Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
24/06/2024, 08:33
Static task
static1
Behavioral task
behavioral1
Sample
0778e96edf1e4d8c91744df5be8585f4_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
0778e96edf1e4d8c91744df5be8585f4_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
0778e96edf1e4d8c91744df5be8585f4_JaffaCakes118.html
-
Size
8KB
-
MD5
0778e96edf1e4d8c91744df5be8585f4
-
SHA1
fadd3f596a98d40b3b34caa854c513d0cf2e4524
-
SHA256
167b0f52338bddf6ba4991c749bf563f5d44a71c6d222a5bbdc00f6f02e876a1
-
SHA512
1eaeff2153beb2cf98112dd40753ae691e13be48f3d70040c4bc3e4ecb62cd0b0f67cf966c2f3d3a4f620b34b7da31f05074636b3dc9c05989022815fb321ca5
-
SSDEEP
192:haOSPrmR81dThJKUgW7bjtJR7ewidZ7gAXDT251MM:oOcE81dT6ULgdZeMM
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a03905000000000200000000001066000000010000200000008eae54aa90d63a22c664f5c42d31f56c5197e88ddf441d23043f98946e7c465e000000000e800000000200002000000033103c723ab5137461ce4fd0b2ded4b46fb3e1160b9444520c0e94786137fd47900000007ffc93e373af69a240a17f972906114b215bd48394faff7761d7cd014eb32e02c7adc14bf4635601c4770437a1296ea47738fc7e0ad0a7577faebdf863528513198c8622ad96a43aa253286177b2a3817ba6b74a60473aa539932f712435f31a15ff13b02c5114917fb08d4ea1bf172cd2c2cded032a76bb8529402275d7353f461242020e100eedcccf1698914ab50140000000eee2c55dbb3070f91384547962cd40e3a8b2b6746e373da719806aea4e0cfb497d5627a17c83a67cdbb294a21ef003e707251f7c53dea14a29e13afe01089efb iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20c47a2411c6da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{61277301-3204-11EF-9028-46C1B5BE3FA8} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425379854" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a039050000000002000000000010660000000100002000000088480e87942d398425a64a55d5b851cc683081711658f31dcf94b8b420da61ba000000000e800000000200002000000091e5b81dca0c6ffa708698f652c5b7ef9a5166fae683326b15f9fa61be89d55f2000000011f8cca216bea845ef5cf4f6e752761aae85e6e46090bacdd715ff312194e036400000000cdc782cd4c5190a64fd05a2549b3de634875dca22255fa301c60713174f7df460333306a4365937ffde8cb943ed286be01836719aef69dc0a2f5936de0b6df1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1936 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1936 iexplore.exe 1936 iexplore.exe 2092 IEXPLORE.EXE 2092 IEXPLORE.EXE 2092 IEXPLORE.EXE 2092 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1936 wrote to memory of 2092 1936 iexplore.exe 28 PID 1936 wrote to memory of 2092 1936 iexplore.exe 28 PID 1936 wrote to memory of 2092 1936 iexplore.exe 28 PID 1936 wrote to memory of 2092 1936 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0778e96edf1e4d8c91744df5be8585f4_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1936 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2092
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD574cc8254a3e221d29750dc0e301a630b
SHA118b66fcbac41eb0511ba960f1f231c30bad2e7a7
SHA256fcae154bd8a5b0f9f7bb7e25f25f4b6a95476967ee24ae82e262167ebcd5a6ec
SHA512dbf1488c7b79d72ce5897643aafd9613e39dd21be54a091975fc8ee8732af27490d71a9cff607abe26e4081f4cc6433d4f36ec160cb762486e99bc5260a5aa14
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57eaa373e98f1c3fceaf1daf009633e75
SHA11e26cad7fb616a3d171bf1cf0e6be3b7ec9eb996
SHA256f7da6207d8ab8bff456bea1847db0ffc054b82ed16b045d0f9d07e2630f99cbf
SHA512e998fe98c40a88c8019597d2f0b4a22c612b0e245012ab9159a3e1c0500a31d8e263910dfde98b687a10f5d77bf279c7b3664542fc2dd9cc1f86a093d5e8109f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ade2ae755cfa341beb51272b6a1169e6
SHA10c7c3ba4ab6961eba3763244de2c969f14ad2b3f
SHA25608a78b7efb76c524beca9e350fbba142e3e6ac50ce1b482dc9037e51094dbd51
SHA5122fc2d4438926b6b63815c8edc839cd51b94413d9729b92e0ca6ec45b78409f96e7e4cad349cdd2a2ee615f5c162135415c407076a7589a4bec1a68b1198b5356
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b9c9fde00b6ac3be04540184532c7364
SHA17127d14b5bcc94c4648709c33e6e7271f1c6d9aa
SHA256d918434e4cfe4d66f1d6719d0d37a2a149132b7f67ed73ffad0f31917e599a54
SHA512663c987301df7c4b3bc13a6d3b8e9e365c195062ea5c363400d243a705ec53d38dd5f336770542e11d77277a3d43920a30d5b0c99a85b5416e362bb8577ee009
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5937370b34213a0f55d947272e3496205
SHA13b242ddef82726d93c6383e0636ea05ad56824ca
SHA2562971b2110e76473c82b0b562d486fb9931db38bb96459f82ff23acdee1cada29
SHA512a66e7df189e4c5631b3f758041716a097fbc163c7251a677d70906345b2a78563904a9137f58d891ea9c97df44b45835609e320210c5522934a4d89fba2bc802
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b949bb3c7ce0a1f966008a49cbae3dcd
SHA1580f92dd50db08724c1c317fbeb92df75c61e34a
SHA256761bb5c512bff9db2f4de6af8698fc092b058ca6fd40cbf90186c7b9944ea134
SHA512303c1c54faf9a759d2ccdb9368a4a49648161781b459e0912b5de373d1b2bbaef908b33623c63706ef6f7058b0cbef260350ba39edee791b20de7696bc1c7355
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53f9f5a7901fc60f07cce1b73322695b2
SHA1efb466c36140bb4b6f87a081e067d0cdbfbf2169
SHA25669b647d8c060bf44881780d89726645d529bbf2d2857221680d9c7d3ea5971be
SHA512efd46b86b4c854708c6e4b3d2d9794e4ebe09af329a7cae427418e994462ab598e1f0d3c365afacabb37a06659862b4b99a5251bedec4932feaf430cd27b4bc6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53907d6bc3f362de3a8c21b9774954e32
SHA12a0a69bf5fa08ac1b1e31560978baf5a2c6770d3
SHA2563cc924ae45722a9c3b91be99fe38211cee5ac6a885e11b49402ecad4e65006d6
SHA5126bf683c8e6974f43e96254a32875bbe9349c856bc0a6b7aa9342bafb58f05bed95abcf3868ab14dbbc22ec9bb46ec09ed2085e58c680083aa31c69d65b9c7234
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD529b8cbb36cb60cc0cf9dd4d1938c059e
SHA1d0bb7410aa35343ccd4ac21a203874249c80a335
SHA256d29ead0971c44950c3a450a4c89b83ce18918b721fa9a1ed3ec0d6918de00f1f
SHA51267665a31c69dd4f19215cd72cebb858f2c09c6c2a69d5d859fade5ad0711b1e0fd900b193a118da5db594aea2949238b706a69f92f95b4f0b42a9f9f9183769e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f26022c307b4676ba4624cbba124e94d
SHA10bc97096b58f9508e6cb92121b740235f0afe577
SHA25698e246852861496035a0fcb8ec6bcd6d907f133a64c2f6ec617c4278719ca9a4
SHA51279e4f25e2fd1b56a1133a3e08dddcda86530885bc03b3c086e67a87fef045b32eb0da096ac5300b67110bc3639307cf95ce769a11bb5c0f7fef77cf90af2f32f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bfdbc1e977ec456ab6b517a923516f14
SHA112aebf7533112cacb2d0b894aacc223c46335c7a
SHA256b92c8494d4638b279c0fe8837a6c266feb6b9ab8a0cfbbf5d28fa8ccecde1060
SHA512f203fc63a0d6eaa037e82d8b79cb48369f8e8b5c449a2ff125987e51eae8098a4247294886dc85ff163f9d2efe1c32ce762f2a8d01781f25c192435cd7e26af7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53357bd3db41a47fea59302f61c324c20
SHA134ec87ade49e6e57c2f3357de864c755760df0a4
SHA256f27f75b9deaf9e9df3c9a0548030a4e96872c187039e1a8e257ff2419ea956f4
SHA512077f83788065b49ffac8ec114b0a795b43575029e19f6b7e109b09e8d3f4b38b4e9cf361f59fc9b9683a89f62ccfa28fd1935f88a00bef18f7b31319f55a9f6a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53aabdd049ba1df602792fe5168f33ea7
SHA15159effed0a8d4df2f64f0fe3031b19cf6530c7e
SHA25688dc020c4c41df6178e7a1c3f768e0c034e917a913933d768d71b07bab16a556
SHA512f02d09b837f088a3a87eaa70791f91f142cc7d94e0fa5f9990125f837ee3bedb72d5b737ee53e9fed2dfbe90fadbde60698e433fab9bb77c78ad505a191134ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD571135bb66198e39e1e6aa25f51eba2c9
SHA116329daac6e33e4768b1cbffa945b7740df2c57b
SHA25622023c8250e24c6bf4cc177e6b266f3f1fec8d76d3f7ce0a671fad24173a8ca4
SHA512015d331c94424e9d8c48f20ba5eff83e4a229b475f466a1d266a1be719e7620b5fb72270b837c99de9653cbc441017d8ba45aeee2a5683914f8e86b50ab5e025
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a6cb35cc55d5421f2bbdaa7d842e6a01
SHA1f0a985451dda3a1b8bc9942313f1a3785a9a0501
SHA2562b9b4d6123f10bde4d2cbf2925ffce7dd5f89882b38f1fd1d693d7ab62e8e284
SHA512df447ef8be5386612b294cb283b48bda6546e03bbdd313ab99a14c3d6f2f955c1d7c556ce543259d56b8f1c8bc6ddb02544dc980c69d78636041a178400723b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD596161c2f773530c92e12f661e0f65ab2
SHA169c887cc87dc3e39980882e5c7e50ea0dbd73eae
SHA256bbe3c9a500c017ac1dc82cca4e65e5963ca7fa357cabc40339ffdcd92044e637
SHA512f3895c733a314d0831c00e5186a46061dee17ba8c36ac35281c0650130620afe184a11a78350f22381ef09d101e90f0dae118276cd0e3789dc5de95f481d292e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5170fcd9a2d95103bd0b72c2d91d00583
SHA11fdd0687d882544772268008869a24b4b0549716
SHA256e129dc2bc622f0c3bebb6cbb215687eefeadb27a51e11132d85854b0a712d3da
SHA512493bc1c6690180230ee7ef7952ed1b861b078575c342448e5425437e4fe00c56cdc0005f590814764a58f4e3d857c717ea1199c6f7102bc5d39bafc1290d3f8e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD566c66d2abd3fbb022aa85314813eea4a
SHA140c15c9f3109cecc3e8f902c058dd2c2cf7bb8cb
SHA2560a4007359fb02d331d3258e337f32fb32db3442e0c9e8412dd649a3d65b2788b
SHA512655089206167246eaacbe726efebae660b87e1476a1717add348f81fee95c6027854fdbe24373669196da0a04b310bdbf02cc54d4d66ebe38556973abd4fc7ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e82255df115c335ab035f9c051db0579
SHA13efdc1297c862bb2f42d5574ce12491951148054
SHA25654cc1ff3cfa891415862d42939857675f138ee8d33531ec2ed7f68b8b70b5c77
SHA512f4ddf2d30df03a3ea7f0f84c65105d0f9a1a535b6a8d0b138f423b76a517454b84939d93ee62e9ea81d9f865ec31b1ae7ba4724e4feaa6c5ed0827afba6685d2
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b