Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
12/05/2024, 10:36
Static task
static1
Behavioral task
behavioral1
Sample
39ac5005cd7d45a1adce8056c119623d_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
39ac5005cd7d45a1adce8056c119623d_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
39ac5005cd7d45a1adce8056c119623d_JaffaCakes118.html
-
Size
3KB
-
MD5
39ac5005cd7d45a1adce8056c119623d
-
SHA1
8c88d4f6c9c72176bfad64ed55cfab8d84ab9371
-
SHA256
528e04f551ac8c6e14043fb2b509eda98586e3e07219c0687366788a8b926476
-
SHA512
d39d4c0a41e3e48eaf9777af96555c84a9f62916d3d873f407573b46b88e05acf85e0684e177e0be42f6e6886b3e9f127a9edd09038e1a6d217023f4acf1f203
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8BA3D401-104B-11EF-818F-FAB46556C0ED} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e93610000000002000000000010660000000100002000000066f0e834781805ef850d0ac117546aa330de55a4871e526876c5406aa7fa6cc4000000000e8000000002000020000000371b36442901e87bd748e96387dd095277263ae44b1e4136f1316e68c7c92c3620000000dab0a9bfd8ebebf42ed08f40700b6550fd5354162822cb980a611bc4d444207b4000000039695b477fca61f1fef5b600f8e3a3334ca9a2f9dd8b165295b1857188d260a5b91160f8be065a66c9abbf009f382674e16d93fb0bc1a4039dbe34128aa97910 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000005ca1a5eca02b6808ed0fd8dc6707d1c9ac710e77f03befa3da4c494903e36554000000000e800000000200002000000048b1002b7be50bd2d8dd3cb110e092d8427e1cabc0ea2b29d3fe67f9b32b517b90000000389cee991cf97300656bfebfcf453740d2a0ce6a3bab81531a99e2a556da801db1db90a6a064fec1f6d6334023976a4845722cdeecf50eb3c14a60ff5492d03abec55c8b00b46e4f9daa9033191fb7dd4a57e50f187b468da45ac18a3b2a2e5ac6722fc15f0ff753b5e3c13a8d7e2375d9e9a192f079d6a445b0c050b906f1f6124a764f33d3cf7e4edcbeab516370cd40000000329c5e4a55e358ebab4f0d7687d709bb5d943153fea2003ea4d56ad0afd444c3704aada21fb9d8f037e9fd593e7dcb290e5f005b58c5255d93492a12b7c5517f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421672079" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00d5376058a4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1768 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1768 iexplore.exe 1768 iexplore.exe 2172 IEXPLORE.EXE 2172 IEXPLORE.EXE 2172 IEXPLORE.EXE 2172 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1768 wrote to memory of 2172 1768 iexplore.exe 28 PID 1768 wrote to memory of 2172 1768 iexplore.exe 28 PID 1768 wrote to memory of 2172 1768 iexplore.exe 28 PID 1768 wrote to memory of 2172 1768 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\39ac5005cd7d45a1adce8056c119623d_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1768 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2172
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD573055f980f841f6bd39a61da06af4df6
SHA1acbcd2ced5826fb1f18c51951f1b156a4142b4c2
SHA256c5307a619a9b1239486cf8e8e3e9a3aae6d2dc97a7238d39abfbc1cf30272568
SHA51259e9407bd73527886d2a939853deeeab98ff0016616b84085e804b669c0ff3a1b83b4de5235957e81e512b52cbf343a47f4e759fc35d68441231cbe968cdcddd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56d76c261e6ca584e265cf9a168a8f4f2
SHA1e6fa89c98872108107ff9a1a6d8ee6f9499646f1
SHA2568c5e619eedb3532291ec875771ed285b8d1a4aeac808f5471408c35dacab622d
SHA512398ecad320d60414ad8ab1eda4163972bba43cbb97adb085fccc1020a5446a4a850f1a5087d68e09485aaccb030ead653b0f267638ce0b67c905f19edc0913f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD507460af78ba32b1b77af83493b6592c8
SHA17fa583aaa5cacd8c0cde6df5104ee73614497766
SHA256c164e510877dc205cdeb7efcd52e39d55aac456dd1eb516802f88d22f3376699
SHA5123d2bf22a3f210d2d211a15da567dc9d65d725f07874e5a68986eb1523e070b195b7d98292b3752442e03479f0ba2867a493894f8be00c41a4fd8fa709fa8d483
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aa09ee5e738059aa1d32e8376424b1f6
SHA1647ed088e3ad96c511431cc7c8b1f5b4cd9f1aa8
SHA2567aa10e243bdca6bdeb3a7d172803451f1190659d427283f6a47d285d6bb83ada
SHA512eaadcc5b409ca808b373442cf18fa068e3e9ecf210677aed9abdea0ff42e27b22c1623a827995b53829b5e1c545e9bdf08ba565202ea5f43dfe591e63933b6e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53b09ae751f2fc6ae92b15bac718da3fb
SHA173dea9f9d7e4c58efe9a1e6f3d91c9b2d0d0a08b
SHA256a13a241792707398bd64f3344b503045b2aa48bea5d2cde41dd946f335f0b9c9
SHA512dd8f6d9c3b3d8730d94990584fbe45c70a9e5cada6f0c832dd8a71a6dd04633f131de2ac905c94d6d7ca4bb5e275bbebe05750d417014703be54b90faf9af58e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f170991a007a688a6a5fe52bdda75358
SHA128f3b6cd7d5ae3819673ffa5c7e9bb0b70ee5e93
SHA25691e0e060b9ca7d49aa589128ef28918a94d0cc32ce1992ebd6fb2e4c97f05940
SHA512215ddfa970c3b294ad5bdd7823fae4742cf86a8b90aa6b0d7464d881beebfe391accbc3c990fa5e71bbf397869ffdaa0a24b8875905bacdb6d4dff029d11b6d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5702c987e314750b0a0958241776c6338
SHA1f6497dcdc71efcb9c0652b30138ac880bbdb5e2f
SHA2561f72d88cabcf87bc922c50026c1313c559ffd63ec00572ce64a988363fdab466
SHA512e490ce5f3a0a2232fd0c57503399ceaa871136a9b2074e3b8c4d502e1408108c9080c17492cc96e3f4f84d55390bd3d893140899ec35ab5842535baa1e9db0e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e4eb534d99547578f76d45fcb9350129
SHA1e5f1a13e276ba600d28a0c2695561af0803136c0
SHA256bff9e8147b283ef96dffec090857ce5627de57869f317ac56219e5f297856c44
SHA5126cf1825cfed770f27447eda8b40a9a425aec45850ac5a790bcd85b2ce73a4cdb0855214d935fccfe98489bee9d13ab4062c2fdd6648099bb5b5cacddc6fe767c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5051c71133af64413b991d27bd07bcde4
SHA12275fa7519eebe8a8daf1b4a1880bff02b93fc73
SHA256e1b3aa304156d4dc241a780ad11921f6896f0ad4bdb656d86ae09dab06f7f2f5
SHA5120085ba5002be54c3e5b3917a8b419be69e07e014e66ac79cf697dfd48c0eaca86df5dd0bb4bff9a214ba14e48fed765f651505bf83561232290f859ca722790a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58cb56b18b41dfb593e953c0bbf8dfa43
SHA1e7d41a0939d8ecce5349462e247aaede209297fa
SHA256f6b35abc4bfd0fc2866de5137e30f27a1b954199361a10f3a0474a8e39d89ab5
SHA5121c3254eafc50456c2fa0d19368bc1d7ae1c453c265224271bce7436de913edb4d676267fe341cc0d5e9f1e7a1ad6fab3e3c3979a8b70f60f3cd76f1514c086dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ea683eefa38032be79dc641fbacda51c
SHA1caa1f7f88d73c5589ebb3c6322fa252f78aa2305
SHA256f10b6981c9b5028d02f69386101fd35e04dac67b8932bd5b009a152dd0db8b26
SHA512bf489e6ecd8ad27d77adfe59f4b41790b3a54cd8e19fbd9822a02fe26ca0bac10549dae76fc4ba3eeb447095e5b9fb5423cf60f0d20640daa9af69f493bd4aa1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c0d6ff6729edb6c63491665051bb1843
SHA1dac61ab679c0a7b22ddc0cf276616fc5e41cbcf5
SHA25649cc7b9c8306dc32a31ddd0f369df05d91152afb9a4fc581308ddfca1efbcde5
SHA512338765f435c564bda6d11741f8ba484319f52cab60a471e5ee9598e14a3c8c5850184edc07b0d75605e3fc440edc86739be966d690b509622f69041860903f05
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD524c2954290f85071101651484a5d9019
SHA1a94b92bdbb7aef97111af2958f5f7bb4fee1dda3
SHA256c543678d996f63e3aa8a542fb30723c699471a9ea09c26e4274df95c9550de50
SHA5124030d2dce81cb66c481109b465ba9e1f35bb4398f4778793205b7f5e19e6b385c3d334f34070e1bff37cefb407016db069389bf051c3edcc812d7d50d3f535ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54a419bc345c2ca0cd7f0ad23d77268f0
SHA134dfd360d1350763aa3b71a3c6b6e965ec6f757b
SHA256787e3253bcaface40577bf2b494fa75a240db5b0f515d0e485e61b042b8d87fd
SHA512d8fceccd8acb730c367db2f13346dffa8a21ac5384d58846760672f1f1a4f03d17c30a4bfefb38df4f6d4a1ac08e50d3bfdc6bebc872291383c0993de7e8e8ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56d4e970436b9c1cd2c8718889ee09828
SHA1900c1aff7657ad05e12497a018e83d9c49d8c9e4
SHA25634c3324c8ef53de98edb937649dd2f4814425e97373bfbecee026d23d6bcc404
SHA5123bcb3516484eea3ecfdc86979239bbc64bd71cca4d97b415ec2fb431e49dc5376479e0978480fd91550aad193cf8f861bb0c2bea31ea1dbbf8e9ffd7b457493a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dca1f5b732ca7ec6c9d752f8e87e0b70
SHA106242f25e3bf42760428f7eb268cf532b3fd9a9f
SHA25600a1d3cc22d63b9863f755bc1620bff82a2f67c71ca43ab382dc639ce0022858
SHA512cfb89c122c55c6c28d9157606c689c194b8fda69b5dec968b654eec3281cd7836272460d72eee8ce30c902bb20f8535e78e37ce1c4c69fc9765f60eb6e2bde38
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5be697645c0104cb672024f41f03948d9
SHA10777bd093106f3cd822930d5581affd8034eefbf
SHA2568e8b437328bdc768652a363c3e1bfd35577201153e9cff7f6b2bbb6fbce09143
SHA512f681e666684e6e740517f755a027330d5f79a6ba1eec5eed8cf7ac6204b60d75878d00ab7a86c453924c442837c6fb0687c89641203b98e83b9c75c237d8952e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f5dd59e4c6ef4108a0f283ad4b3b2f30
SHA147c3f0628aae39757ad5a6d9890a98d8dd7bfbb9
SHA256f8c595574a51f43e52aa566d2cff8c21d672e94c51bdc66a16fc4e7fe473e115
SHA5121704f8c3ee0f36cd0a15458047003bc7a3720e6c1683638bb905a5a9605309fca7a74fd4569f31985e822723ff5ed4d4f445e9adf25b32e44c9986b0e2cd0543
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f70bac5a3fb9d138610da292d1f1de9f
SHA1304cdee0c3594c54fbba2604ccd3fce7a4a61699
SHA256eb738b35fd0641313d8f17f75249e1485883832403b29afe8aee76740f16c424
SHA512e81ad6032144bc41e8dfb4a66d52defd60d6f493011c1b82e48fdd92646de032eb68872d1da9a588c712676c3d0e73dc9927f1d3ac5303893030f6c345d73827
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a