271924be603efd3468abf076b7b1c4525e71165b6c7a0b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59c362e8bd9faae6c999cd11aa17e6e7c
SHA15a95821d03c9126ee2cea43635357d5b29585d95
SHA25625c01435c3cbe00189f503eca2ae87850e07f9088e8ff58bef6f40402d60255d
SHA51278a4d1b9cd4b9d2204081ff9aca6843a754a5763f8295879af1d41388896d614682c4bd38a156fe6ad7bd524bd6399afa757c4a31e19d7c97fbd1df619622a4b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD504eb7772fe8c54e9d140ae118e0728c5
SHA11150ddc9f8fdcc25abae75f40a781d5fd0ecd0d9
SHA256541ac99cb2b2ef253c0d7ce1a68bec2c29c4706d4e6e67da74a764fde9dcdac9
SHA5122adc628bd38e6166ffc9c9cb6063b3db4de6a4ee9e659ae0579626655ec679f4acbc55722030c1fe554ec08e5f425172b343c5c7c1e61ea297168fd476e586f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59131ffbb445d8da6f3e8addc7d76413f
SHA1d96470173853e7626cac65a4931ee402b6c46390
SHA256311a6ec699a3ce879ae88af9aa05de9ef1de4a5f7497d9b06cf4d17fd8620583
SHA51224a4cfada4f18662b8dccf308973ddb2949314503d40cb6caf97b37837a16711ceebe65cc3ced2f566be76f71e28621dbd7c10cfbfc9b616884ae936ea0cd855
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5344c472e0a9559740a1d67e59394a58b
SHA1a6e05fc51b72107c655d388df63bc7a7632b1170
SHA2563990f238d259529abf99eadf13ccb85afd25aca941bb366f79114fa82db88b2f
SHA512b4540fcd2b044c8ddcb9a847550da16218417bdd5664871e74116801da62736605511cd06b40ccb0b547e11702651412a561342a550f1dc51ff0b53f3ec46269
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5514217ad25becb35449a12c1bdd6d81b
SHA10f500d40cbcf3551d58d172bcc4bf002f7b4ae7b
SHA256aeb8155acc260cbb76e7a568622a664066a7844942d7ef19626fa7fd5df10bb7
SHA512cd6fdd038647e2227fdbda251e81faec24899e49db3b1c5bd7fa3ba98e256802509cb57e9ee2a7e83499de0e09de3a90206ccf26a3c5155219d19d69b9f62bb4
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b