Analysis
-
max time kernel
135s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
15-06-2024 03:40
Static task
static1
Behavioral task
behavioral1
Sample
acc4768c6fb2d79d348b7fe4104f8f3a_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
acc4768c6fb2d79d348b7fe4104f8f3a_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
acc4768c6fb2d79d348b7fe4104f8f3a_JaffaCakes118.html
-
Size
29KB
-
MD5
acc4768c6fb2d79d348b7fe4104f8f3a
-
SHA1
fffcc4eb6cbce28a2556576c253d6c29be75b26d
-
SHA256
14e7ebc93da9b1ab2e8a3063c356b23437a61c25077009d73d525855e6e8482f
-
SHA512
8c174e6c233560a56013e61a0fc63fd08ba67c81680190314e077175a068788004484c3df9a3142257432afba7eb00fbd6fb423fb590b611469d46bd394ff48c
-
SSDEEP
384:C+cMjIhvsIxTN+4w240WWtH/kKitRdnPd011n:CrMjssIxTN+4w24dCH/kvtRdnPi1n
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50c983e2d5beda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000009ede798e7aa4cbc7e45137614f1f6a60045f12e1ec65c1d5fa90c97b29452469000000000e8000000002000020000000f01802ed9788dcd414f5582a184fd939a7cd2d967f6f6e6d4a85df7081c15a9a20000000c7142b889eda92af19d9bef3e40b51f8ce25a32f2a82e1ddf1390cb0829e7b404000000091bf45d0ae2a62bdfab216eb1f5b7f86d43ed35ca5b2bbd669f4613b643f9be1265500325c3ec1dbdc417c6fb6ccb4b2bc344e9a57f9caec80f9f32f4edeac6b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{08088581-2AC9-11EF-A243-C63262D56B5F} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a80760000000002000000000010660000000100002000000094a47060f1aac9dc246b19287a64928e85f951e29522bbfb35d872d08b10d15d000000000e800000000200002000000048e95a08fdbe899ce748c5ea0f2641429a4cae8534fb09a919c2230ec446582790000000a965c50b5f8f49477701949121a2e03c674653b8eb9737da1aa69b1e11e3c8e90f4bb3fc8fffb8819b9fb2df3498cb479628a54499e36490c932c4723269338c88adbac5de07692538cbd28b2908756c3ef6ba311b72f42bece6270c2cf511af71511f279b0d5aa487cc864f7bfa64fd544cb2464781701fd029b4e475d5ed6273919f12f51e743dba581b3fc8f85e3940000000ee6aee2d5e61770fb3e3f0cd30daf30e36a13dfb0ff6ed8df109df577556e651e6063362e23234a6859381785b9040729a283843465562a767f67c0c6d938c70 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424584707" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2640 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1704 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1704 iexplore.exe 1704 iexplore.exe 2640 IEXPLORE.EXE 2640 IEXPLORE.EXE 2640 IEXPLORE.EXE 2640 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1704 wrote to memory of 2640 1704 iexplore.exe 28 PID 1704 wrote to memory of 2640 1704 iexplore.exe 28 PID 1704 wrote to memory of 2640 1704 iexplore.exe 28 PID 1704 wrote to memory of 2640 1704 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\acc4768c6fb2d79d348b7fe4104f8f3a_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1704 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2640
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5563203ff4b6c4ab9337d825454f6d1f6
SHA1051992507ddce7b4558df9bf2bf5e310e463e0f2
SHA25611dfece8ba89fabc6890a1875eca43e1d2c49627b502dfdb62b06effc48ee67f
SHA512ebdfd5a86193c6fac744ecfc15cb2d51c297e0069b021f6e644c5bde56860d0c42e4ed86d3392a18b339951868a8a7535fc84bb5c41f7a63074a827db4dbe562
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD572eba5fbd708b30902d08590f1ba3435
SHA138b8c00a6b75c9f9d2c93177b03ce9a490d1b6d5
SHA2565809637e5c3aaddc8fff6f3874cf6458ef657b866706e2be2d18802e5efa2296
SHA5124f62aab494d05f97c401cd0ec8897a3e0f49b53e20f129388edfad1bc3a2d5ec96a1952c438d56fc75f61728e00bd3113863e750f5ca491c850ed1edaa6fc6bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5996fbbfb928aecdd0d8a7dda477123d0
SHA155c86c6d8e5dfae7e1e5431106eedca7db17843f
SHA2566f381481040da99aff21ab97f1dcb75edc1b768f5c683946638f60ce93c65b41
SHA5121d41bd953efe6daae4959617d8a265127f7124e40be55796ace02b5764c14a4fff32a2531babbfaa2467c6c92325784f574a3aad7d72b620db7d31cf7803777d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cfacda73b2eb817e2a564d76811c9795
SHA105d50a000c25939c57a578f269cc824b1f4b3776
SHA25605ed44f822e0919d0e72b44f4a79aa16395a8f9c999247e2784f5adb7dcc6de4
SHA5127d278d69b5c2c1eaa43ee2e0dee4d639f9f50b6ae113bc2372aa9fb6cc63c014c5d03ffdaae14a07ec83d3c40fe3ad820554683902d561a0314c40bbb2da5af7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5edf3aa7d6fcd379e202d12d0b27fa0dd
SHA1e0032ddc7012fd78d2be24c572b91e998369635f
SHA2566b782323d8aa760a4f720e0d394588c4e1c3b94447686c37db57eee9a870f2c9
SHA512a37d47a4b9c17e8202005b61764194d4020b0bfc0a745a41797eb831add6fadde8a2257d8126c53f876ffa95d402d781b9f1a305b0f6769bbcb510a39ee5d848
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD507ed7e0b238339ae3836fb33a78df59c
SHA173f5e57e42cbe5b62ab8f9d8e2cc77ec2e84ec18
SHA256d2c8ba3ba6bc174c102121c7ff0aafcb551d2c61ba7e0a7f3ac9070260307328
SHA5122d7311452c61ebad38cb5a9e7117485974383b54d71f7426baa65009bc310de37f40294c811906441e44395aa005ae781e78020cb62159ac8b0ae5e9729fe5c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56659792ad5fd4cec04c62495c926a4e2
SHA1c9b4abea8133a523e4857a0670a5bdd9958f975b
SHA2561a0287839997a8697d2e843e9427ccd223c00bb19bb7d0bf44f553e2c4008e46
SHA512db82b08a6f7be009c7554659c4dfe3dc76d31ea4935d3977121a7c081c7926ae69bfe76d1d64ca6566734d6cfa920792e555f07d74d13c383932726bdedf0653
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e12157ad4405b0d643339b030f4d8105
SHA1e0ed7c0279fded3a9f33708c0d19a63b63fc320f
SHA256880963748d0aca64b61f7cbacbf013da443d2cc51ee4ecbed2cec142bc860048
SHA5122092c9f0a47800beda232948ba166acc0569e0655d17dbb24c892d4015eee9177e17e6e42110df779262673899d0670b4c26996cd89efc252364c97d4931cbb3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ab39967ba0e3d65970f3486d2d845b55
SHA1b7f77a15507b7adda40261f7fc283fd71959630e
SHA256317e4fbb874378491695d9ebbdacffbb577f99208d6c5ef25d0a78f07830c2f5
SHA51237047433302001880b9d7686c218f4e15de55d0b5bbf54e46fc9889bfa57cffe5250748efd6170f2eeb82c33f46a89ddd261c557b51943561e404cfbf656a39e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD515df8ea962cfc89754d98bb300d34ecb
SHA1e3f81fe14809f15f28ca0d0e9ca8623472ae3586
SHA256e90087db2b767ee77a04eb5dfb96c8767a734bdb681ccb2053d8025a7035a59a
SHA512beb41c9cb1573bad4d89c04d6811b13c2a78383385cdeca9297d340f47dcd554cf7bf345f55bb534e74887bd14dcb7b8d1afd498b6851841c6f6aba2967cc429
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD541d5101ee11064e6acb8b9fcad5a2760
SHA10ad97d81b6e77fcf1b8d852c79dc0a5234d47ebb
SHA256d67dcf65d78b55bfe775088536be2190d5e91916613e4c0b7fa4bb439fc5fd3e
SHA5129f3a2c345b181d030be8abbe1265e490d14e183924529cb0466a3fe18dc2dba456bdd763fa5228dc62b548ba8fe7f83df06e7657260c3bf6a6b6d2fa5420a594
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d9aec6148df95992972bc4aed3c149b1
SHA11e9dd2e66fe531c30a6a51db79b0ba2a4b5cc675
SHA25654499a742d41a658b8a9ebc2902bae5efde8116fe3670250ddadfc7af3404a3c
SHA512bd55a727db78ee3ffa15ea0cb813940607c5ccad0615105a3aa3f13017992eb7126bb5381e11bf261dbf6bc169f247f9018c6a2b7ca42cc2e17d1cb7bd882703
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5698471dfaac97a722bcdf04abdffad25
SHA1700604314d98530f06d7626ece2d15f4ba00074c
SHA256c2acc540ccb6086bbf5373427cd2d7b409f6b8888916aafaa2ce9482e6df4017
SHA512b96e740bc9b7e71699f9c4fe41a6666701fb82b00380c8ecbdc442a5c05ecc1ce121fa1bb11b91f57c4b50378d5041cdda0efea6f4520bf1cb2eadf35469bc28
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bdd21124897f3446d4a083bae32efea5
SHA1b30d4fb543576d2774074c23b63fdfcb0e17160a
SHA2561e467110adef8ec99bf2a1eac786d9effcd4d77ff91fa1ab332b506a7d43a236
SHA5127bb0dc7536415dcec5ae3d292328be9d19d7f8d91b27ba67648b87adccad8a1ae548ecfaa87fd5654c0d357bc5ccca85d7a5dacfbe3d18213335fe6a56d36286
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD550da20af2d9b4dd6db057e5dbf0e5e8d
SHA193c7b99e2a3a56f4c5456e1455f070eeb9797c7f
SHA256e831a2a607ec7aba8fefede129ad3067f03706b5cc22cea84621bed90ff7717b
SHA512f5607a295d7134639e439e35e08d6d7c5d1cb4d236719713f1d39484a2baa03e7ed7dac9a42aaa4368de5e4a401e1ec54cf97213a36b9ebe4683088b6a99d343
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d860a5a89996d7ed3f6e63ffb0c7487f
SHA1ea9144a21d352c95884f4d1537dd1597d3fac542
SHA2560ae6dceae08a67c18a4ae4cb71a6b6f58b154b183023a8c9ebf2c19c76c655ba
SHA51209cdcd90caa68d7cfc1122e46b051b01153c5d01c3ecb6c6686aa4274467b3e6522ceb10ec983132ae5ba7606303ef3d6c5bb89767de60eeb0425bf256f34cf1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a18f43643f633fe5fbe95416513a6097
SHA15dffb89f758ac9c65c34bfa8b210aced680b908a
SHA256f6ddad15445b84e77c5bac6de1131b3748c4bfbdb867bfa23913bd24cb1282b8
SHA51241c73fc11074be4bdd2f464d247bc932de2aeba5b331b4ca67e6b140365ad60e1193c24a58ab1aea575aa7fbcfad02b0c4ee95c787aab4ffc67b2fa3081b824f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5177ffdd1467dab257c247639dc383eca
SHA19eadbf6ac406c4f88c878e1c0bc96dad63625412
SHA256ef9f4e07b279a1bd235f13f4a26b4da2798937e6bde563e5b60b31a136e36df9
SHA512697fbbc9688067c50722b1d40c9874f3a900e7fa0f3a868a1f59ac914d37cda961df3710303fe7e13b322b439d12795fd69afde5458d96351f4b6c48f04d8891
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b