Analysis
-
max time kernel
134s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
13/06/2024, 14:27
Static task
static1
Behavioral task
behavioral1
Sample
a604d5d9fbebebda02db75bb6b32a1b5_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
a604d5d9fbebebda02db75bb6b32a1b5_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
a604d5d9fbebebda02db75bb6b32a1b5_JaffaCakes118.html
-
Size
461KB
-
MD5
a604d5d9fbebebda02db75bb6b32a1b5
-
SHA1
47015baf629cfbd5d90911474e04c258d8396c70
-
SHA256
b627ff11b4245b6082bde9faa94319483eec6414af241ddfcfc6d4f95d353056
-
SHA512
736e0abb51abe1763375679da5da52d386e600a4e7c40548dc76d616f7b5c303609049c798f026c1ff8b3edb798a1ce768556d2b828527a60e759085113226f1
-
SSDEEP
6144:SWsMYod+X3oI+YBsMYod+X3oI+YjsMYod+X3oI+YLsMYod+X3oI+YQ:v5d+X3r5d+X3l5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424450742" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1F482041-2991-11EF-A5E3-C299D158824A} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a03905000000000200000000001066000000010000200000006662f1ab5ec1e34bac35599feb3bd7c8204640a55be3ce9b636e0a62f694649f000000000e8000000002000020000000272bdabef574e4c87b7e1ca184bab9bde3627de8945f077e78d78c75c75b194a90000000c753e7ce28de44e0b402395afa2d023b25c6be00402bf48eafd4f753219c7caf7349e7b27ca3bf10e814fe9e72c6f6f017f846b2bbfaa04bcb9a681e1bde2b7c575267bc411f6a2946235b93a33bcce106475258dde46fddc8c8511e73cccff0dd07e2624439a5fcd11ac4108dce5d6edac941eb8b91a28d0303128b5a4a5f7e34bb904455942c91aaaec5cacc89ee5e40000000c364e3973301dd1fff4b9282d6b5fd45926dc7b526da34bd792becd247a32d5d69176d2af818ee06961bb3338172a6c804224f041649f3ea95ca881e77fec5ee iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a0390500000000020000000000106600000001000020000000341de7d3477c658393abc55a533035d9b7ff9bac95b3523a70182fb168f69303000000000e8000000002000020000000c970dde18d644c873cfd6303abc3a9649ac51bad2f373df0a7eda051e66c2dd02000000041f2fe164d84e29c411ec3d6919b3ae5f75831bc693aa01a415ba5715841a5a640000000f5e1551360d3fc7df51876cc57164ab28e8f7f4d65c197b76422bf201cbfcb8a780bf48b9906af41f888b2750e4512c20ddbedceaa806fe8b7eb5ef34235f8c1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3005d7f79dbdda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2028 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2028 iexplore.exe 2028 iexplore.exe 1644 IEXPLORE.EXE 1644 IEXPLORE.EXE 1644 IEXPLORE.EXE 1644 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2028 wrote to memory of 1644 2028 iexplore.exe 28 PID 2028 wrote to memory of 1644 2028 iexplore.exe 28 PID 2028 wrote to memory of 1644 2028 iexplore.exe 28 PID 2028 wrote to memory of 1644 2028 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a604d5d9fbebebda02db75bb6b32a1b5_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2028 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1644
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d3ebd103fdb874bc23536df6622099fb
SHA1f0c70c88cd9a690678cbfa6f6e792cb61527b764
SHA25694388e19395727caa52b59d1fea45505dcc359c0f6cf6d4624d5cf817e7ec659
SHA512fd359ed79c1147eb778a1d2cb95d56bc2ed0ef6cab999ea1f4a41ff13439bb823f47c3572b396486cc631961bfac4a8c070f300fb39547cf37c2bf41babf1dab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5460f523c2c9dbbdc34c88377ff05c93d
SHA1f42996cd6646da33b176fba9f1bf6eb8394a6f53
SHA2567b20f8a0cea4666b97cfdf5f1fd26dfac6119dbb9af63c13af16e8e04b00c88e
SHA512ba79a1e56be1ab8537ced1e2cea87511ffdd7bc59e115591c2243effcb6f7c2dcdecf3ea36e0e46342a6dcc4dce2c7de1242a819eb677fd7e226388fcf4fc117
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD558093aa7c4f8210e7e1ba2d7a3698450
SHA1f6418c5b277423f03e3f6e7592ef326592d5656c
SHA2563adbf248d42b2507dbff5fa9a430b43cc4b019b533c8885c46962472ecd9be8b
SHA512d914f5f7643c9a76b0b55deb95ed80615c4bfb69b131a26e7537dc0aee13c506d99d8a3b3bb09918c71361d9d60c811b059b15d0b6ea9a3cf3eedc1f9938ef93
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55712eaef8a46185374bbe4aedce5b428
SHA1e56a4f54b4fad025c04d1c025851437364e5b98d
SHA25618f2fd91aad3becf4f7ce89d71ad6e4b4eeff8130466184f8687b58b27cbf065
SHA512b110c7e685fd7b5e832214aeddbfbef7f11d39973a11c9514656ab5b062e9873aad70128376a2966eaf7d63372e1c8e80331d88e864c476875f3703fce027d66
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f4e46488addf55888d474ad3390f970f
SHA1aa7781964583ca29a5452a2149b9711dcee66c0c
SHA2560564b4183b0ca126209de7a8195bd8a8b25408869829e2152f49422a6382d87d
SHA512b9b32af0c55695a810045220cec1011c262065a72a8b57ff4da8179125fd5ecc40bcf0d9a3ef2b37a8f4349f535fcbcc9cbea870e908c66a614ad6411f82af5f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD553cdc5f131fdce3044c2821658513c1e
SHA17ee9fd1def71b125c9330464ec9f2c7f3c39d490
SHA256cb1eb7c43efb95d0110418d6ead2f2ee2ea986bc3664429b8dd53247249cfe60
SHA5124727bc6992e3ead0ccbf0dd8141fcf15378dbe14ab02533d63110b9b27ef111be7ed30fff416b11ef88ec06990d24cda31f5e6b1a677a20a32bb54461c6c1d31
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b20f91fd6cf61f607a0cafc7a10164bb
SHA10d088766b5aba0c76e8b48c07aaebee33a9362d9
SHA2565f13293738c6a5415595460ce95608271aa4d2a492d99608f6ee861335ebbf06
SHA5121a5a8a2dbfa99b5be7f0556443892751f311a7a6552b9d284ad347f59b31a8520549a54ca6f4b7b667786930d2929660284616c24cc44babb729e4eab7747314
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD521b2d77eb6a4fcfdb8f05b0c079e9f7a
SHA17da7b66cd46ee0dda2bf91f653b69a74f011b769
SHA25614542b48a40130dae558b6d6a188716859ad56da953cf4ebf4201e2d88c36d0a
SHA512f9469ca8e1af6b9a864d62adfd02e626f535131ac98a7c74a3fd608bb1d9882414817bd468455aa7cc729ae191b5da1553ad6d6d90ddfe76111a3dbfec8ad49d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58c48de4e3cb567e74e66dddea465c952
SHA1dceff21cb84db92d7c8f94e52b289037bafc0801
SHA2564afaf7da15380bc1159a95f67cd6ad4e90f8fa46c95f0fda511142f1660e5611
SHA512501a4849b18d60a9f6c4ea033b3c2de137fc8213e2188fae1f978d7f9f9ed7eb9afad42a12d265eb89102a135d8017e701b792fdd88b84d7ca4ecde359618b90
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52332d0847420819d3395e6b36e823e56
SHA19db054201271884c9706062ca6a2d779f41638b2
SHA2569e2acb70fc71e5bb2e69cab9afaf93b4e38dfc9b8042b8c964a93242bf18b084
SHA51214abcc909adac08eff7891d71d874a09c70c4ae99b8967d2bf0762a399c5063514106b93a374daf15d672facfe586f17c9658db6a504a6b00ebbdf2372368fa9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50ef2e29267770fa596f57e3c313ba69a
SHA16e329c5b258782c9ca9cad72f3bcc6f1b76d1e62
SHA2560ab8b53021eea07d4cade496cfe07999ac13ae819d75016803ac7728aae27b80
SHA5124263c2f86a5c61e9d38fc705d4e5d63bef1a5a82fa250d50cac0e0c78aef59934d454f3636130d65f096eb9ce92fc0b1828a2e38535c61cc0363bd13efd2cd7d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5123cde2e939fa5c8f4a4fb24961fd138
SHA1fa598d1abcdff0cfd17d5c03abac5b349d650624
SHA2564e4807f79de48b51cc5ed00f11f66cc3cbd9cec588646969c7b894b78700c36f
SHA5126a1270059c461d96206d68299c93fa4bf2e0a0615617e86467de0465e8754e1c488b44023ad44744d60d6eecbe9bd2f9d0eb591be25dddc6e97b910ee3864778
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a07509d07b79791b97308429d39b96be
SHA10831391b6d246c497f7a56cbd3d0371b6141574b
SHA25626579f0fb1b0db479e361b57754be254cef86098c3967997091c690982d44ac4
SHA5124ec2338d7a4239abec1aa05cb8306db4e2c58b0013a9635ae25ad471e6287e1f4f569611ebb0c1ea8b2df8d77aa152644dbf2d5f105dc2a52178786eedc1319b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b6fc515faf2326e57bfbc792e3d65555
SHA11e995807f73cf4bc3919d78257c922fa6c1a4ae3
SHA25695358d995534bc5723993ec7f6096a2d52a8970593625b5ead927fef44a25104
SHA512208d6d975cb6c4840e572b0f6979461a896da5cb7215af555bb4279eb536d6a8bd4fbba85ed1291dab3e5c3051abc826d688a68cc24e5fc1ad210657ab9ef287
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56041df9e5466b64d00b3cee09d97499b
SHA14be22a3aada87171a04cc5e761b257bdbf068712
SHA2569048b6f20c3f81ed005be17090d29abdeae6bf3494c2e206b5a74ee7964ff75b
SHA51263555564e89f270ffc30835d5b4aef0e97f7b57b422612b5f76fb6459035e95d601391e340dc411b6877348c039b590167c389568f72ffacb7cee598f8e1bb43
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cef7ef72ccf82923b827b417b4aa2be7
SHA13e66f965fbdec57512e0394d3ec56c3988730760
SHA2564597bcde328163898d47eed60a4f00276d93077eb6064cf84375f362409e263c
SHA512bdacbe825c537fbce0783bbfb2bbc878466781ecba61ccf37186a6292062b5b40fde3bf4ba2b07a5556453abaabfc42f5cfb6c866ba629049a7978d233da58d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f7c865dfe8c174285ffa8664ec689576
SHA1cde33310c15b55f638bbc8f8adf18f0637992543
SHA2566a259b74e3f5c55b37979e00a746d22a9b534901995d17cfff9ceffea323fa15
SHA51224c78b5c4e39e7835cec28b932353a3456a01272b4d3207ff5d468c645a0417cb8de4bd384ac3d8c5cb38e89eabb0718a3c3c07b73071ded3567ef3b33183714
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5711b4aaf695fad597e6b23fdcf8fc398
SHA1f88cd0b60d287f0c25573399cc1063f51c54f8cf
SHA25699af246b430433c0926daeddd9981049b474bc5648434ec4a8f6e2e948e4b2e1
SHA5129570b7d8f1868aebe9c05b8a77945f0514dcd9b056a092e9e6db9b50c6695193edc7dc4c31417fd5626fa4e8c4e1115dfa1afbe647d671e84fc983406d77f0aa
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b