Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
14-06-2024 02:50
Static task
static1
Behavioral task
behavioral1
Sample
a7c2bcd644bb67449c6070039f057aa8_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
a7c2bcd644bb67449c6070039f057aa8_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
a7c2bcd644bb67449c6070039f057aa8_JaffaCakes118.html
-
Size
36KB
-
MD5
a7c2bcd644bb67449c6070039f057aa8
-
SHA1
97b6215abfc6204aebd82c0308388278696eb244
-
SHA256
807b0f62afa479a80bcdeeb97f9fff87c8f26dc41752674884366ae133cc438e
-
SHA512
20023fa9b418924d28c9486a003919597a547723057148e4357fe909d369e31d5932d6565204a4e371e5b616fc56986f02696394afef251413534d89483789a6
-
SSDEEP
768:SEQVC5CeCzC/tg+gEc1sK0ii6owlZLqWqYxJalDBAj5Q/s1ee5r4WlqOU+Yrc5wp:SEQVUxMYtg+fc1sK0ii6owlZLqWqYxJY
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E58B3AF1-29F8-11EF-B918-627D7EE66EFE} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a80760000000002000000000010660000000100002000000025b02062a204a49d635b6f232a7e5bb63d9993fe443a5cd5a4335651c67ad69a000000000e800000000200002000000002ea788227904464092130613160570a8baa55a69144b0599608865ee145912f90000000e16b199fd67b7c02a7229682b43ac9bc445feeaba07b37ad22795b06394a3b83b30dc4d834831d285eef198e8428b0039c50cba362d0a4df8c0dc75d4a3434d4b913a926357ab032b6a94c6740277e027a8a68f252bb3cc70c5e337f05a113e9303376546c57e04fff5d5b8b21f164d7553b4be14b5ad85e96ed48150222d0692a89c39fc06c16696bada3fe0083819540000000b134cef7b16e3098d761058ec67c7d62ea3a7d6441ea6519cb79461e43d2163598b75bfd1e482ec26b0e65ac0d8ff98846fbbc43b3a01898ee255474206c3d50 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000dff55550e93f3641d7f4c56c2a8ddb2f789042d32cd1614ceccc3a7bc30f9f72000000000e80000000020000200000008786db3ba09134587aebf286da6ecf5dbae412e6c222a6a3dba022278b039d3720000000f98ad69b9be9da4f6d518516a04adf6b118b13d8fdbb72c783f0e79746ae191f4000000042fa37f669cb5c2b4544e9818a99326426ec7c2ae26f62be69d55c437cd9edbc15a7d82359cb48983aedc0eb456f1979193ab49b7dd62eb02fbb247d98c3d404 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 005624bd05beda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424495314" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2448 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2448 iexplore.exe 2448 iexplore.exe 1116 IEXPLORE.EXE 1116 IEXPLORE.EXE 1116 IEXPLORE.EXE 1116 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2448 wrote to memory of 1116 2448 iexplore.exe 28 PID 2448 wrote to memory of 1116 2448 iexplore.exe 28 PID 2448 wrote to memory of 1116 2448 iexplore.exe 28 PID 2448 wrote to memory of 1116 2448 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a7c2bcd644bb67449c6070039f057aa8_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2448 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1116
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5362b3d4b0f32e0c1a61aed369177d5f1
SHA1a137ca44028bded362664fb5e831407615b9eba7
SHA2569f4f841428979e43503d621cfa7379be5695a44a3048252306345cd7b5e79d0b
SHA51259b31e899d425ef420deefa85d6f05e5b593b30666cf40bd92e14f706529772c1e06c484df91279f14bc08479edbd9c8b53179ec2138b3ce405f1debbf71223c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5941740b4048d9ea4db02f81805b00e65
SHA13c7f09a11f4e1f00f248720aaf6780ecac1a0631
SHA256837ca057d19130f065a89233e33c763871105e405a87abf4eaded472423471a5
SHA512f7721ddf9f4b2dfb0c925d3200084f991ef79cb51376af6134e588f3deef7d4291be7f29da36120bd75ba0113c35ab1fd38413d9d05a3d12dc8f03eae22ccb7c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD556f31388fec5fb85a11c75feb1895dbe
SHA1f1245d856a8fa9aec1d220fc04737ea3487241bb
SHA2569a454d6ba4c2862895140d3c3996cf5cafde9d7259791b41eca77658287cfcdf
SHA5122fba3f0082133458cb2c1510cae5aee300c58115413f5041e060a02a0e6258c9c38cd3a23ad06929dcc5090256bee8d7acb08ece143fe021ce2de67940a66af0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5866b508dcdac55914274fe57ac4ae970
SHA1c61367980682c642165151651018d28b3cbad4f9
SHA2569686dd484670a6b895eb794687df04c06b5adfe7a854baf0878be0a1a590ac26
SHA512af37562637ef675eb01c8fe63f4e2466a5ba784fb8f26583f3c8082fd3d9a96ac209b1fd38e00772e50306255efc122b92d88cbbfb6b593681fd30e667962d23
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50a1324fa6c3fd35e4d55d247bca3f3d5
SHA1a8ac37ff6f542bf2cb67408bc9a803f97678fcee
SHA256644f63d3c77e7518e8349eee4f1162763a6c9ce7c067aa8de5b0d06870565abd
SHA51289f3982a25565d38feda07bbd06c3e56fb29506855e9bbf7f3f8e75b103bbc7538f41acd74e8c9068154c009a5cb09db7cedbfd7f38c35b25b3d08923cd1290d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5570e49fabcd88702eeba5c48105e40c2
SHA1226dd25805c77dd9b5666bcfbdf92b0830204591
SHA256f83b5d9b2fdfe95bc2800e2e048ddc4ae33eb381c815dde0cc5e87de44f73a31
SHA512f557f64a076fcec2bdc8f7b1f6771198faf0acca1bb65c181fb66f364f69897c5b3857eafcf56ec61cc06b645cfa208d1fd20c2fb76fe0671627f1d093d79766
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD568e84a3a12e1020548b7b7a98bf40228
SHA1b96c35c8fd6e87fc9744df1ba8b16a6cfa899c4d
SHA256159b935d5e02bdccb07b4037f7263b462bbf849cd32049cc25c5ba36fdffbbfd
SHA51219467ab0d782c642f6b05ac6a7bf636409f2e84089993245c4e9fb40a0b256a69a0032439f44ea406401faf1e7468b724545cc28da78b1d5ed55a70858781f1e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50a5c933fa32bab30bbc0bd6d61007f54
SHA124cdfec7f15ba37d056e60c270f7fd20d669b10d
SHA256bb58d05ffdf1c0e78a7f2518f25474fcbe9eb93d6709534424c60eac9a3692ae
SHA51242a8d5887454c2ba7adb9e6c964b5c052e438e9dd6c35ce30d326a597b6674923c3dcf2c41c7efbbc99a2f7739574579351633a9578448ff340ff0f2e2f7f30e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5be62b49497abb7e508dbde0973d46cc0
SHA1fd8bac638edf64569cdd7ab1c04207a9ac3e9228
SHA2562f1f216a4f33ce23e10e9656a13ad7ef2d34960ab7379d1667166490e3319752
SHA512d57503473c493c4d07e62d0990c9db0271368996e019d6e987881861dd83fa888d3c477ef54201a48287ffacd22d3d3f96b25d6e2e9d378a04087d15f360fec6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53408a7669ccba1702b421d5a807e037e
SHA1fe8ab9ea30c5d7ad5c39a787aec618fce44ba487
SHA2568b89a37b194dafa4298511fae15ec2e4da569b9e935d3d9889a31d759e3d7cee
SHA5122af167c8e40101bbe42db1f8da9985008654020ecade923b930600d815c3aacf6bd9a2ed06335ee36bf8ee6e2592077329c6137f19cd9ec3e8decb2f4e4b6644
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f23745b27fd25a61023cbaba63b393e4
SHA1bdb12dae3985b7498c8527b67ff2661433e1d0b2
SHA256b601be78ffbbc6a0cf606fdeeae5ed9252afd98d3b47f354adfcaea98be5f902
SHA512931a5d496134b7ac5654eba66232061490a31e979157387a5cb8e9b5901992c45ccd97a3fe1fc6ddc15483dc6fad1f69e388823153bd09c795248ce1ed250dd9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ac5065dae8843bcbc19f8a4453aab82f
SHA164a0fd0909beedeadc6c7473d275f9c6bd0da270
SHA25676b501aa254bd34b0fba45a0be465e70b54bf4b1ecacaf68f6f4fb121adc9156
SHA512be339300df5311100e441f703e0b23506e041f60de128797882976fbf00074922bec6f438d18500eb6eff3626e9719e59f1fd928c11a5dd858046bc67f8293af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5da9139013613e54ecc09301cd50c7d96
SHA110cf2ecd36e48515daafb04958ffa4b05ee4d84f
SHA2568393d6ab2be5f4737a4233829116ad5bcb33c0a7a2bd10a59d119b571cbbaa84
SHA5125b4ed2162288e1a921359803207173384922424d4ecff04b05c5a23de4c8a5206c4fd847721f1666b3c2378b6d4510232de4573923e4d4ac736edef745f5f9f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52987498942b4b60a1ff1ffaa9b83833d
SHA180b69b0f058e0b405e0fe16a2c2e3bda1ac4160e
SHA256e9cd9e8d289dde547e61980192bec8442974178f83dd0268a217792c242e7187
SHA5123171a4edb1bba80c1c656bfa8a916faf26664156df6c2f63aa5a99f77d125a561c00c72af7ea5620afacf12f986655881f79849bb94f9afd564d56e077a4180d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f16f9304d2fa62d6817befd23ff1cb2e
SHA1284290b8605883f4cd31eff1b00629d40b9d1a08
SHA2565916b73152c1766569099934f6855772c846c01233cce3adee3e2a0828ad2b36
SHA512e89fd01f507ec085e9442c9acb372abe258006ac48a7508731d0df6505ba68d74411ac17c021ee4b18c1a3b5afe4d6fe694daf4e5bc860d3947ccf362af73faf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54ba4b42682ef76c217d6b749a93a2e9c
SHA1067bb0abd40d8daaf0d147d4baef709bbf4e713f
SHA25636dcc2488d572774337f026bc56f635cf7423e8d563d7521b018539429522ad4
SHA512fd3eb9363ac47f42fbf7b249bf1d34bb206c8883ed9938a966db98a53a05ed4e24ce0b5ca0673112174db7c8dac4ae4ffb40ee57c3132dd4d6edc1db933bdbf7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD588d27322a442c19561e96819855a125a
SHA15df628ac98320f82c29d11845a5570b9397a8edc
SHA256ec194fae5fbdbae3acf52e7788fde7fa93eeb8344d335453dd8d04970f23d261
SHA51281f20212212a27b272199adc511ffa87440384320e8d688a2bafd2950cbebaa429d30353eba363d3e41a5264514506cd200015fed867f7a16bba84879b0de76a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ad158318127bf71ee051153fb63cb27b
SHA13329486505baca8b848fe2368765cb092bc5dde6
SHA256e2a1a32390a0785a0090c57512f2ffed3851d7e3d76c36166502973c170153ae
SHA512beb278630bd3328a73e685834e5d2255229c77d685b544d9c33caf99763ce5c39d6ae80cb5f9979322e7a0d020c53a20d82538cfa4be2ce0f8c871e9bb177dea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD550318d1af7e3b6c06fbeed9b5acc1bef
SHA1212eb42f97da3e23fafd3e9747113c50d5cb8fb3
SHA256194a7bcc170c60059f83a8ac9c9c7f2a73d79ff8fd551dbc8e8264bd27762185
SHA512263921e0f201702773b9117d32ff42a0c6e88916671a2d57349fb213b7f992853e9dd70a7c0d6577dfc6cd9ace3e7c8b9c73682c15f04a6a75ffabe6cab0d036
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b