Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
20/06/2024, 17:25
Static task
static1
Behavioral task
behavioral1
Sample
08349d0798acde0655480c038d09799a_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
08349d0798acde0655480c038d09799a_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
08349d0798acde0655480c038d09799a_JaffaCakes118.html
-
Size
2KB
-
MD5
08349d0798acde0655480c038d09799a
-
SHA1
e24b711cfbd88aab6b25031bc55ba7c71ed02893
-
SHA256
eb3d32bd9824ad5c2914f640193190d2674a7adfc06410fe6188a92193f0961c
-
SHA512
7baf26f7e974c41983dc6ce46a05aea62066d0df124d17660f04dcdbfbb4b572ce60dd02624602470dc298e39df2eb7d67173bc9dbf13136211004298bcad0fc
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0A7B2061-2F2A-11EF-AFF9-DA79F2D4D836} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a0390500000000020000000000106600000001000020000000d3fd1d84e86aa4733d66b582ead47866b8394efcbcb7cbc089e6f8c4b7c084e7000000000e8000000002000020000000183773c5a8a1925334be1257f5913fc098ee6ea1ebcfd457b73ae5ab45f9129c90000000e05f8328f13be97ffd084715ddb36ea3b072075f22ed278be5e80348e870f1aac2a469922cd71cb04fa3413f88bca5b25e3537a1477e25b21ebe9e5a9c6da65de1aecfbde69d835b77a9aaf39947e19d0a4fffb814ab0cea5e4427a2c3839c7495711e75d70ffb0bd04c40d54adfd7518a1f51d8d03bdd885817d5f1bda1e24327cffff4a8e8feb58b9c46042e4b9c8c4000000062bc8655f8a1d21f71188714c19058486d9cc362c6a64b2d90c6b6e1f5123f890de8e6ff98bce8de94ee0989826a40b20d550bfe72185738573bb83230796221 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a03905000000000200000000001066000000010000200000006df0db335221f38e0faa73ccbcec3a9ff09b3959ad96464587b52adecb80504a000000000e8000000002000020000000baae07935503d1ccab22ea7c8f738641d5329f39e7b37cda9f4f38dab77ff2a920000000760b998753a3cae012b3afc6b75c4b468caf4b1b50e2032cfd7842578e312fb640000000718c7c39e561aff92eda73b127a92875d6d21d123a68a64529286be190ce7319200b398d30cbeea78d404062bf5a93cf00ed15deb1b586bae2d9bf56c3281a27 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1059fade36c3da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425066175" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2304 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2304 iexplore.exe 2304 iexplore.exe 2440 IEXPLORE.EXE 2440 IEXPLORE.EXE 2440 IEXPLORE.EXE 2440 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2304 wrote to memory of 2440 2304 iexplore.exe 28 PID 2304 wrote to memory of 2440 2304 iexplore.exe 28 PID 2304 wrote to memory of 2440 2304 iexplore.exe 28 PID 2304 wrote to memory of 2440 2304 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\08349d0798acde0655480c038d09799a_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2304 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2440
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5918118c50d2f4fbd02cbbbcb7c64c522
SHA15600951e406ef0527068a49191c8379f801bf83c
SHA2564b3089c9a42b4a190fceffcda03f225c140ac36cef18e50292f5aeabd2ea5d05
SHA512e8b598ac7fce02c7ce67b266eaa96bf4f04af9a8f524b22ed231b784a0fa61afa02ac790b585f8e57b57a4298636c3cbc6de911928944e70e44e6a6a55afd752
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cf8ed9e788d01225afc85d732aa63b64
SHA11030a2ce5aaca759985002be8a83e78a17fb0ce3
SHA256ab51bdd1ff908beb11c4362069e811bb67f0ace0e5a0cd40cefe7a9aeae9f44a
SHA512a8fb2f3221654ac58d9e94bfb5171c50a0e2b4a08ba2747dfc6ac0318b8d8b0344f990bb6a4df9f0f49bdc070ab07c8ebae7bb0c6096ad078f5e57103513c395
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59c1266c6271a28b54de70ec53dd23032
SHA1cf4be8e54a68fc6eec4916ce3d3b9b279715723e
SHA25650a40ae4d1a8d7eec988af10645930dcbf3ec4987839009025714e209b0e748a
SHA51288a0ffa1584af48662a6c7eb6473af1c0f11be178c1ffe9b439f139fbf3db2a3ac169f72f0d7c503b0f511729679d9a7be5e437dde9e517ac627233791370341
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b3248117424c004b673955235c8f7456
SHA169fc849b973e8f538a676b6c4c67ad5ce0b1aba9
SHA256aadd96b1ab5de612a7bfce0a0cf24d073178d5876c5d93b7311bc9bdc1c5205c
SHA512734f63666bf47922d76b283a697ebeef19d85585d9e03f893bde1324f054ae91925adf59ea54164f1f6c4aa8fb4a877d81fb27f812ca9c72004346e3697ec33c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5de0e1540e00b2415e02b100ca96d5f17
SHA1d7e0c1ef1bea9f15002549f328abe907e0928604
SHA2561a6677ea6225796f0297d7fb738255e3149e04681855092af873345c4e7946cc
SHA5121accc28f5e3d4a8c45b19c1246bf9bc461de570f5de7a1f8ee50c2d5020df5166a0abb22ee2295f0acfd37525829685aa55374c1bb289f3c2e49382d58c1d9a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52c13e8fa2c09b4da24a0456b18bc28f1
SHA1d14ca95d848e83217b5825e0b1a4b8cbae154027
SHA256cbccdd972a9a6c10df80e121708fe1c85f387054dede71a1ff7ee9cfec103fad
SHA5123f6601e8bf8a3c30150989d384ea308c6e0505b878b444a1c48da035e546b34fd6a0fdd8739de236ebb8b1dfb87aeef79196591eafc191deb80e21e1a7b3475c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51d56a1e3b88f74802ea1c52c54156dd9
SHA170b6085d73002acac264c0164cdf0a81f7869995
SHA256df31de24897be01e7adb9085d61f29b638158eb1424b3b7ecabed96316dad03a
SHA5125175fe2a96260af9d7acd3f7cafa6f55d8a58c7116f0eab87bd25bd68e5112b196e9d3192b5d2d7d3a294690d99b3dfcb43a58ae7bd49565a1e3fffb24d8a462
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57569771562e4450729f272ffafab2449
SHA13594c4e9116af2d0653ebc79c6cda8b08aa76c75
SHA25667690fbe8b5c8554355735911100b57d97e2aad16a941d2907a09de38b79a487
SHA5122dbd975db5e0bd49011d96e7c7882ab7c35a4721671070c563bffbea2205bac1b5b5f78d1b1a1b5363160fca3ca934dd4b43433f669ace35a50818b6558b20a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e5de1177bff41172292d99246af10e9d
SHA152d3ebb8155a790197bdc2238f74e2a31393245a
SHA2565821d8a8de921622c39d18a45f008ba81f06965736840f9e7c9b9b1db335f497
SHA512c86ae0680854489c5427cb820b2d6a7c1e657cb1842cce1d8dc02b034b031a089a585fe9d5c5f9bf4a6398841a3d2ab69c1996cdda2ebf14f1566d46f71bc6b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e1176cb1aa8a75c744b1b233be72a12c
SHA109db3fef817b0b9dc73e031fc6114e007c7fb47a
SHA256b0c87db3648e63f1375d8b2dcd58d0f37be923ac20e636a3b6caea4c0acca07a
SHA512f00b718a312c9b2f911c56eb364a538f6f503c1522aaecf786ebd8980dc4ffced64b1fac42540a2500374029919953963d365fb81c1894f7bfb231bf806df3a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59fdcc89e90c26d2bd3cc84abeddf9c98
SHA1c10dd011c64d6f737d306ef21e02ec0760d35a53
SHA256b193b02f39face2389e0206564b07138f3ed850530047f56438595aa6abb8f45
SHA512a39aa3bd0e773fe975be90f82f0775190794d654f606a0fb4405cedd410df6a017d0805fb0519633b1a88ccd11d66ec8d88d1067545ef353bf207a3cd081bf7d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5be6e7cb5a25e47452e6ddb9b8bbf7b7e
SHA10a32f091d3dd0b98e9af3e6ee00832e5a76ef1d3
SHA2562a62a41252828ca36eee38d79e4af171b413832e93be67bb9ccdea1aba5a92f5
SHA512a600f2580f49fd3143b484d18d6805e85f3d12c598f4349e25114741c8ed960b543da8f3ecdb2f5a90961aa68ebf0c5ee8074190ee4133fa2acc539888055b26
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f95d889b32a8d87ad4d5605f0cd97833
SHA1dc33d4ab628b3eaa3757b9b3de3720e875d9587b
SHA256a765d02a3a9ecdb24fa58e11a2113dbce391df59ae887494a9ec0d2dd9256400
SHA51217fbae06d17ad4a83614f431f0019e7916fd2d38af58f0dc1723629f86c97282a09f2e6104be314ce3e115cd42c7b480dc3fa4b7652613eb373f1fe739f57353
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ab0cb94e032595378476ba1292d10bc8
SHA1e4d52133d1fe99d05339ad1a902a29fb563438aa
SHA25699189d0c5638a3ae14d8f80385189baa8ebee1ec9103b4faa6c22009c67078f0
SHA512668e9b55cfc033cdbce0410cd2cd70cd10829260d415f8d3b3cad75aa3e58c28c4d4574937d4897e678655e6a1b686b2c430e7f195f323aecfbac0caccb87e2b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56072b38020fcec99d7fcac9224b454a5
SHA11c7658357265183c38dc481411e3099da2427082
SHA256a21d421d15300911ef3817d9063d1c982c8095984e85521e0012290d9c99b26e
SHA5128fa39871188be89ad688f69cce45dac27d40343ed6f2ac98f205d7a37eeb13118f4cae1ec0f2bd0c789f5490527bb985e7550c6d7065cadd4af97abe00524083
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d2d3efea44e971977254463e414a1e41
SHA1fd04e8a8462f0c104e9f077ab87942cfe93df67c
SHA25684f0e6176203747c74d9698342f7fda01b81807edfc39ef03b654dcfe74e5e15
SHA512e785d08247d96b6846b9db03f5644c3bb74cf9120e74a76f8a7002294f1db2c21d8340fec38ede7163fb9c8b8debd07ea2e2f20b70d1afc307c643d8d33e062f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5da422c72e43c887c292cba7c6f873b80
SHA1a2c4da6d48a4581efb0db99b6167b2b0d9cfcd04
SHA2562807bb61af70d39effbce72ab4004ba73fd425f66719274f4b5084453db5c77c
SHA512659333609f5c9d5d2b90370e799419bdd9147479e78ba12fc34335cf3a8e9ba6fb28953567c5937428af746173440ff48549064425317fb8753793507d12229f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59f96d78f006590699459be3f2fd3cfac
SHA1dcf2f9549068c85b1c8c45bb1d78ddfb5b6297d7
SHA256ba963d2683eaa8cd7385b5f3de8e1271892c7b4ab2de91b8bcf6de38efa999f6
SHA51206085821792b8f1a570baf948a6659e5ed31f66a6871e285199c5495adc3911aaea023186e324d60bfbe1f172f1447d6d1ae0da5adae48f32bf43876e184d219
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53c9c7e74da7079433892c762590e778c
SHA1a6f1e7e496cc32ddcd12d3b0116e759ecaaa47ae
SHA25682fcd411efe790c8f55ce27f8af817173fc5c9d7c640c8b80d89589d19b982bb
SHA5120de2e110665f0ef15d471bfa0f3a3bab60054b6eaad19897d7da7630db9ffaf2fc68c2cb2e868f5376835a843bd7d87c9f67ec028ae01f728408466edff32be3
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b