Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 19:19
Static task
static1
Behavioral task
behavioral1
Sample
685544311ccaf5c136f1053e7243ab90_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
685544311ccaf5c136f1053e7243ab90_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
685544311ccaf5c136f1053e7243ab90_JaffaCakes118.html
-
Size
38KB
-
MD5
685544311ccaf5c136f1053e7243ab90
-
SHA1
9b1a048f8182a87d4b4a02ff0531123b17be3498
-
SHA256
da34021a2528b0cda05b95877018f1b953db4b93c3fdc21a5c85bc41bf3e6313
-
SHA512
79c1b9d2633a2598443413321fc9daf9e2f983bab245ab4f47583171f87a308aa7f144dd2b2da32d19c94d72e041b45a2c93192f7a2749cbcec5926bb88479fb
-
SSDEEP
768:SCrXC+CnCUCkCDCCC/CvCUCRCtCtCcCOb9cxrJDlL:S6XlyLlQNw+1iIIXixrv
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000004750bf7cf12041468765d9cb3b98ab36e3b9f796a00de616cf4c21fd50044e51000000000e80000000020000200000004a994e7607927451f87e1342831c03b147449053e1c2b11f60cadd6fb413090b90000000b95b2ca165163e9ce7e6e445b207eb391cf97152eee00b66d6be0f1afb7232bad22de9986fc068ca08c080dfd26c4171f4d36e61cb9636963a4b7a4c6705d6b5423136e1ecb314e381ac771b13d7ffb5e77a83fcd25ebd7d86f94bff9f2d35017e6aee84c1137dcf5d4a4db178e09ecd99d49f95ab032257eb811dc75946eebba50a5c8a5765c92f455e6d518e60a76d400000003bc5a4e0fbc4ac9db4d00c118bdc26431db22e29f1c23348634802d0620d0f669cc1cf62a2d6bf9ce1558b59af3507dd50cd66c4b6044a3602f6327758fb0e16 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a05b292f7dacda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000030428c6461d9dc50bf090794c34e6e0cfe50139984782eb7ed84c177df66d0e1000000000e8000000002000020000000f989dcb660f86225cc15792398aa9b33757721cc9648dc65465d4488a37a454320000000ed6105e5bc71fe0a1a3daf333db1292f0f2613f80d5a989ef4cd0dbfd7e6ba9a4000000033489bca5c23b94634dd52539f3a8779c95ae0653664a2fd89ad6afbef2affb3cd4ec07df04f0a6bd1440dfe99276a2156523d3378f56e3ae565871139c3d223 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422567460" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{444BE111-1870-11EF-91CF-DEECE6B0C1A4} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1424 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1424 iexplore.exe 1424 iexplore.exe 2020 IEXPLORE.EXE 2020 IEXPLORE.EXE 2020 IEXPLORE.EXE 2020 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1424 wrote to memory of 2020 1424 iexplore.exe 28 PID 1424 wrote to memory of 2020 1424 iexplore.exe 28 PID 1424 wrote to memory of 2020 1424 iexplore.exe 28 PID 1424 wrote to memory of 2020 1424 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\685544311ccaf5c136f1053e7243ab90_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1424 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2020
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ccf78241201d9e22c2f4610d3a1568cb
SHA1b18580aef4de9b2e86718b9113dccb27ac5a7c13
SHA256af9dcc4f65ed82be41860d7a425ed04e43d2b3db67f1eecbe14cde34b839dba7
SHA5125d177f6867da4a4e18ce3dbb4c78347277a6f90717e45c850c79d4288b38a609f31bcd0d6aadd9618dbde803976c0f96ec95021c7695f368a13b02b3d66bba39
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cc1211d31c823afcbd02abdca19ecefe
SHA184e2ea358039d7ed2c5bcaf2e8425e2f30d15d2b
SHA2566a58e082ad0a107e32985be56ba8e7ef2ab7fa67291a14a529824d35c6786c5f
SHA512330586cf775003bf12f6b6f0b6eae4eb85d5305873ca789685a03f2e3d2956fbb2e24979cd4e02b14cc7116e35b5a2b20c84ffd51944fe6ea197fafe07e0af0e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c35ef7d230c2769e4e37af7f20a2d8ec
SHA1a65d7df9a5e7edcc93a25b8cedbe2a6416618b12
SHA256d6867deed1c710e0334029fa54b51009fc3ff7964e5906878d34b06f5cf73903
SHA5126f54cb8cd97438e04c62299be669e4cd36934e92fbaeb54ea65def439ffb39454ae6ef7d8dd23ee47129aaf9397db61244fe28aef88c7acaabf77774441d2f32
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52a6910baf3a82ac46678ad0c2d09f9bd
SHA1e8f729fcd4429b64a5cc2fac6c6440d231f30a41
SHA256f1e46e3babf896adb2cf22afa2d051dab729716f5c724dd040516ba985e66e16
SHA512116fb74b88af8391dfdb4288398034a1ec03618b79ec2dd49dcc800a69e6fb2ac75a11753840aa8bb0af7bc40351b15c6cbe55a5dc3760ceb02c3322e88cf4a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD585e44e2a4ad481ffc4f3d4c3b150b107
SHA1af91f10dac0ef2c2b0f45c9f61cfb4b27ce38a4b
SHA256f961e05414c45b41f2049151607f0d757b72cf2af05b94771ad5568b6bca949a
SHA51200a2df5e5f6e3ab9d97ed977923abd55e25aa1343aaeb06f99fd40e646e1958d067d101fce1ded97d0a6c1abcc5bba8d7d4181c9d5be35c6681a657981fdf891
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d8a700efa6b1766d63a146ea2693c378
SHA13f7e5bd4cd2c8ffd76605aac2c5d26ffe005a2cd
SHA25637accaab301747427043397527e00ff006026ab4ee7a89b5dc75b6abbed1830f
SHA5125a32a2c75bb28836e08a9103988a46f69676b38057a2b12d57e0a73ea468fb5d3e707d971c63150d3a2a11fc39b5896e51ed6168a5f7ef6aa91d8c0019308a8b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53899868000d7df6446330b75b05d54c9
SHA158655e5eee95e28e2b35a3014d4c3dae2f214107
SHA25677281d61dd6d1e102248afc2886ea0577c01cb4edceb70209f31001d3d1636e9
SHA5126b8d789e8c980e9b828349239e2539967b0a80cef6dec966461d1ed895a1aa4492fb099f0d5df04e5e5c223fa78006346cda8b5ac1ea4cd56a38f60807328112
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b47e93551772d1575679ad67f07be8dd
SHA10e02fce76f11263341c57ebc0419ebf622ff453d
SHA256d02ccc043e7823e2f1cb99d658c4d6310dac66f104fc5e912333e46f52ef5ae0
SHA5126873863cd2449f63fc9bc162c0b06e2968e99fd96e7920a8ae28962b05fdb5ac1f6270a95e31d9a75d9d66621a6dd9e2a10facc5c973a5c50c4351970ec0acf8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD596ec4cb0f72847a29f38d90dfa570123
SHA160ac3e8b350345cae4659eb571073d96ece0a075
SHA25683297cfed83e86dd93fcb6542df4b275a60489d178fa1636772acf0577e889bb
SHA512c6d9be7294ef38b7c5e9eaa71f6cc0c5df9db01d3e9af0c661342911d6b589752c42ef50b99b3097e4840a434db0d48ecb56e7eaf47ec22b61c250420354ff24
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD599ec134c92db3be3c213df914ae9d45a
SHA1bcab2a2d76be05676541a0b701900d3bf317e8eb
SHA256d2e266c9d4f2aa6162f1747e6602cbfb2ef8b468374955c92de27f9f3514841b
SHA51286827afc71896154b4797dd84fddc4268a911b86461516c6bbc952816a6254ead83452d920e32852209aba1eaa644186bb1f1b2480de42f116f7e11db455c9e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50df17e88f97ec029c7d9c31ee0912dd1
SHA15c96b0525768bd1c3c0f3ffe01610a0c4d35366e
SHA25647b58e0364907161658d8741e7c835fd97daf06290e03ee24e4fbaecb8fc592a
SHA512b9647717309b1dde382333345015db9a1cd4fde2e85533445e0a6b135e6ba6c6c625c5ab0f5ae4d6eab006a015ac1bcb1d38c13965ba033f14b06e614a488e55
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52448cc665a300a94c91464aa2c7f45ca
SHA12a3b9a980f75782ec8c489ff648f1499a0e7a399
SHA2568651bec237063abb07533f18ae798e1c09d01272b35017ac29f75ae2da45e338
SHA512187871180f877dba0ff354b5b5f5bb450a2c8a2542d50f5aac7f438b97a2fe6fddf9bc3a519d28198d6e0205d76763a067c82f6ffafccfb93ebad7b0e4b915e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD557ccc05230e7ab4c61f264dcec1251a5
SHA111b5d71a8f6b8c368fd923956ea1b08d01f674d4
SHA256e286c58dad06a9807339040a0279529cd4cb1ed961427dd29b0e3816447cb2b0
SHA512fa1322881a778e98f5875476022cf34eb97ab86a8c2884a4603d23703d292a1b3a528334291cc247f6e3f169ed3d88887451890b9b50cb138ca38ee20f47e157
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD588000164e8d30c2c377a0db99ecae164
SHA1e4cceeb0212ccb8bc107e90890ac58db5fcb2c3d
SHA2560550cf464ec4c055fc04a279d659f8ba61a25beeb65ada2636e1cf16ad199401
SHA5121307c7fe8e7f1adf6b95cdeafbbbd1b8df3bce34f9d06d6f2cfeb2dda1d167dd2fc7f6699d1e63dd3b7ca3365dd25fb5657c625f752f8beb5b280efd5ce6e1dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59c7f3ab3ee85718e683cd458cdd2fbf3
SHA1a3a04267de9d6be57c2ea2340801a4a38e385b84
SHA2560cfce1fdf190af9f9a1ef5837b42e0e474e72c0e96f45b17c3df3fb9ad20a288
SHA5120df36ac884fefda27cd0dcc631fe01ab5055f4cb3e6e950ebe6225cef7d6e10261d7250991850a12e33e9c9627f5e9d1de0d0a5e712626a14ed7d3b9294f1336
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e88d3e3f764f0771ebb48a2a8d78f003
SHA1232796f2546febbc92e72efc3e4e53d86e22cac6
SHA25634989ad3cac46789fffbe19539867642c3c7c1a03844150f8816ed0b97ebc55f
SHA512a0833a3c1899748144913da5a9f9d254ede040a03a3d2e2a17eb2382f02f7f89d9fa2f2712342d760ece77f0b3c603c8b645d8dad0f2603fe3ee5cfac18850b1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD559bf2b3786be70ff87f09e8b93b4fcde
SHA16f23f8bbf2edc9c97e3647a937665fcfb8f50969
SHA25630a990bf1769d8486c68b9fbc0c1064510e8520f8378bfa75e858fc26bb08f13
SHA5121013d862a7330f07670b4a4c6999a3d7a3992ef5dd3f7d3b1594c2980b479d40f77140670fb9fe8b97ba82b6d4c2847654a042ed592c39f2922b6968bfdd7ebb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD509f9faa550aa4046281c347dbe224c2f
SHA1c05f2c1a9d6c00cc1085b576cd3c80afeafb5792
SHA2567557fc2c36863a95d283e236903b0199fc5aade165020efff33095ed46e539de
SHA512d514f2abdf14a124e2575e6a073bbfaaeb65ff2662dca26dbe0f2560977213e9aba2bb1935b2c227ede556f417c0129c34282eb581541e0514257258ba0dad8e
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a