Analysis
-
max time kernel
121s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
27-06-2024 23:38
Static task
static1
Behavioral task
behavioral1
Sample
17f6d73cbd9c94c13a4a8f7a3b1e8074_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
17f6d73cbd9c94c13a4a8f7a3b1e8074_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
17f6d73cbd9c94c13a4a8f7a3b1e8074_JaffaCakes118.html
-
Size
35KB
-
MD5
17f6d73cbd9c94c13a4a8f7a3b1e8074
-
SHA1
afda1bc13d0b7862f7ef2624dba7f84b10a48d52
-
SHA256
34645d197784ab8d1ea03356d7a327c9c5397c57c094b09c142cd82e77c98768
-
SHA512
73446ef16d5d5134ac1053366069673c368cbde91bc2d8a495e210dfc218f4261179ba1a2e5349dd30e22afaf60e9b5fafed1026de3a0ae54f028622bd81dbc0
-
SSDEEP
768:rTNi1+DqwQhodECg71zvIqXjILyts6kTvDjtwcynCkeE9J3mmzyxaDVnR4AK:rA1xet
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb8100000000020000000000106600000001000020000000de9054d0445ff2c09e0043edd772913e2d126951e3acd848b6d6e766e0153605000000000e8000000002000020000000258ab354f72ef907101d0694689d15b0d88b0909fe9d5c42ffb8b07f875f1868900000005c8450b130e81a1c6af1a83425c11a1a84a80c977c1e5b8357ae178bc48b111fbb3f6c72d92caccf41e3d8d690abd9c630ca8823cf724b3c8e28eb09bc4d6eca6c4a7bd70e8d7b517099ecbdb4cd08f3798826d1a97b5cd124803243516b911c952fe29487cf4f01b7df65f3a3f3744e95f890e18334262c95636fb350ce9d2cf5bdfe1436a5476729b5864061c3fb5c40000000cf68903075343807b7c9253134dfab3387c57fa8acf11ab4c4e345466d355511e89283bfa1400976ceac529bec2b97a20a9b4faf6499a0ed466b98ccb12c200e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb8100000000020000000000106600000001000020000000bcbdaec6fca3de9ba7c68b1efded28ab27056ec446a2c8b3c9faffd6af6c71e5000000000e800000000200002000000071255a9fe46b1be79d596a84d1ceb2e641336100aadd7d53256071f5a20066f320000000c67efc281506bb2dfa26f8bd1fe4458379c040649eed8a2e55e3c3ff3489a79c40000000518e42e0bd4407254bdf0a63ac0f1cdbbc5a0dd588f62c9d3ed1ad12d940ac067d48fa37b62c74fa4f954114b65476ab8a46168551663ee412307d682584f812 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a06ea1e6ebc8da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425693683" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{11DA3071-34DF-11EF-9A0D-7EE57A38E3C7} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2180 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2180 iexplore.exe 2180 iexplore.exe 2628 IEXPLORE.EXE 2628 IEXPLORE.EXE 2628 IEXPLORE.EXE 2628 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2180 wrote to memory of 2628 2180 iexplore.exe 28 PID 2180 wrote to memory of 2628 2180 iexplore.exe 28 PID 2180 wrote to memory of 2628 2180 iexplore.exe 28 PID 2180 wrote to memory of 2628 2180 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\17f6d73cbd9c94c13a4a8f7a3b1e8074_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2180 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2628
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD591410b5f613c90e35703594c8a65ce9d
SHA1025125e19d1ab4fdafc412deec348220bfc37cab
SHA256c207c0f95f325dc3cbef25b113cdadfb92721b4560c2b08af71a00142050ee26
SHA512b9e3afeb592eab55f7696dd16ea1257ce21f8b8217d0224949405e2a39a8bbade57fa1e2da796444cab412f2b39459c316ac1e7e4f16f2cedc472e7e2d38ec9f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5473c24c28f47b259bb167816ebeeb034
SHA118ae0bc87938481fa795a918123bb19272b42ab8
SHA2561c89295db7953a64f6980690134a0834772fba0a700011e76e692e8d88a4ebf8
SHA51281f530f2b1816aac18d3f54c1a1bc2d4ef470f56491791f531a9c5bd413f717b3836d09d57eff30112e448e58301a8dc6812e23a114a8dd8d7bce9628e2cdcfa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5955dbbfff8acf7b270a25e70394c3bd2
SHA18f560ca05825657984952104cec12c20420a7884
SHA25676d1ec58409fec117d56fbfc46b9c40d05a25892640ef458769d3f762b3496d1
SHA5124d894855ecade709996d0f7f2e367d90f4da2a3c7067ea35c9c885b537511ee4ebce8d4881777fd89dd0768ccaf816f238e84f58993ace3da0d3b9028bd79abc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53225d148d148301fe45c9be5961b54c2
SHA1bf1dcbe09f0783227ee223e7aa5b3b2b3efd8d30
SHA256fbc001ad4c5a91c673551f52514821f9f083b0e92a1528d81bbdf09f1220872b
SHA51280e0f31d0ec6ba99fbcd096c9ae99af9885141a2921fd27d4caf0ee4a1b007e4e69ab8bee1d5adb83727eb42e3bd53e1dddbfe82f3fc506174fae5ba5cff0776
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b767a8ebab226e78a0572c82548c45f0
SHA11bae4cc48845337dcaf347e7ad49ce0e4c954b02
SHA2568b32098b07b0bf278e8510ba4090be53718c3fc392543e9b95ef018134ae33e7
SHA5122146b0b4447b856054946b947909d6a7736394b9c235c3099033e5c8eaac4359d6af4e1508a7abc40fbccbe4629790ab0500e56825fdfba0a0b721a45f3f6f7f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51019f16dd8f65d34c3278bb2d99aa03a
SHA180bf889cbf0e5a8d366c0c2130840ef76a9b413e
SHA256359ac067c03add07d0be99c82b05844a2a2ac39a43e69da6330932f466f1aad2
SHA5123395ad37430b2fdc2b66cee9adef819f196f3b72211ad62cbc5c39274fc16615e6d1208106f1bd82e1f0121010fd61a0f2f6a189eadc31bc85a80d1208a96c70
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD569e8bed67921340322f19db46788ca35
SHA1719af9721e04dd0a9735886b181731a939318bad
SHA256b8af925a0879ee07312a27a7d2f750d3360d865f99888024f4b0089dc09e871b
SHA5128dd3e3c47fcbb666b891958f4014ace1920f3ae54449ce89e30484ca5b11e1a0aa0edfdb2126a9d533ab4a59e1855888f99477b3f945a1f40dbe7acec178233b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b1ce196e7d35e3bb40e6a87183f9ca31
SHA1aed1582ba156bd454ff54f64fc96ba159705d9ed
SHA256128f91fca31835d2406e5f0dd750d45cedd829955d6076c5883af5d050305cdd
SHA5120595b23a4c4e1aaaec39b2b77f687e05ddf22748687fb8e1f9f7426359e23d6c05eea4a9677985affaa4e975e0566340c3c160cba1330a8d64be6176ffa4227f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f8317dcb5782c0bba284b077235ad1ca
SHA1fdc09f8b345e9080374711adb446fb72b49b4964
SHA2560f9ce1aba4c94e42dc962271d4fd0d01fb6d1b1f6bbfe238f73a22e051e82285
SHA512501f6986a8de88e83bd0d466e62a02b55aa2e07df6e3f0cb39e72ffa624687c50249eaedc51755e19dcbab5a4f3c5a7dfc3ff47572e8323625e7433bfe778b40
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52e273d240a8f67571e5aebccdf99f30a
SHA1f9a0cf24f21572c63b89bdd43819353970ca9844
SHA2563a282a308b737b376244f3ec8b25d7a38652304607f85c4dbff1ba1e27141b2e
SHA512da8dbd0a94dded39617f5de348aa9b2b148401bfce2093d177fca09c5744be5d37b85bbaf0500981e99e626f2e8f61f691068fce05cfbc4661bce197eaa8684e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57dcb4e457262d7e5318af762ad2c47a9
SHA1eae1faad53cb6d05725fb37f5f05d1703acc24a3
SHA256f04f86c9a5fb10fb728782ea8e5f011076248e846494087e08fad84fb4f4b40b
SHA512952e56b63694aafe9b8dce4b51f642c5295ccceddf9dc08ef43e29b72314176a9de2dbe6787094e50104edd823103e30c28df0851a75957cf9b6cfb772e3dfc4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57319576ab4fed3e3bc60557b409371c8
SHA17f22e3321333dac9561ba3b190be435ee17e2f2d
SHA256f2d3f0a904ba88b449be1d82921377d1642a4c3343b55a159d1b8ab662e9a932
SHA512a2e53032ec35a53da4041aa46e14f896831e76c1e6b37460230326efcd1d4d9206b9f2545b632a92409535e6d56a6240344651ff323a66ddc825a80a7716bb8e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ba3b3f7c2d9f2fdce8ef9bc9d48dbfc9
SHA1c54dffede0cea9beac85eb50fd3e9fb145e7d8a7
SHA256a4758c9ecce1547a5cb3f4286dda992937ab8af62c31de46a999e9ee96bc10db
SHA51265246e3100c0f7c70908999cab67deed77fd8cd657985e3cc940cfa2679c66ca46cd342861ff8a50fd0e13a6f947ca841cf1d980411c33bd434b1293062e236d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ef1fbb639a5a679c793fffef650cada5
SHA113f2ef74a03bd53eb461704e11c822994306b238
SHA256551cbf321b42fea5b9f634c0175d0747ce9a08c19135b0c91130338ebef7914d
SHA5123170a9e132691a03ea8cfe6293dfdb40f70acd90e1a8fe023af22256807e9fddeb136f00054979c508265ff413d8dbcaa766995ad4c93673941a1fc257c49d22
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f1fdeee6d199a41898debd48d939a2ad
SHA1567f0634b8da9924e356e66b640cffd14c255b39
SHA256cbd16eb36997bb74b0769e2a15e96cdade1402adfe5d1efa5724494915fe911d
SHA5124bc486b9cadac4679f4efa74d7db0000c0b5943b7f9a6103904cc4c7957e0395c5c39d121157d0a8e71ec53e3636aa7f688c62f7d86ca2dcc994b88b04ffe585
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5759ab003b2d5bb3b39db0df70f01ba6a
SHA182ec47a94688da55564d4792bb38956875d33b5b
SHA25679458266f3c32674ade6a445177c2dd0400cb4149251c210a35e77d7527e894c
SHA51249b6c7e0c84a9fcfc755676a0ead0f279958ff8a9fb7eb12d06e608e9f591115f6894a10b10bf163dc020545ba8a02f83be938e66b9f7f9a7ab20e15dad34079
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5374c111308785847f174f75e657e6921
SHA1f37c3e06ca98da7ed82a06711cd3aead92773321
SHA2562bddc7fdc35a63787f6cc18fed8e6a91b4d1fcf82b33fbbd921710169e7f58a7
SHA51281488ecc85ce94dcfd688eedccccec2e6e70cb99e596a234daf569293215d533de5a70185ddc990a7986ea6f72626743b6cac6a7f54a2f6ddefd0b5450b5350c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b9acb32a93d378094a1fd8baf45b6b98
SHA1a32c2aa9578dc8d97a538848751de896d3970dc8
SHA2560bb2c74f819e5726278c2253fa7efb600990f77214d85c5d19412fa2bad6f991
SHA51265fa465ed0eefaad34a89d9ffddc96296d22d612fc12846de5be4dbc8480f2592d6b10b36852e496ccab3e33f790422d182ef9d66a5bd23c999290579c1a4496
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD589e902809d7c6ed895a4ccea8202681d
SHA1919cd812030f82039e4fb303303cd820dd161d43
SHA256e061f36c78c521a15e3b43942787b15f3349fa185cd6af87eccc8bd585a18004
SHA51244e203ab3712e6a0814340efef6e5b8f4f674435cf4b2e2b4ab2a6a9dd7184a8682484b636b47b3ca9cf7429071dfa192ea60a1ad775e4a7e2f9c94b60d431e3
-
Filesize
67KB
MD52d3dcf90f6c99f47e7593ea250c9e749
SHA151be82be4a272669983313565b4940d4b1385237
SHA2568714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4
SHA5129c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5
-
Filesize
160KB
MD57186ad693b8ad9444401bd9bcd2217c2
SHA15c28ca10a650f6026b0df4737078fa4197f3bac1
SHA2569a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed
SHA512135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b