Analysis
-
max time kernel
145s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
08/05/2024, 19:41
Static task
static1
Behavioral task
behavioral1
Sample
2668afbbde9f808ca8763cc17fdfeced_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2668afbbde9f808ca8763cc17fdfeced_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
2668afbbde9f808ca8763cc17fdfeced_JaffaCakes118.html
-
Size
35KB
-
MD5
2668afbbde9f808ca8763cc17fdfeced
-
SHA1
cd883b2a685335596ff2b8f9ea6ed96a2ac48c5e
-
SHA256
2cfec7d5339aed4fcfe625aa7a2d186f3521f3a5d630f8894a7629caf2269c6f
-
SHA512
7bdd64cb004a6ca989c2bda6d1b15fb09ca58f78ea56886be954bdfafe0358e635942e6b7e64afe8503230c6e8be9c0f2c68436779eb3a00c6dbb4b7f52faf07
-
SSDEEP
768:UoPY5kJa0Jw8taj3MOulQBY+a92F99vB9f0xg9Lgc4uPl7mWt+PL6X:UoPY5kJa0Jw8taj3MOIQE9cxB6g54uPp
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000256fce5824f06f065bde9590c18331241e17304b98e77f27459dd8f1e1769c05000000000e800000000200002000000067dabb8c73a55b0396f6222aae8feadf987b63d2496c4ffb48dbc9ec14ec5e9a2000000031902670fa22b678891840a70043ac072f541f410adb9aa4ab053b48e23e5bb2400000001c73801f364ed123d13cd7688b7689fe6aa5c406b3e1cb7be91e4d97c0c29f09cd94abef371a69e6088deaf5123b65e44593cdf7ea83b34ef3129a44d3f55d86 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421359158" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F2D503F1-0D72-11EF-8962-7678A7DAE141} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0b706db7fa1da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000d56f1b85e0ff6e6d9e465c8e43678ff1e5914bab2a341d9005c452058447adda000000000e800000000200002000000012732fa1686a1aaf700035afd2fbef0afe0c0e8c85bdbf0a38a42ccbe35f328090000000382621a7b950cb7d3deae4791ac95d75d42e1cb8e20cf163bef35d83e70ff2fd78e47636921317a76630b7a2a5b5a7623be6af89f35ad7e7ff3075ee68981a4b95427075af267cfa607da43a7bdc0afb45f38e730e6ed968ee0b06bd77f846c13a3db8fe61bd53cb085aab5390fef32bcf82c0cd6c752b1083c0e5f3772a24719683fe8b5cf83e42a838b9e9884217c640000000cfea4369904d7d149d50cd73cc60b57caba1566aa6ec45e01f82b95c70cf36b401b4bce06716bcc8bc82020a387a01bb18e991a67e95acf3ef52fb6dd1df9de3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2556 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2556 iexplore.exe 2556 iexplore.exe 2616 IEXPLORE.EXE 2616 IEXPLORE.EXE 2616 IEXPLORE.EXE 2616 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2556 wrote to memory of 2616 2556 iexplore.exe 28 PID 2556 wrote to memory of 2616 2556 iexplore.exe 28 PID 2556 wrote to memory of 2616 2556 iexplore.exe 28 PID 2556 wrote to memory of 2616 2556 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2668afbbde9f808ca8763cc17fdfeced_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2556 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2616
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5638e52a875f3265f5a665e2e9c67b75c
SHA10a9f5273b683e75719aaa91aaefc025074a74b6d
SHA2566f2d9f5a816eb76c94df55e44014457ba27d8bdac320938dff9e3fa191550855
SHA512a369380ce4077d497f09b1c5ac73b3f3bd4e86e46647237ade2210dfdffda72f7996973b6d72ddc78986fd868be39b8cea3ee45cfaf2ab038af5e6ba060a9d80
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5003b7db6c1dabc854a26c9093c621fea
SHA1ffefdd27ba71e309e6e47973c89313e5ea4185ff
SHA2560748d2ea93287df29ae2b9f3b1a075e022fbba2faa4e59e4c967649973a52a9a
SHA512f6df7f1adb5da716742bf869e0b287acbc1bc6fdb22fea4c42668a6c0cb2c5a169a95ff9423f864ab85d3c1997c370a7e38412fb9a12256879d03a0080750d1a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD516344caee5dea851b52347385f30a609
SHA165dd4ffc43d8b062f66efd402a9d014dc4711a4f
SHA25669ab866db797b6b07bc9110f84feaf0bf0347d879113a83b7cf5190f59fb4cbc
SHA512025e203973eff62584385eef4454708f70ffeab75f503b178e963bc23efab72ceb851c4ecf6e57508a61f535dd927f0905645edd815ebf5f730dd2c7cc5f8e73
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD557fb33253631ce0a1acf3ab11bc3a937
SHA1756d94bd9e2f4bd8c669726af6b27c8fed1d04dd
SHA2560ed6d169c8f99156da77c98b467b06279c07f138cc59eca44ade83a62e9caad0
SHA5122bb84a3b7b4bb789e46c12d46c497d67bf3b49cedf66e8b4dbde0357bbf3b2e80df6cd945e7dc3dd2c74e4de9e7a9a04d4ef830ff12de246f48478c1f8047cbc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56746849335fc8a220006e6428e8333d2
SHA19d94dbf6b26d42122e082db37f6c41cebf86faf3
SHA256c124e9021a5871a05f92e641d46956243bcafb041d8cf185ac58f4bd38488920
SHA512f13bf5e73516cd66c23f226896f68da7ba74198daf110097e4b4d6f85166de14ec3742c6d184928dce71f786de4541960c9c6a97d6b11feebbb960ac4198a9c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5903fad2dbd55fe09002685b6aed662b0
SHA1d46945b989fa27bf2460dec878742b898e9f641b
SHA25664a3553c4f43408b93835db8afec1c572a7d33deff1094179d357eea58343aec
SHA512c38cbce86c5a83b4d05931c1499f02ceaf270a4cf731a2df34658853d12a2381cde9b14f6ddb537dd9fa0df92e70c169b1db9a439228ad50631bdfcb6669e292
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD536557a454af6a215b20cda8e2658bc83
SHA1b47abc8fde9c74e83cf9214a8f3174c558434950
SHA256cc2bf7373db4ce9f833062e72bb7dfb0ca12f1b3ebfaf7ff877e62c030bd49ca
SHA512fe9e7dfe2a2811c9e2d73a6a4e76aee3d65f988bd0c37fcbf1305b6da89d6516be8fb380f7b1d9ee936de80846e68ae981d368fd48ae32cd1d2dc6d393b6f826
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53a06eb688c0c84339c8da93c28136f7e
SHA1965eefb237e949b84d49e11ab3195660fe8891a0
SHA25655423d3f73e10c271ad2d0eba349bed2845f9ad9aa12ae97113d5692ab48a815
SHA51282cce1d7d73202fa6b4c40d6b651307c903b402f7dc99407b65c12fb572db3dff1f8813c7244becee80924895bdb0b032a56dfc9f145af797f9e1012e8ea8229
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5224f667397d3b4eefb3352cfa9e0ed78
SHA12587d1bc6edf23db83a96136d1871aa6731177ad
SHA256294aaab377b27e7f07e4ae86d60fba4f36c25461badd34a52c50e47c4d24eb2b
SHA5120eabf92f0ed89efd27f2e829732515b9ab496838fa3a4786c212402f32f5a6927b09f8f18de951c41e5a5cf97b4257e089fb7791420f5571bf0d5896344ea7d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD583ee1be4dd4c8b416727e86031880139
SHA1149dac72a857ce5d367fa76ea8d0762792693a77
SHA256208110c26e5d2e32c3fbe08363adb76f4fe41c0b99592f11ccad858422cc530b
SHA512bd868af0a9a74162bed98d38d8a74a227b2d95fe7a5522bd062f268c68bd4d95c4b87a7c022929e312797cf27525aa0069a591b24d29a4c37acc3b58f7222b4a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e7a434a2fa67381c5ac0fd4129ded6ed
SHA18ca44e887427ee440936fc7ffd23ee509f994161
SHA256634226a83ca03407b1ca215e3cb86398f656d90bb8a297055b3ae33718f5ad9a
SHA512452bb9c35abd824baa670aa12c215b8a76f657c71a1342d009a295ed973365393b481faec2d4647ab1714e29bfb29e82a40d23d3586aa18748b945f318b44491
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54658e5f9e654635fa4ee64767906a1ab
SHA12c183f4eaf77cf1150cc3fd4a52e63581ab49412
SHA25634e0ef3fe4e91ad0f9536439b95f095f1c579a0183e1f3efb5bb89854fb67dd3
SHA512e292389d614b875b53d9ebc1482963370619f9cac51aa20b3ada58e6c87c7f30fbaff9697fd9b127c3bff085a15cb0d75c01e9ea1eb8943daa06f301e47c0e2c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD586a4b914a62351518f1df7b9705c883e
SHA17efdf06beb91b1274e44ab1f4bcc23b24d91d807
SHA256242b5227f86f18236efc67e08ca91644775b2bd253d7abe2f1cea5d94e065802
SHA512e75c6be00ab75a49ba38da5b93818427cca19aeac240d4dca4ccf3dd7bf8741bd5c1f0458597bdefa6f6b3a9393eea4db2edba94d59b49fdfcb4664c0fab9dc8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bac0284241bb8b4fe6044c16af48b944
SHA193dbb6b4a16afcad2e0defbcf5c9f1a6ac56ad35
SHA256a1ff7fa291ff3a7852f54ba36650fdb0908f8d455067bd155ae1036e1eebe354
SHA51297c551d076307d051b8217d140f7816617ef748d4bfbaf43d7c90943f02acc0b15e8f9fbb5878d53f951f6225908bb932f7ec43008010d3af9c2244e1a494e79
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e4f23a49279d0bf8b26c17321737ed64
SHA109ef60efde90dc0c4a0d2e1b01c90deb1880abab
SHA25641de2920dc5d10b115159eef7445fe3cd2a61c5d8ee078b93ba6a7cd655b9dfa
SHA5126ce428f55135485d4ba8ff2067c296f046d2a73c30061aa0d29affec5dd8103b0050b1706e6c52cbf9a76ca1b29f5eda6180f8c2c98863a8544eacf0b9e45e52
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c6a70ff05a8793874764ce56e16eef77
SHA15881ea42590511ca0460b5b7188aed818e6a5b2c
SHA256839c955d2581e712d71c76e4fbf3bb1cbd37e7ed9067ced027021dfba5f61755
SHA51254aa9a04319e07321ccb73fd4daffdb90e174757158892ef768ec7ea4d6eb3f501374d9ecead1aa92415971a514d3ef921fb823d986c748563b88a4c0c9a711c
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IO0LJX84\js[1].js
Filesize46B
MD5ac946a4835a75bc54fcfe718c372176e
SHA16d1ac65e9393d5b8652d22dd72ae1d2752a4abf8
SHA256d731edc8bfb413bb22baf7f0f1bc42ccc2990b7b15b148b5a6bc8b45d29d34e5
SHA51258820c7f223036cd1e8a6837f1b2b4fb9330944730e5127ea0035fc8bb554240bd3e7835c0509fdd0f8c6cf84373f4fe8a36f242953a42dec9a81105d2133d38
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a