Analysis
-
max time kernel
120s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
13/06/2024, 09:03
Static task
static1
Behavioral task
behavioral1
Sample
a4c2b87eb710fd465607ecc836609bf3_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
a4c2b87eb710fd465607ecc836609bf3_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
a4c2b87eb710fd465607ecc836609bf3_JaffaCakes118.html
-
Size
483B
-
MD5
a4c2b87eb710fd465607ecc836609bf3
-
SHA1
31506789548aa5fc745346d745b8662a4b1121d1
-
SHA256
45af55845b6fa762ea34f740507db849b7df03f3ce7f827acf1d31fe4d27a8af
-
SHA512
42a275cd6f2808fec6650591e44e21fb3c2339e643a64d676eb86971b4acb5c46bfde2c5bec88a76ec24451b566f6acc23d45c1591e1e16c683af6f5d5e25c19
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424431275" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000b0793c8a1d071e02a6f01740fa753596a5eb0c8035e827cf1ebb7566fc9e8ba2000000000e8000000002000020000000d76ffd30c0d8c3a14f68b034c35c66ee303e7fda1b6be29ff1cfff5f06c3cc2a9000000062382c680bc17f7a2f2e1a6dd3c39e3151c1e4817b838f0839b6647bd4d20936e0fc67a5c1e89af2a3f8fcf2c1bb5ef7b2f96ada588cb0922cbfb0f78bd441e84595764c2345f7fdd48e30a3d7e8a836b68033a4934c14dcbf5f7b8b701522f9241c6e18aa94c54dc2d6010630d2bb36e222e13babe42453af1ac5c574e63cd23e043c0729bd0c311977ce298b6b291e400000003bd5f47d457001f4a965b8ea750f00d50685d44de9f3255b5c02d5c50f4ef0fb83615631a0b4f4f0d120fc5e66363751531415781888ca26b8b7577cbe629c5a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CAAF54E1-2963-11EF-AF9B-7E1039193522} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a80760000000002000000000010660000000100002000000015676600ec22b693f7f49910d4d525da2858b512c89c74b9d9c36d5eb99ef645000000000e8000000002000020000000bca428d4d65171129457be02bcfce410e729a69f5d79fd001c702aed1836486f2000000023ccb73c13a771685b103380087422ac05f87e9931dae23735b36726b35bcd6e40000000c00e4957112def997b7916365f8f10be62ecde331c32300f71f9f018fa7d21560e6934287f347f192a2663043688dc7b9023850e8f31ed0a10a543c59c27af43 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c064de8d70bdda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1672 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1672 iexplore.exe 1672 iexplore.exe 2280 IEXPLORE.EXE 2280 IEXPLORE.EXE 2280 IEXPLORE.EXE 2280 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1672 wrote to memory of 2280 1672 iexplore.exe 28 PID 1672 wrote to memory of 2280 1672 iexplore.exe 28 PID 1672 wrote to memory of 2280 1672 iexplore.exe 28 PID 1672 wrote to memory of 2280 1672 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a4c2b87eb710fd465607ecc836609bf3_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1672 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2280
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5741c91cb3ee9dfed0e1d3615d9bdc824
SHA10902bbd1eb03fcb449f4f2d41aad5e914459efad
SHA2561454fbff13da2ade4aaa79a0c2106d837dc5d48e636899c7baf28df1c6be2a6d
SHA5128a012a5395fcada07f2ae7996eb4c14c4a2e71800109017513bcc712c3b5e427308342bdb121c44568ee5ed228048287e93ca285f930433d8044a24ccc070338
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55d08d46be6de6548589f012078f77c2b
SHA11dd60f30d5c1013a27b074f712b49b3043257052
SHA25609001979e5bdf3cb763e58d329f1db7492469c7b42952813ca853a4fa4ab30f1
SHA512ab86262b8a7a2f35859ea1c3de57ea5841367e3833ceeab3c4773746481addde2943dc867bdcc8e9a86f30b6d2e888c3fc78894eb6c1850c69990d72d5491896
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD556974a166239e9c0f6a079e07094b956
SHA1b3eb82fb84ad770c272d488de2919d195d9ce524
SHA2568314fe6f07ce262ba5d4acee44204ee176989816087d954017bb28a1f6b7010a
SHA512c9f3a692f4a6ca53b8aa7cced4f231fbcf2c5f2aa5a67b217fd008002eceab71c65c0e985ba79d30392d4d177c870abbb483d7ad014d53528f48d914772c317a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b7183b779552a0262fd86b94819b0f39
SHA1d57942ecefe837e3da3460dc0458235f8f924611
SHA256f30c995899ad898bc0a39ff6ab4b7bcf015fc7dae2d38d9f71cbd33baeb98bca
SHA512af49ae153368977997217b6081b2d1d4e3bd628315c725c2c0e9d0b184318d551dc5412ab12164466004f619488b1bc77e20306a32a94cf41950098223c94bc0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c3ee83eaa40a16d3993be2f4fd14a52a
SHA166e2a16936f8adaf3f60822841a16ef16e92fab1
SHA2568e721797be8661bb6f9bd9c55d799ff3aa9dd56c452f4d4190beb8d77d4a8803
SHA512cfebd5e0f584abbb4f73a55dcf711888b35b63cf2174af30b12aecbf0142fc31e8f2ebbc2d3776dda94f58edd490a9d1f6e0e821782f74b9579fc493cba85d24
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5026ad8c85070692acc80040e66610797
SHA10a4473ef1e4e5810691dab1f5294661121766211
SHA256e296292ca187b93001e80c6b22d6915fdf7775fba553ee5dd286d677bb445e27
SHA5125ce5bf55e14735a0a321634bdbd3a82b4b922088d7db02832e790cea796fb02a38ff6345a9de678b8fc883c6a70b6535dfedfb060b08ace4396c6249fb307c24
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50972fc34225a30b243d9db9d66c65f99
SHA12ddf67f06a08a6ee3c627a36cb2824037d7d2e9b
SHA256118a4369e8c3adc2e291f7dec1ff03722da0e5910aac869e36cc4da8fc3cbe6e
SHA5123366d21c47be2ab6402d43ccd116ff3f7234aa29f0d4c261cebf78a86e9e2fa61e28e0369e969df8b2cd2c4ae5465ba2a56e6b163e54023fbac60615a8750350
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53ac0eab9fe22081bfae36e90cdfe1b49
SHA1013ca1a8a09e3c445d2bd68c16450eb7760d07d9
SHA2561c1bd17a5adcf7d7b111c0044784bbd6648aa2b6d3098bee8ed8037cd26870e0
SHA512ee8a814de4511f22aa39081652392dce618c042e0a5250a530695e2109add7ba7d442afdcace38c990ec49807a5c1d7e6a9d7fef9de2c902cc9304d68d724baa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e1b1acceddc1abf666697a3e407f5a45
SHA1468182ae5334a44479b5b5c00a873fc5ef25150e
SHA256dc4e0227d9eb2c868f840a340bea93ca96dafe10522240c30d28de5e21edca5e
SHA512287a3b3a10212d69f72363116a5d9cc2dc45303f95938b329380f91047c211de677aa36b49b77d407f3a73db8f9e9a853f24cbc182c8bf9caf56486285664e43
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5edddbddf7ed8b686d8d2fdd35e2ac691
SHA19652ce50d87cc6b5deee08e9a8459143c800f8fa
SHA256f4b41be13db4803e35f5893482480c91a3be35987e87a10f5a8e92f51e5ee926
SHA512add7bd61478a5d11f5ec41558dea813fd1da382d2c6edb2375375168efacab86270ce06fa786957f632474b617c03eb4940a14c1a4e8fb9dbc37e33dd2d25e1c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53fd20f930fc561736bdce827b6dcc78d
SHA1a74825a740bb1396bb9067218d29b5530844cc67
SHA2567d02c97b5b41279c7659b782a13820218c84016d3b45eb91f112a3223eb07b05
SHA512f03f2f0ad07d3055b8ad8835c7bfad79bbcd59432efe857b848f75ceb3fb3ffa338c4782e23fc2ec5196ddd144ff3f5a4a1f327c9a38622d69b3a9ffc25b2bb0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54d6066d07ccdb18dbc7df6c9079a1703
SHA19133baf2ce25b241e40cf2e7ca1e8be711bdf7d9
SHA256997f59c7d1f494d9a2c599cbdc3368bcefce32b0f1b0d681f3e4565f51570cf4
SHA51246278540fbfd81560401862d7c850b1075ad8c9d7b2f9d423177fc7a07967564185faef8d2d381d536fa69bde11fdd96d6e2c99a2299cdcce2ee3c0c1150563e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD542e8bf484543b4fba5dcedf79191e5d3
SHA1010b6357f265a47e6a05105926f35401de0b5d62
SHA2563a7a786c51667b72b8765735b650aa308553fc7ac0ce148dd3dfa36b13cd538e
SHA512b4244597defdfbfc42832933bc667e6467662c68c44590e80af774ee48b7c312ae348367c009b363b213030f88e42fb713cfe1f4ae3d04a09fc6b4b413c9344e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a0030c8fdfb380070137299a148675c3
SHA12dbcec1a39c2776c263f1271b11e8d12bd7b899a
SHA2568a88b05ef4975a8b47ec8c9f7a06453fe5183b91b9239d585cdbe75e0322cca8
SHA512c62f7785ec50659379fc6dd47b67adf921764b83b2c05a489615cd507ea7dcf4dbe1eabe5aba18e11bc0d41c73ef6ef0950f04c4ac67b7f782e34e9666be6349
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5411d724c1f2da042142245b7ac666080
SHA10279795ad45a43b25efd3c0a4aa3ca2600d8c674
SHA256cdfe33dcb531de421c5864771103a974873094b128bcec547fe99cc6dc42df24
SHA5125001245c9dc13c8e0cfbde17c90e4e83706abb799543792fee431a5bd573cb5bb6a771d3f331827f79f04e7eca8acbf29a361cb95b88905f30e437bc52b7cb56
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b1e9c9b7ad9fcfe96d211cfa93cdb537
SHA114096bb32a0aa06b0d0885a7d06f61d674a90d1b
SHA256794d2443d1288f9a0de416fd8f610d72e5ef00f9779928a872a92093b5331c70
SHA512954e4e67210059f3b8e410ff27f95f9b4b2dce1ec60f663c0651c422bbc12441237694bf4f68341460a25eeecf0e76f7d276512f516c4d07a7f58cf1669e9336
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD542f913d5866fa71b2967dce8bb432f51
SHA1f0a83ea0b0eb0edd8e65e6139e9405867232b0b2
SHA256eb86e81c1bc582d7eb6f385abb50ddd632265e7e88e82b950df523ab5fa56d47
SHA5129baee49470f224362b2f45fa69e09e4ff7707237e63a8f3cd23688414c6bbc68ae2da4c91000bbefd190a1a2fa551dd5acad149d98ec726dec623e6ae82849b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD597349398fa1130872ce670120a32ae11
SHA1932d37ddaacf5d424ab0453a63e41931746e0d9e
SHA256708388315ec492fa3bb661b2b106995bda886309d720ade5058d82fbd0108581
SHA512efb971b35a1911c09d7e571557ba8b57d34728d03748905a08e7a59e47f20d9d6feb11bd72fb29169c0e06cdcbca5ad55fef0977ce9510cc66cb2761e423989c
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b