Analysis
-
max time kernel
120s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
19-06-2024 17:23
Static task
static1
Behavioral task
behavioral1
Sample
bd7d4680da083d80aef573ede12e8485_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
bd7d4680da083d80aef573ede12e8485_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
bd7d4680da083d80aef573ede12e8485_JaffaCakes118.html
-
Size
98KB
-
MD5
bd7d4680da083d80aef573ede12e8485
-
SHA1
d350a50ed42f450880fde39b8f4fe920c93fb867
-
SHA256
134461f497be53bee2ad6845c7643c8dca4a8b817530520f298457f267037753
-
SHA512
9b6cc92b343723fe226ee2549e02de4a595951e45b536e852dc8728253a81d04df4585025ff728a2bf26d9596e85bdfa6d4940e37c28864f1cf703150fb201a0
-
SSDEEP
3072:n7izOhkTPiPd0tur6IUAphdlkI+q+d0Yw6PJbyvxF7iM03E5uv7ML9Wrv:0v
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A9AADCE1-2E60-11EF-9E46-6ACBDECABE1A} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a80760000000002000000000010660000000100002000000089dda0b30ad4d9185e9d5d7d4a0440121f210828989dc7d25f5a445c0264af4d000000000e800000000200002000000010cb7acbf22efaf147be70593dfb19b1dfbb89d49377e7f07a36c71a10b2e42b90000000bb1c26a7fe3c9befbd6444dc8ffc93254e3a69c1df7974e2d4767d29cf70daef0742d2dccace9288f3a3960788d4332426af6374d7daad8a0d8c100cdcb1c0f4c7e5d9b5f7807ff9e0e8b37a352a356180ea4418dd42bfcf2ce1cc62af9e2bd9d244e699a7d0636a134e5be1391bafac1889de5645dd10eda6a66156e06eafdfc729c81c1485983df5556b586ead2df240000000cc4ad0d66ba86c81e34f4a6c5c303620d1584d143c88a5c70969b5ef765bc511e8f3cb1e1671886a0fe6b4cfe3b2242272ad4952c6e0f71f9087a7f2d75a7c42 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424979687" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000dfaf495a4d6fbf80cd58b883aee914892290a705c85c86da25d6f1926383e649000000000e800000000200002000000066044518314a4bc9f59880f70d228ac9533a3f36d9a9760fee601f86c797e92020000000e871043d57c4f48eb5016dfd422ccee744159079cdc56f902f6d17f494a539c04000000033bb9b067968c588a75f70d85683d950ef0aab81ca0e8fcac09ae9a9ff707479889bb5c6c9f94287c796ad6cb484cf430bc8d1bce86fbf92d734158548a56d46 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a04da7816dc2da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1704 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1704 iexplore.exe 1704 iexplore.exe 3016 IEXPLORE.EXE 3016 IEXPLORE.EXE 3016 IEXPLORE.EXE 3016 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1704 wrote to memory of 3016 1704 iexplore.exe 28 PID 1704 wrote to memory of 3016 1704 iexplore.exe 28 PID 1704 wrote to memory of 3016 1704 iexplore.exe 28 PID 1704 wrote to memory of 3016 1704 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bd7d4680da083d80aef573ede12e8485_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1704 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3016
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b7a709b64caceb042b27075b6e1fb700
SHA1453156b12316b63cb1af5223fcb0cbf4450dfe68
SHA256ce4877e62329e2888e8fd9398ece781ec1a2117f2c27e7e878e2e6b422ceef21
SHA512d5b0f5fd31487ce913498e11ba6ce03ead19d9c808d08e9485d9f1ffd398a4f2c7cc5ead3a0cf32c51fbd8d0f3985b99b485f55c94f7b96a9f81ac198ef46895
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5200333134b44587b658e64f96fed66a2
SHA14f581cf2a3974daa1ad5a0ea31dee9cdf2ecea2b
SHA25653c7a0cde1076f51587d71e3064e37c978abba8f135820479d1474f90bc224fe
SHA51249ea0a8ed4d2aeb6e35b4b71678135b172fdb61707c336733e7c666be92cca581617e7c1aa7e6d551aaebc82cc0c61452fe2b368b19c2244e7aeec028e0f6ef1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5176d59abb58fd8fbf9012e797c6ec45e
SHA1adc339229a2e274e02651717995a09b1bd3b4e00
SHA256cd36b7336b54207165b3f29c9b4e6072524c1b5a7487a8c2abee033bc8dcf819
SHA5122364c9f73807a090c45caf26073e74501dbdaf93a8a69d3731340e3e60dac413e737fbbe6d31bdbf655d8614f251135dafbf67d77c1559fc8ac1c0dfe9b7291d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD508698f8069c08061f0695f82f6af2538
SHA1aa3a7a43063b0e1f18c35ce5dc8c687d2baec21a
SHA2565d6358381b0e1e74eeee54484e17991a97c93f867d8dcdb829d1d07233dd13e4
SHA5125af20ebf2dff13b96714e70deb268dcec0d117e7f7cf2deee716e4771d85801c8e3ebf2185de539c27bac862743222a89d74cd1825c17090760df726b3279641
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53daf74dda0f427614831b092dd608389
SHA12fd9ee23352384f94d60241cbbfde93ca4b3c831
SHA2567ddddafea9924742279aea25236173a39166af62162ae7200c5f8622f457d26c
SHA51206b2b4d40c8dc966675790a403674756bfededad4f039e5598ea1e16742a82dd227d0ebdcc590f158f3e84ce927dfd3d162e50c4ffa31cd5a2a6fabcae075ab9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e51bb6dc97ac65ef81cc930be974a3ff
SHA1ad7f516842e03a1366bd756490df59658a449eb5
SHA256e039c9d403d068ff1b9ea6d44cc2557ab69c9f8c9f18f524e8bc483c76e0aa36
SHA51250a563afcfccd24b439ae9370e5db8cf4f798e9402547e727b42d97d90802573fe683c04f8291f5610f2b820efe97c34a17c2c7cd3e4b00a336e27ee2ba23cf8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55432d785e7e9ef23aba1f35d8a6d95ad
SHA1f3901b9e1f32167fd0bd490efb19281811a8c808
SHA25690661b45ee169e36324aed1d85e47a60c373712efaf37b403be68f9eab74f753
SHA512fa9b80b8137399dd71f7d4a07695a59f260844d67e54d5275ec694765eac60c542dbec1067a13681aca29a38d59a64410d7f8bc21883f71c53e966e4aca5261f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5196811211f39c07697d4c384c0e06589
SHA123a98449f64cd567edfbdd4b9ca4f524e234f2cb
SHA2563c2bbe2ac014bf9b8539a89b852b4b49cccf74f67ebd74b95cc7c5de735f0196
SHA512d6efe4ee55c01f94f16e70b999cf23639dc0d146ccdfa0ba32830d7550d5be84cebb40dde9e8ae1aa29227f24d9cdf72381717bd01c0c05b07baba8c00bca4e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55280b5868b2706e7635d6dff74b68074
SHA1ff50c41a9bc5f31d0db367f933fe7c0a45845000
SHA256d0ef66bb0928c7f80b3645a99748ede9790664098addd8377c4971b6f9350029
SHA5120f1c9764fa172f627d66e9af70fef355da8676be0dafdeba435474f166163a941c8d77cc0adae4637de06d1cc9852ea88cc2013b96a71308d40d6c6b4bd65443
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aa025b840c12afa1c0e7dc19f1679017
SHA1d20ef26f96998ca7ece3ed94fe9086c72441b0ab
SHA25696ffa571cbf0f94a5cf240cc793dc02f88bae23e3d0246ce25d0222e2a8d1166
SHA512ac7723a384542f603804682811ae8319762c127af8aba2aa83c308f34c7829d2a2ea97d6ecb5e30741c004043e826795a6144b69ab12986c54d0f46bc0729498
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a388cf459d7d0747f6a6ecacffdd393c
SHA13610b7b00fea5eb7cd9aee2e04e40cd89be94279
SHA25679765f0e8314237a5094547daba57a7a9adda1b77731378670086451529f5ddc
SHA512fa5f31b8c3bf5543a86e88f3a89c80a16651f38eb8f4433f5483a91f09441ffa200fd14c0df088f3dd4c4aabd7213a762e91ff32f3b4c29446cce3c69448f7df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5224869679d133ac11ef89639de33d129
SHA18afaaa85f5815edc803294570aa99435eba20f5b
SHA2560092f9a1e506081b5b3b009df1d97e3b48a94ac2eeacbb9734f3acc7a6615062
SHA5123da430113bc744120a23f680f7d3301b380bb9308e50f9bdd6a66e6720c8f363b5f97772992111851f63b836634e47ce5c36801f33c05c7b5198c929cee1313f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d311e19ccc89084b336871521af39258
SHA1d344b3bc3c265d8af9b5faa478c8aadac92e8014
SHA256d9d116957af4ef3fc103c9e1b1d318110d8619eb979aa5c063e0f1d80383d390
SHA512759409ffa5558be3276b5684b7c6b796cb6dc378614a9e9c7014cf1af33482dd77e1097a5d28dfc6a4bac5d17337a56d2f5fb00ca057bbc8d457fe4c757195bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c681825248b262ed993fe5a36c73ba9d
SHA124a2238d26319a62bf8c4e0e0beaec7e77d8abce
SHA256a6039c76972917c372324af72ec004e8677b5bcf7415b97dd277e6fee5743765
SHA5123d529034904b27168d3355fc06c532462a55d388984031e8ab8f6b08e1dba5343a85184306b0ea042a9f3cdc12607f5626d5e6fc989dc60a2caae79144255f20
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d43578c69342d59adb46f6722f631798
SHA1a3a1434844ed3bc680fc105c75f5cbf3b7a6b6e2
SHA256682e075a456750ef7469b3394558d38879186bac5f1b47c5fddbb37502fa6d6e
SHA512d21fd4c8ed699888cf87312cb26dc4bd2405e37af421778acd33c7b11c9cea874c72fe6222ea43ffd9c6b51e6663efadd4a2232d8197580410a75feca9cab0df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d86681ab54c506a0f98291ffcf61727a
SHA12e35a22d17075543eac00b0b03d41b857d93d751
SHA256da3968a80309fec5dc810e6397438632a2645533d1547fc0137153b2b41ab801
SHA51292fd742bb927ade2aeeb96730365e2a5bd018dbcbfaea05a63883cf8b454675adcdc65ef75f7cc1b35b417f65fdb9eb46707a60a3ab2c85bbbacd644a5a14aa2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD519d0fabeffdbe5f1b842c72d523e8c05
SHA1354fead4cc0051df0b4ed7fc98ad92dafc553947
SHA256ec1b943b105291e77f98edcc101c663e5dc19f5ed808d1be5fe7c7a3725a8a7e
SHA512322e42e853a1bcdc2e98368778a361b6e529a5783bab40a28d44dd358c8948b127a3d4bd8ff4c66253f773f4bad0f3d2493489c37808baaabbf7ea347050d142
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f23ca0fadf3231c2878f25cb41254a39
SHA1d7cfccbc5e0451d2c75c80c8b4e85a1395ba64aa
SHA256c61985b462ea78d5afd2ceec7d471e54a54b1212131b67b8a236ed457ed48af7
SHA51293298a68160fa34dccfbef15bad5f863b7d1ab09bcaaa2e510d7ad9c17302d0b13ba49bbcea40c1e2c49f4ec92a23a92cb672eac31007ee0db56090e7c758d57
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD541096bcc9932ae3d24dc99e92b74ecef
SHA1d9bf32bc8e31b38216d28aac691ceabbf51c0ca8
SHA256cf9701d160b3c5a53ad60a4962e38228f4d74f171395f5c5be8ff9496cfc5127
SHA512e5fc3b253df12c0628c284e41a9a74867afec8aa2c68ad4af9a552f8837420c5074c3a0cab42cedb185312cda8a58c406db68302a7ef63557bdfa743af6117d8
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b