Analysis
-
max time kernel
141s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
15-06-2024 00:52
Static task
static1
Behavioral task
behavioral1
Sample
ac4fe9410b2c15f6f3a9bb69318cb67b_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
ac4fe9410b2c15f6f3a9bb69318cb67b_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
ac4fe9410b2c15f6f3a9bb69318cb67b_JaffaCakes118.html
-
Size
70KB
-
MD5
ac4fe9410b2c15f6f3a9bb69318cb67b
-
SHA1
c8d972121fc3b609d74c6d4cca8255c9e56a9672
-
SHA256
c4aa394024d570ef3b65fda3642d95ea847ed80bd15bc407aab52a8fc9ee5fd8
-
SHA512
0927a206fbe3a0a435258f112180e6876db0c60679b6ae2723c7ebe01d76f7a571839e59966561f46109a263e78dc6818189d28140f419b2e407ce70562fd690
-
SSDEEP
768:JirgcMiR3sI2PDDnX0g6sm6tcoTyS1wCZkoTyMdtbBnfBgN8/lboi2hcpQFVG8sM:JRrTzNen0tbrga94hcuNnQC
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb810000000002000000000010660000000100002000000007a6b2c5b5311cc2e9cb8bc2748f0cc410ae50dafff5d08547c376313f9a9f74000000000e8000000002000020000000437d0b38f72a7e6c3e0427ed3bb9566e05853ac899d2ca7f8b27b496a63ed5d720000000d8a9c8fb7c4d4455988ff064d3c8fcb5a64d7a7dda862d0d398ebdc5b93573f940000000c7570c890f7b28b17c2b528054ba821f2903d0d4806a484118cbeec3e06bc4cca0dae3bc1b3b6a91163baacab74486680af8d0390929144620be8cfec186946a iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0b7e556bebeda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb81000000000200000000001066000000010000200000004c6e4ca046cbc10ea3fbdc1743bffcd852863c00d0954d603488b20fd3ae7bc2000000000e8000000002000020000000e631c76264d81fe2669df106acec8eee6764adfd405b0fa24722a0bfbdff5fb590000000a61d99073573c62244fb21ad452a438748e689c28480daaebf36617547089fc3f2e83b746c1c2e74ef2cccc9b08bd25fada9a8d590f9735756ab213d1d7a97b762c75f1416c8a52d8850b3f9cd836bda1ffaf51c099513d1fd80677c57776b7707174638798ade7427c94e60f2a990dd898ae8bc956b0a57e0e6135ae7e11c5f5f46bb35ea1b39dc16739251ce797a38400000002dcf48bf917c519b9888046579e6c9e6f23eaba146ac9d8650e617891b742cf62c5e378e7eaacba43dcb6b4f6c68fb250226225b63056b865e5c941f03440764 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424574603" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{823220E1-2AB1-11EF-B9DB-4A2B752F9250} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2472 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2472 iexplore.exe 2472 iexplore.exe 2632 IEXPLORE.EXE 2632 IEXPLORE.EXE 2632 IEXPLORE.EXE 2632 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2472 wrote to memory of 2632 2472 iexplore.exe 28 PID 2472 wrote to memory of 2632 2472 iexplore.exe 28 PID 2472 wrote to memory of 2632 2472 iexplore.exe 28 PID 2472 wrote to memory of 2632 2472 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ac4fe9410b2c15f6f3a9bb69318cb67b_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2472 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2632
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b5e4992c962dc0f7271b5189d0105719
SHA1d655049a504deeefb51620ab212f69cb5141e701
SHA2560697ebe0b6a6a05816b9ccf4e5065c20faa860af4d649876a20f45372f87444b
SHA512ceb43dd41bfcdc10d7e7d62616d6400d6fba7bc8073f815741394a6d2cdd8af04eb517d8186c1bd811637e451dca1970d4cd7a3732170385006f95ad3c72b013
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57ff5e003a85c589f3d096708ee9777a3
SHA125a2c4c6309529db4bff5ffd537a3ccbb7441cc1
SHA2566d9151d9e7b9013ba4ee4fac2519e84a82d94db13bdcfea07d4c91f5747faf9d
SHA512284d03f6991f12717e1a3ea89ea6c6f44069984a70a832dad431e512e691576aeb7fbbc8e0f07ba3332c7baebb5a233d43a002e27c66f48ef38a56becbe1f12a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD541880cb7d43c8c7baabfdddc478b45cf
SHA18b878148174f09326c5356b16def467ea48f72c2
SHA256fa3783e363605d1d73d93c0666551083a6d9152521d48d7e33f7d53f77d59147
SHA512e4afcedc58f9ac5f4c6f40a633c71fc77e22b55d4fbce3a9ad4ce3646cd1100436aec81192fea527541f5d76202288bc85de017d0efa5ac04846329fef2c63e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5015be6808dd5145463794d62f5cc7a45
SHA1b79d534c4178eef9869c05e40ea6ec8a0e8dc0d0
SHA25647d3aa4e69507096a6b2e4462fcf4b153cf3c9c128623108a689aa0d5fa0e1e1
SHA5126c767dc95892badded64184aa714f2926d14e7fae27fb5e0f1f1cef023b48f081a612f296f36a92a0034bc5acc4cb388ba7629b326679e6f80d00161b80e24a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5440b0ff2a187095aac8e186d4cb61395
SHA12ff79a2a457c68b0a464b2eeb2e309bdc28b278f
SHA25637846d947618cdcc4088d629c08d7edc70e82e269c1ef2b4b1857212e1b5b1b7
SHA5124c9ce9604ebbb030fce5deeb34a6f70a55fb49c9c6db064b18ff8825c18c2173d158581dce8ee4de4221801ef5bb0fd1a1fa3815948f2355896081dbfc8844a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55aa9d193fb7cbcd49b0b7f93e3e32e39
SHA19cfa31ddf72c60567dc1f6a2692513339d402e5b
SHA25691a1546d0174cfccba00063081703c272ef404043860698b2dbd4143148a6119
SHA512f65d875cc7f929d95a9bc1214bd882ba3d44a496737f38c3de3dab3c28a81e79198c61d701eb11eba68ef91c0966155150f830fe8f8ea798d829fcf53122d662
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD573905d25dca99599a264977c7673f543
SHA1bd40a8e3e3f386e783f63801513a980a315df8a3
SHA256515ffe78a22c6deeaa9d2abd7ee23bedb8274f61830c7863acb61d8ff68ffc01
SHA512a95f99bd64e08df3a8e24e56fed8bc6eee741cd0ea0787c403add2c7a98b324665f3ebd206d6410d25d6ddf881ea6fb507f6f8901e27aa0d8551853a48ece282
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56ee10a1f48209502ce64c3e181003a86
SHA1808386dc8d94953c187216da666502d41315fd7e
SHA256e3e907d1f7b0c0234be1bd17988f8bab4d0393d5d2f262d71f4a471204bacb6d
SHA5125e805cc60bc4b56682740030e29b92ef45fd4b7d6130fb5e0e9c3d2934d77576e933cde9695d14c760a1a4149383b6d0b171be406697217c61d4114a1ba30f2f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e31e108e7a62e2951e8906c8ab7af217
SHA129cb27021ad7d03ac969501dcc74f281416fd817
SHA256a4090624328926b8b26744beb02ba443ec927e647c89436b6844f5712d875a46
SHA5120b5eba17c0175da84483035f673b9bda58202c8f63030b0d29deee9b06c2ddbff52b6c0220a5239092eff3b040dc0beea35ca56364ddfc1c4558de070af03691
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51b51414ed9604a0b69b84f09c64b6de2
SHA12a20e7c50abc68faf3fce4e82341b54e381b7bc3
SHA25681f5f0031f9bda478efa2280689acf9372a87b4730c5568ce6a338e787775765
SHA5125cae7bc3ed9c9dc95f1b6db7bb252c59e33acce44604dbf2638292b45cfcc807905a22e28b6eeb9b724227e85f69ae8eecb0b8d508a906e721eedc13903742e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5202ab90119567f16a81730dfd58ebb25
SHA168c0ca3e9fccf93ca85bf1cbde253dc232b7e400
SHA256f1a3e717927371cafd3bdc4c18489542d9e6b020c9fc31e24bdcd60fee43e688
SHA512c79f00dbe2c1a837098a1482e79b5de5b9c3df9887176a2064fa0890932442b012eb2405101d2b8afc3a3bb51fd7c2dd32d65ca60f59c1f7ee877e9f5aad4c91
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50c75ab2994a65d543b8041de203032d4
SHA129ffa6c8cc91e56ba9a6145aeca29fd831c60894
SHA256f8e2623fe03c040cdf67843664eafb14e103107bb854e2e7d2135c3850a11b0a
SHA512dc83e8130bc22583287b5fe2f1890a80c04f4076d2233254f7f3975d7d83cfc598574b84f5957e8e9bb9b6c0fbe47bd7bfd18c1d3da8867c210736e648ccc026
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5beb72b10c9dbd3d96b8e0f435a52df6b
SHA18b1b12dfb44656eaccc8f66dbea32bf633863635
SHA256d8663e02cd04e1862f546325c03abc6ab3ef352445678ce50dcdf54712a6b50e
SHA512e6b648fbfcf255709b870e48f6f0e6bc27c6f5f6b3792a782214e248e9ed005b9604fae046bcca896a032b60a53de9ac03675c60c52979bdfc1e29b3a9ccac22
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54aab497d44b9383249517db9e8815291
SHA14a62b34b03f67b7dfbd53875f3cd899638a8433d
SHA256102d11bacd2f7653b45ccb03ff5539a8bf2b6a398978befe04290e136f80caab
SHA51255c90a48b6fe0a8d227173023269fc9c1c6bd499ffdb44ab149336e9a5fa417fdb74abbe4629785fc77641f595fd7a5d721ccc5bc08a51c22fce93d19cd308b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5307db1c7baed710b7ed5d5b4ad7fb844
SHA13ffd877436fc585c5871ab304257aebf0850a053
SHA2568cf00bd9c4ef675c7ea136113e1a304c13b209ed08f7453b7fae8938a80c71c6
SHA512a35d0927d6225c51929cd9939f4686d109034ff14533d18f35941e104ca5520edde071df07e46058457602cf480e89c133dff5d8c440cdccf137924704bade8e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59228e8d3e1305918cc6706918f24680b
SHA1daa5164c1a8ccf305ae68a5d7666e47b6c25db60
SHA2561e3c58ab5ea77d42abf3f23773973031e7dd01f7a1edf8dfef5f7ea5cbe64fdb
SHA512aee45dfc4cd303fcfbf2bddf6ae9624ef7eb44f7544b47f8827af2261678a73ff2bada5fad47a2b12c29a6b076a2ee6cc757192d49f3b65a2be2b66f66b294f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57dca36528fd74e020bbf2c7e9dd1cc80
SHA19ac99121773cd3a3a324a2b1322144fb074912fc
SHA2560436f5adca1c84d721504f8f8d9badd3e48c0a1d26e49259ee8ab7ff42c317e4
SHA512fefb0c7486936feab543518266d1e7ce95c7993c120cf135b7ba5ee9a36e9f57973a8bf248b543d77e5cf4d84403cbb846e0d636a996c0d21b39d26c0745e139
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c1ba5806820982b61a09b32aa3f26e1e
SHA1caf2d02f5e4055ea03a51ab4eec37c63fd4cc3b6
SHA256f5052a5c18e1dc60f351a5d1c17b2b4bb522ab2a3b512a3f8209fc9fee8845f4
SHA512cec65ac9ecaeb694ed2ea10dc85949f614d46f38011ece036c84bea6c6e424fa5486f076316447904390c64ace2ac81bfc5b2900a6354de6a968709c61188f0c
-
Filesize
67KB
MD52d3dcf90f6c99f47e7593ea250c9e749
SHA151be82be4a272669983313565b4940d4b1385237
SHA2568714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4
SHA5129c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5
-
Filesize
160KB
MD57186ad693b8ad9444401bd9bcd2217c2
SHA15c28ca10a650f6026b0df4737078fa4197f3bac1
SHA2569a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed
SHA512135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b