Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
15/06/2024, 08:46
Static task
static1
Behavioral task
behavioral1
Sample
ad9a6cc3d1eae0c41d3fb7a81f8a1e60_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
ad9a6cc3d1eae0c41d3fb7a81f8a1e60_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
ad9a6cc3d1eae0c41d3fb7a81f8a1e60_JaffaCakes118.html
-
Size
2KB
-
MD5
ad9a6cc3d1eae0c41d3fb7a81f8a1e60
-
SHA1
5adbd5e9358ece20a22390fe423d416d2acf8b79
-
SHA256
4f9371a9a6de02e842a842b33488b9b139b8ba7de54476aa120aba5f7995ac27
-
SHA512
86ffa9d0c9b84948dcdcda2b9db5d093d5d3557b0a61bf3a47f66c7b83753a7555cb7c1210704ae43748d11f96c18e44da738ce93fb570e59bb3c56384c8853b
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 007a9ca200bfda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CDFC8281-2AF3-11EF-820E-FE0070C7CB2B} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb81000000000200000000001066000000010000200000009ab755d078dc89be018c2d2a07915f76a5fe34f0e706cdb084fc15c4c6fc9f53000000000e800000000200002000000018b23b8123593d1f6cce3731a56cd58784bb66a453742654a00805b0df07054e200000006a41f4abb0d95048765865dea3ba292d9a2f25b84a28f88097ae805505588d5440000000ba803233adaaabae08972ffb464d8e0db486948a72d2b66f9c4e58cbe067921a8825feaae0a64970f5e41bcbc519d62b46b0b61206a9e2bdedd4fbd87e7ae191 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb8100000000020000000000106600000001000020000000b80d3d1708e60c007ad3dcd48f8020218b5a6e710d320d7586a9b72d1ac8f998000000000e8000000002000020000000475191b41bddd663200c674f0abebfe3931bbcdfb7f57174a9cc822e184d3eb89000000061c6ef1f27dbdfa34a747ba22cb5a77a394eeb1c2d6aa84348cd8bc17aa67a36e6475b0a14c3f4a107176404d5d6c2c460fb6c89501376dc5931649df6eec171e6222be89e0e6b46b873469c5f7847cd490256c3d8bc76b385573dc48c83bbb1eb45b9916a4350180781e3a91d72314965f62e450564ca23f91da5d0c8c123b4a148f7dc054632b42c89ea2db61ea70d400000001f6aac4f66096a2bac114393c849aa1e7e80523a105379b14581bacda7c8020bf5eb605f1552e8486d550bd9657fff16e3f3a2c2e44eedd8e1e599b32123a621 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424603076" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2456 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2456 iexplore.exe 2456 iexplore.exe 2104 IEXPLORE.EXE 2104 IEXPLORE.EXE 2104 IEXPLORE.EXE 2104 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2456 wrote to memory of 2104 2456 iexplore.exe 28 PID 2456 wrote to memory of 2104 2456 iexplore.exe 28 PID 2456 wrote to memory of 2104 2456 iexplore.exe 28 PID 2456 wrote to memory of 2104 2456 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ad9a6cc3d1eae0c41d3fb7a81f8a1e60_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2456 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2104
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53caf46e1552a6b0f1a06e9def68571c2
SHA121a2ddb7ff3085d30d815b0b8dbf85f9f4d3c82c
SHA2565cdfe7067c2561630e60789126bc9fc916b9d4322dec4af93fddb5471cd048ee
SHA512ebc0435c3156879a332c319ebe57c9bae98fbd7018ba202c016001d82013494b674c11d8865cb532c1c219f532dd796c2fe9e42e127862a36637c37e47f7dc52
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55a241fb652d2ba2523a4ce998842c688
SHA18e126aafe6e22a69b10caad9451c875259c05d23
SHA256b78e60c9ba4aad1576f597a8e0428b986dc6532fe17690fe82beaae0a52e6c7a
SHA512fef381b6e0751e75aa71be728791b9a23289cedf092471ea31a15576bfb116ab5b51f120d085648b8c1361be267dbc9aa2e789209a71b7641c9ab6d7bc273cd1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD543ae27823154b0fd31c36a53467d5c21
SHA13645c8ba78bf7de8c313790b0d9652422c6cff3b
SHA2567ce305fc97e762eadc8e8258735c1442a864b9566e58315ebf06ed28ff9b3eb0
SHA512d255574c63316041821c63ac181717419a2d0eeb440290c94f04ae9346a7db2e1f991a70dd1d75acaf99dbad657528c00c77523b9818ccda2190da452feb2bbe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD511f9c84f8127bf4b025ea8c1f66d1cf9
SHA1881f1ae55b7bc16573ea3760831418b20934e8ab
SHA2560c71e3512840a6b2e393fb23313e2d7950a5ff5e5e7c9a43adf0f46e553e376a
SHA512ffcd04575314e184c0d47885c103818097e05a786d6e110862781132df5c017400814c4d496f7c924bb247e003d1a811cf7f2e2103a0b6b2ddd21045afcc228b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5517b92660f69d314326add866edd763b
SHA122e7b503911d9ec536a74de051dcf4e9adf67e81
SHA2561e3395148d2dc954ed9d0ab1e918e0a4b243c82fd339e3c9c6eb849a3ea9d2d6
SHA5124aa3a17d81f9df7d136ad4d3bc0e2b1faf7163494796382d1498eba0580af56f6cd82f0b4f735594d0722ca010f8a8c69bfd202ea516bddabf4b1ae3aede6e3d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD531acbad83ec97a1b989295036072a439
SHA1f7e4e401ddccc7a937a1d4fd690cffa7bbb8fe68
SHA256b1acebd61ba7abe178df2fc0338ac3bf4c8516cb2e558e5e52dc46e462e2b5d1
SHA512c6ed356137bcdc18560547a5d432ebbbc711a089d412f9ac3099cf10e553f32675627250221ca31d1f7e29d4336a46086cd1cd6d5fb95d41523d5e56b20ad58d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5241caa07c6b6c39e902294cc1069540e
SHA17bd76b63ee0640f587c153fd6241c696b4984a73
SHA2565697073cf91dcc9be87c7644c13c1a20d28552ef2436c9426dc0421983b2bb09
SHA5120e95697545042c8b8be5551e7f38b238005aeed17265ff33e0ded1f9b77e6cab1d0221159e44d331559211f569f74436d6f32c1847807670760fa400bf3455ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5500349b3ed63fd74b806ab38b4dc340d
SHA1228c452b490bbc6d6de5df0bbee80f05dc823c79
SHA256887e2cd1e89868260731f8575cedf46611d4f4654e71072f0f6a4648fe148548
SHA5125f07db16648dacb6f8255a0e863b90ce486009695b9606a8854945880a5c47bee22e6ac84a51eb541cea931386622257ff12601cdf1836978b204874920062e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b62daabbd5211ade06b5525468716722
SHA1637df88f324fe291e9098d60cf20e331f9ea8e2c
SHA25656509ae1f1ed5c6f2461b6f980ef5a9f4879a72c47bb23c740e76e2def30ff34
SHA512736f5bbfe252c65fcf6b521abe691a51780bd75486d5a42ffdba61db8987c350151241f927ed65cc9f14cfa378bc8dc399cd925ef9a8a172e0e0789ba46d5e48
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5241c2f3ce05798f25b07b16b85b16dd2
SHA1f6cce2cced9dbc9e58d423be1fc789633e8d8325
SHA2564cfef9ad6a9a81a75374b45622663ec8f5c82ac6f37861dadb60cb135e324f96
SHA512155ff1e3d15db52a6a9daacad7044cfc3371fbe62e7bf72846d76a568b06c44c7746a525444597d227bb638e8ee2a713e8b72b97946fb74e67e6719096c4d492
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a897824b6633c312d94a993146b50366
SHA1af7ad4e82a5dec9d6af2cf0fdddd3a94ca258090
SHA256d63c43be6c3d5946b27f637da8390becc910589e3f527c0077b21d43fd535364
SHA5124b5878e8d32f9f581050959a45b73286b975fee0e271668cfb874b91a0a678436d392362d335b20ec27f64fd50084ca341dbf763ebf363f706307208f03048f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD533804d6e89ebf9874d46c945551eff26
SHA1e91f36465a76c98b2596fac3281675357643fad4
SHA2563f76e47ef7df0c77d12b58bc6e60165499f9a7c19694514372b3cd0cdd5bcd93
SHA512f26ab7d8316ab0d363a93cb9dc5f6e6e8b35a0d650c49d754d8c06914458be41a1060dce961c07cdebc5187e354a1bbd02da8d95eba3b5cd330b5549a602ace0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD538a94636cef3ebc9d57815d4c41e3e91
SHA181f18db2f3dd6524355edbdd00eddd05d05b4205
SHA256dab0811ed573f425057670b4af8ef7f5757f451bfe9eb9e4514d20322c887c17
SHA512460806ae383925ae09114dc872f8d40dca21dbebefb5c2764a370726e51c9ef73e3bf306f25a9aed1dfa821a3f103ddeb5f6e9053eb6928f3014c0049191c793
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54b5cea6e496597005af35d6a6bf70f0e
SHA1e5b36f0df3170802fb6139fb34f9f21c9ec2de1c
SHA2568c2536f1ac9037cb292783d913abfdf369f7c640163bc6a91492638e14138884
SHA512520645e3763327d05d3ce540a3108b66c432d856366f77b97415bbb54e7bbe6b98a5c2a8bdc34804655fa2fd0ba1ef07f5c5da7402cc14116a9e649f6570b390
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD512178ff945e1ecfb084399ade7b5f6ba
SHA1a775acd41a3a0e13f44f036dbef30e037bd6f411
SHA2569c4f676633f8534d47251bee25aabaefeab92165c25c298c0910f723d190f686
SHA51217cba4cf201bc551ca95a2195e6b4e3f828da05e1dd046c48aae325cb5b3bc93fc419811d4f4e9e293e127ee26b2a47a30da0dee67264d926992e8e3f1c40a44
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d844b16436911e5410354633a75146bc
SHA1f9014fe3ff4bb3e3a4f1867fa8d22dfa33fdb732
SHA256d367104008aa35d73036b742994e40a1eceb5a50e8669ab4dd7bd52f5cbafbea
SHA512aa3c11e1d101922b5c2f2c13ed4f0e4724a6a4e1b9a544e43e119cc0cf97b0a143f86cbecc5e8b34bd41a49cd1530b523c0900b286ae139a575f941faafc87a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5475bcf42b110538d20ba37ace451d72e
SHA122f2d87b2c003dc71bc38d8970cf8197c5cefe57
SHA256db95fd401b4d4b8bf34977dffb10763165973b5ab645c5982261708aa1116e81
SHA512e8d627545ce7a274bf7deaf50a32eb5dc9b710b64a4d20f45d2ff75896786b1f89a61ce67eb1d83cbde656639eb040d406778c9e3e318ff9ad9c78641dc4d94d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d14711d7d1dfcc03441542a047117386
SHA133b706a7963eca93010a02eabc5e580078ff5ff5
SHA256b145910d22434035f7077f2af6cdf9b6805e2496a1641e33f2b2013da9770baa
SHA512a4ce4e771c9cca035cafecaaf71bed96e8895cb060cc0bf9c5e2540742e82af85ef8b362c8816bc3ead79909edc10044b65366de2e800138a54153fd28bb079e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD502353a223b763a9ce907c1b45f89efd0
SHA1bb62a310149816b4862f4f8e6c7ddb3367384be0
SHA2564d42f5a571160696253d606a62ce225d46f4c077bbd859afab878fe05e099109
SHA512a94c5ddf3d7b407ce71ba6bdffafba3f42544955ce6029668a192f07d2aa02655bdd8e11c8e6e75b768a16310f4f9d265817bc87be7e8a021892aab2f064d3e1
-
Filesize
67KB
MD52d3dcf90f6c99f47e7593ea250c9e749
SHA151be82be4a272669983313565b4940d4b1385237
SHA2568714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4
SHA5129c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5
-
Filesize
160KB
MD57186ad693b8ad9444401bd9bcd2217c2
SHA15c28ca10a650f6026b0df4737078fa4197f3bac1
SHA2569a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed
SHA512135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b