Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
12/05/2024, 10:29
Static task
static1
Behavioral task
behavioral1
Sample
39a4565cf50572a2104b37b0b970e4ef_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
39a4565cf50572a2104b37b0b970e4ef_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
39a4565cf50572a2104b37b0b970e4ef_JaffaCakes118.html
-
Size
10KB
-
MD5
39a4565cf50572a2104b37b0b970e4ef
-
SHA1
bb99afd0f8d803c1d4846ed63ed908c79142ee23
-
SHA256
3a1e6178e7d73f0c2ca95fde12359afc06dd271590a58e72eb57a25a8730965a
-
SHA512
e1ded895ac0e42a830895d8fd88584631917412423a33229a9909729aa8dfe4473a8023d06ce6323ed6b0c489889d5bd7a16e3f083563b82b25cff76bb0ec752
-
SSDEEP
96:YiJbEWOWskSgaY1hbKOkROstquFa4h47VSGBL2jMZXTDNmgOWyE+hs+yJDTIjV0W:ZKLRvtqufCQGBijMFTDNGW1+2Q9
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000b841d5b8308d7545bd101f36ff73d411b1fd717f1fde5b641e697a60c1e1cb8d000000000e8000000002000020000000924d7e47dbc1257e83a2efd75f9f8422f0cb9b24445a8c26c17c4567aff7b9d9200000006d79e010d787b5b687272a598ff83679c2d918f206e1b6dfcdf4c454c9df94c940000000c82b525a148a212042430d830f754d3960449aeb86450dbb385f6facd3f22215f69fbfc0cd5fa45752993c9a911c21cf7cd7b2762a4ec01051b7b6d734f2f821 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f036ea4857a4da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000009881b91da8f428ec0115f3c8d244304c9e61233c2e1db0f34b28c289697d4dba000000000e8000000002000020000000911ca05260bbd39c8cc787c08d19b166ab3612aa9d42a4dfaceb33bd9204ee4190000000ff1b71c4dae7cbc034aab031436fe8b822d6a9298ed6cbdb612bbc82709922a92e29487fdf29ec91230fb383df0506d1a23190f727738971fee53d565f56bb0ad6c78033cff995c1bdc13cb134d3338dcdaad814efc34b07d97f7126ca8c09f5e8287be8b5d326a4bc54f4200abc0283ada19d2ff502e21c3c173852782f9e6fa077bc1bd0f271d9fe7fe0c1eead74b8400000008db74954f3c88ce9aed8b1dbb186d13b830312656c9657c622ab9528fa7cceb19ae114144ff6b225f65781d9ead6b982d3bc6bf0135df1bd6c35b6189bfe120a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{741FFB21-104A-11EF-B8F6-D6B84878A518} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421671611" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2928 iexplore.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 2928 iexplore.exe 2928 iexplore.exe 3052 IEXPLORE.EXE 3052 IEXPLORE.EXE 3052 IEXPLORE.EXE 3052 IEXPLORE.EXE 3052 IEXPLORE.EXE 3052 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2928 wrote to memory of 3052 2928 iexplore.exe 28 PID 2928 wrote to memory of 3052 2928 iexplore.exe 28 PID 2928 wrote to memory of 3052 2928 iexplore.exe 28 PID 2928 wrote to memory of 3052 2928 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\39a4565cf50572a2104b37b0b970e4ef_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2928 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3052
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD566a0bf4df48383fd73c439e9f6b5404a
SHA1f0cc9787300feeb7b2e83df630db404db5674078
SHA256953f53ab7bdecb6289018f8d1da820fae39b54eb27eece2231fef842cf3dbcdb
SHA512db98131ac8f03fcc2c880ddd6958891d5debe9f36dedeb47a359d1f633144a12c89a47c742c5aeaec9fbe9ecc28978452de73979b2d1a3e611b19a0a40bfb9d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5416a0312c216f6da979f97ea43c3403b
SHA112c05b800d4b9f8d0c29a15963831d3964152114
SHA256c8503210ac85ddfbb649bae8ac84e559e4747267ba25e85490a471151cf850f0
SHA512381b4a9c628a77c6e33236a011dd4b6fd45122e8b05aff7f1e61d07657e062f41e26deb3bc7d41a1f16e3db4ecc986653a1e4ddf86a6de9b4ef468e4fb997f80
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b98cc20a9e2a27e584e20fc72b9bc795
SHA1ea5aff55774abcd02dd2d716127f2c8a695112e0
SHA256615ab7b41cbb9e1207496c6170e7a9c3b3d14aa13934487906721bdc99b565c6
SHA5125d59731bf49d8b97755a1e66dfbbeba4ff159d93923b1505585f3d555940716eade708f453dffe8df4fbb2dab7c93aedd27865221e7eae059b9dc77b5b0b9df7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD543bdabff189e51ced3ae9316ea5e3f93
SHA19ae6923162551cf41ec9affa2d1f230d4718411e
SHA2566e43fd9073a896a22ba17354203fa5308d18b63c73bf6b14f3a578cba91ed7bc
SHA51281bb34b71589fdc95710b3585baaddd9bef64fa8f51ff9d91532f7d863b09f7da79f5bb85e03ccc552cdbed9aa9b2192dcf16048c412b9a0482509cd43f0ab2f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5165637811eddff43f3a58dd4478ff571
SHA17d7ef82a9616a3acb3540a7126b13613e90ae05e
SHA256026d15659253a93641678625eb75c762ea91eefd8b3654af7340315b5e6a1905
SHA512b4b5244fba4da0e67e8b198e32d224ce43422ec215230282968074cdb98bfb26ab7a5b99246132f8079c1cb8ff205c42782796948f016d205ee6945de6477f01
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52dcfa374ba8811089879ecc8c6b608ec
SHA13676d2ee23c6d504d70819133c6bd6ff0b0ab373
SHA2563189e3173418e3fa35f6b39f43e1b7e181ebc110054406dc0d383be965328484
SHA512394fec15c1d2545dc01b172b0c0293749adc1f9dae569e28093035f6c44c2851ff3f7e879e38c07915d386d4e741acffe5d23025bf51a84a6d5213ca73818e49
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5661e34f69ac5ce477707e5b1dfaddeba
SHA198a826e944e24ed2b5e40fe6905627f0766eaab4
SHA2561924effffc7ff76648adc0e640394aa274059bb04ad836429da9267b2a024410
SHA512b228ed4f15d11ad9835c79acbe426b868159709b31696afbbdff13c7c40751e0ec89363a8da162f2cbfc5868b22953e63a465493acf828c7be13ec96324b41e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD552eabcdd5cf5e76dd86c0caba2988703
SHA164f31a018659cdf1403655d37c9305c3dc57bf4b
SHA256a5d63a7def1be33d0e808466dc8dff6f26c0c06436211221ddc559f7483cba3c
SHA5122c6a8cbfeec6381b1e2e2f102f192cd3f9d53b7f649bdd1bb94393028a6ad2319d41139e0415b9c1d233dadd904d9d5d626609d72d3113d2b308ef1618c50543
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a1b63a719284dee8b7a7b056f6857a51
SHA190fde4261a63f6048990e8752916e571da8f7e04
SHA2567bccb062bbac179aa2f5e39039300023ef6653dc1c3d35d4d8d9b3ef0a4d2a1e
SHA5122d5154ea5aa1658bdc9c05721389560e89dd7d53b47edc8793fa71001f463d0b940ae696c3f620c1e06a76e23361786e4d15b444ef3419c33f0bc1ac1b1500db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD570674cf5ea75a46fd01fea9531dcf3c2
SHA15cf5c7e83d28d2e3802bcfa10a76a19faf3017bb
SHA2565f0542936690ff998d4d2b5b92420452d186a094a8a87d905ec9c87df88c193c
SHA5129029c57245c28dd47e8b16e28019dcb1cc61c40359e5a6e03bb60eed051be95792dcd2abcf56f1614afa81e5d20e31242df4215beb07c7c5fe8444a85cf8cf62
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55f91c09476fbaacb2d64072f6ead893a
SHA10f56cbdc868d73bc1ef6e60b418e893a908bb0e7
SHA2563f8077cf42bdd4940bd49a25ef5ff320ce192dc6f7128694d046f559187cb2b5
SHA5121f6bba3c8a455a34200a4a6f540f846457cef47db4ea65839e2583c655a14990877546c1115f43c1f2622510c6441adef66c084099fcf11d131d396904f92a5a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50056355600552119ada2e7d287b4d3b3
SHA1e72a6f5aaadd900a0f980695e6785c60bc2aa139
SHA25691d0a44196e238e5eabfaf6d2a56743463e05ab81ba2d76ef0b2d797e7c16515
SHA5121add4a76692991710b7ef1b094ed41b9b275f8225ed80b407e4130d8f657dad4c365ad589946cdd081996bcd5ae52cfcc19fb33615a2b6b1f3bfb50aaa8c0790
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a