Analysis
-
max time kernel
121s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20/05/2024, 18:12
Static task
static1
Behavioral task
behavioral1
Sample
607edb5efc6fe4ea96da13ebce7dd3ed_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
607edb5efc6fe4ea96da13ebce7dd3ed_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
607edb5efc6fe4ea96da13ebce7dd3ed_JaffaCakes118.html
-
Size
852B
-
MD5
607edb5efc6fe4ea96da13ebce7dd3ed
-
SHA1
568514ba6adb240b324ff420ed881ee263efa978
-
SHA256
dbe04fcfbdaacf0c977f7a159a6c09a6595e91dfd230c44d84b8f5f3736005a1
-
SHA512
34a4a27b99d197acbe73232f928d53a3a7da256dcfd1fc6be70b22544642023a41bf5c512d0c09f959ae669c4f6fce33b03a012eabf9576cec283c06cb075101
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000dfc63662f711df037b366363d38bb4e4dcae93e667139b234a6a00e15bc8ea93000000000e80000000020000200000001ebc7a2483501e6e327748a254f41af784345f17f8a019e314dd78b8e848b90420000000db8f5b0b5f38ef2a5d10163b17f7fac279110404a190623e5c6b760aa7bdd683400000004129a4f2d411a8b6f9b7b6e8896dd549e386316c65dab9f9c5911636047f8767684f6da927646b0065b85138cba5c08e5ecb40f6a7c248cae31ddb0e0dabad4f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000eef22364f01672ffbd54b7efbc4370952272e6f755cadda1dac0fac9b3282358000000000e800000000200002000000048091273c484091101ba53da8440cb83d8fda91ec95fc9409660fb23269f2b4990000000d5d4d1c4c0bb85ba2f54cb1ad465487ddb6cdc51066174410f93e689f0a491496f0d545ab25e6f1520a1bb78371d926274f9878b9c1e406c3abf05750201795e14dcd31488e9131077912f6473f28b2e719542ebd156e4535ee73a2618b186ba6994807de0186548881c91edf844aafa410089446517cc017197b8e695a06c6c19a74a6880226b9b91b2d73fbaece5fd4000000010aee74ff5f1b774e365e241b9daf745d4d9ec21971de122d278e0d6b6a89bdffea128c9c98cf17da9dcf5e24f2fd17cfc181d1c4620ccd08d6219e012eb311b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8C41C0E1-16D4-11EF-B826-EA483E0BCDAF} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422390630" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3015bf60e1aada01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2872 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2872 iexplore.exe 2872 iexplore.exe 2800 IEXPLORE.EXE 2800 IEXPLORE.EXE 2800 IEXPLORE.EXE 2800 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2872 wrote to memory of 2800 2872 iexplore.exe 28 PID 2872 wrote to memory of 2800 2872 iexplore.exe 28 PID 2872 wrote to memory of 2800 2872 iexplore.exe 28 PID 2872 wrote to memory of 2800 2872 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\607edb5efc6fe4ea96da13ebce7dd3ed_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2872 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2800
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD505886e34793bf4397b0ddb8bd22644ac
SHA17071d2ecdd8cf2f0188783e10847ba8b438c39b8
SHA2567e25a516c8f60554a999d056c605dc23bd36f46733450b4f9fbfaf40bc8709cd
SHA512114a3136e2f2817714be5c41f0b2572c48bcf604767484bf26df5d1e082ca570cdcb1f768219d5e8eac411a4367e63113cff221d2456a5cea89619726a1ddbe7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5483607a5330e9d8098cd7d22f6a4403d
SHA18b5520544720e44ea69dc18089a6619ef2d5979c
SHA2562eebbbe0b32119e722106ce007a4ab1e7e9b0248a7813f538e358d7139db8fb5
SHA512836056f1ac5415b977158fa7a073288a9d9c1f566bee79374faffacd9d525b4a0a2aaf798ce07b9ad38557c01ce5cb1f6034b6828b0dd53611a11dec35fd2dfd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD586ae43980d9b8bf39f3b19a45d98c716
SHA139933ad846d1d4cd8791e58675be25a72123a4f5
SHA256e323cdb80d8e2f05a058c6f645803b9ade9ec150016af548c2e387e3ff7368ad
SHA51294024a044798a97ac374cbebdbae62bbc877c02db16d74209c358f8c1a497f9ce6500580cfd7db7a935d9cefa3bd1b32351516ad3be38a2be2a11dea1e13139d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56ae4e1baa59da32f3876c4ca104215c1
SHA10a7e598f127abc6ebc68e7e47c5a98694024b8de
SHA256eae0d42bbaa29934bbb91889e6eaacd17fb9fb1fea3c3fc80aa6bc678f50db33
SHA512eb0f52c0cbe4a0cf9f79a1b93f49f1bafe767f68699fc47d2010d991d7d8e1f1373a6d4b73dc40f7c4eaa1772433c6e670ece7ae6b86b7ac4bf7ed35fc0cd9aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cf0119a89f855e1135ccdfb7c3ba9515
SHA123f05a800c4ba2b54f8de8e86c5a9c2a3163ec52
SHA256fa1e5bdce503f3d711411000f326d03bccaf34f99d704c3dee66338a4c0997c9
SHA51212ce7664b6a48871c6c5a11228588a46e50e63f85498d4415c1283871c7f4476db3dd275c8559db7ed795756688087ff2f55617f946bfb55dd2404a3069a7069
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57c77ff01230cbc3bc188ca89b632f8ea
SHA1a3ce227058b61a2ad5fec5784a0e63bdf7168f29
SHA256430ab2f86ddedbe9407a5bf0bb2bc6a71dd12117f74343166878d6d781ab4cde
SHA5122e6c7386f536e0ab2962aea0af6df927aa8c8d1fee0ee0dc17580ec824c27a0c531badf6121e2385b8fc25fca04ebbe10398e6f37c5b23a021432b4b1d34a2b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD586a091a0c145aa74f6eef92fa1a057fe
SHA19aebf082e6e8b66e7884de471f5c4f82943e8fe5
SHA25640bc2b43362ecca964e2e2e6c125dd6c91e9808c74484b836e50427974ea880a
SHA5126885bc29fb0a4e44745222d2f66d35886aef17fd6c29c87360c93789005e5f5eff03942b2781e39995f03bb8ebf72ed8eed922f694bc1b4fbcb03ab2c08ef0dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5127e8be0d576c51228f0a2d79e0c3216
SHA1b754eb796a2e9c499c1b363c0efdc13b6ee067a9
SHA256365f3a2a8749881bfcbbfb62fc8e4f3b5d6e132507ff98ff21d5e9a7eed59f88
SHA512238d04ca788bd910defcbd311ee78c7f9aa812db0050b27b6cdd48127c5dfccd343fba0e1dc1ae5112a7e71251dd5ebc78908e40a1bb480b44f7559108002d58
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b446859b9218dadf5e2c6823ce3b9d30
SHA1b0c28da11b75e101389b50314a5127565e2b53e9
SHA2566a7bb1948d82b35913f041017b0fddbe46e0137e296b865d27c366ca166b6786
SHA512904690460cf4595427819483d1f12ec0f23dce977a172d3cc0e1e35843643c180c4ea70fd0c7431e0de11823f717af39bfb5d6b011b676902ea80f2ffc615d58
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a2e87ef16ed2a72e556bacc6e4dd800e
SHA1ac9cabdc43f0f10368bbe24030063898444331cc
SHA256d3b924966d88abbe2a37a7deac1df196f12f355bd14a85df0e8c7c774690ee53
SHA512d6fd096b1166d058cddc0e922b675498c5fd586a6d996987300c45eac96bc9dc14a8025ac6d7e3575472f9a119c75b7851b7a18adb07f858aa73e4e51dc33bcb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD513e229a1dcbaa3244bd5e4abfa44da63
SHA1d0bc62319ec0eaf0aca6b831caab418d8b08b82a
SHA256cf6e86144064ae40a8d501a6a9e9dcb09c7e06d34de0c3b51736f2a8a49813d6
SHA51297d08af815d4713e9f55488e2c4db84502f14a623e32b89fb99acb8f4d3d700aa78a714ef0894e0eb75173778dab53335f9dbea36e50886435c753cd11e16321
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52d64f3a0dcbb80f919e9b422ebab3225
SHA18681229290c9887513617a82dec89008291fc8c4
SHA256ae748757eaae7a403e45c078a71426a5719b5f741063b721835881c6a7fceac1
SHA512b7f644cf8c303536c1138a285a33403873d54c3ecb211c4c182fd384df1bfd9f4a818ecbb5fecda8eb8b6805ee938420f9184214c6b51e774efb29f71a2cc773
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52a6388f7a9fbe53819fc37cc4a07d9e0
SHA1d3f5ee5aa5eeaea03641970858a60f8a98ec3ded
SHA256e933a07c04966a78c8bf688e535df02558fe393f24d1145e2b0fdd392a16c51b
SHA51272146f61af79f8ff6b8d67cfafeb1fb376ad239ebec8a13e03454a76b942f443ba9d627953856ab9d0c22e05e3f1412f3b5cf2735884a5246e730a35749ece80
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ad8917218dfdc7edccc2deaa5e657d7d
SHA1c282e37304ecdc0a9dc9a89df093adb28db7512f
SHA2564a71ea6bf6ac71643fef1c16b475c806e6cd4f3a675d1d26149c5b2a863c857a
SHA512544f124b1dbc0541967fa1207fc9838f99c21895a0c52d757f3874b5f7e2934d21b254904f4b55808255faf9082c12d609c57f80ec3864130ec211cad4e8a8df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56003b56297a074961867c6fed2d5a74e
SHA176c72a7cc1235dd355913b8c6a081900024497c8
SHA2561b3111ac2d5707bc8f1c1e80b5b355aec53c5212ab5f6b1075ee967e1094572b
SHA512fbca0553f2830d24ecc16adfa1331da4794704c757270a4589d81ffeef20a09cd69013106f22fca86c5a0219d32ced2ad7bc238d0de438daf41e7d55cfe82c34
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5addab07d63ade2e81fa3bff9a9d552ab
SHA106bf7b230f3c299e19808fa8dafd28f0253aff8e
SHA256d82bfaaebde265d9d8f30abf24c82375a8e5e7bb64b5a5fef54db55aa669fcbe
SHA512662d933f411c0ff49384b47094c1bc22b20c28824e70fe70f74ab2fa289ebc9db88d01033a3210596b95b7c0697a24e67e24353fdab248494cb4ae2781edda93
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b0a1e03e7339850911e685c9e03e57cc
SHA17cb0fbf3c3cd98d0455fad03124c285dfa49867e
SHA256078e106d04152926d0b89b05f17c6d2d40077eee225fb3d00e8eb40f7eed1c61
SHA51289c4f13222c2844bc295a9766b1dacc30fab4f962a50d3cac88da504ecdfee1c915bd649617c932dc828c97e51a777a3dff5dd7df3ff7494fe33430aa896af3c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e3313392dbb09936d55f9f8091dcc4b4
SHA19b674dfd60cb20ea93a3f9a2fc5d1abc64288b8d
SHA256e483671e1d4bf64541272a0735cd3513bca7f0f8ed6937f97a656eedce7ea3a9
SHA51240ed7cfe42cc174b1f6c2b3b8bd132ca8d01fa42c33d9eaea36ea4380bd5785d4248ee49a2d6b7a4fd7111303e4438935438f817aacdd5d29b52634953bf3955
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a