Analysis
-
max time kernel
119s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
01/07/2024, 20:10
Static task
static1
Behavioral task
behavioral1
Sample
1c5759a75f9c8cc38e23ec4f62d11d78_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
1c5759a75f9c8cc38e23ec4f62d11d78_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
1c5759a75f9c8cc38e23ec4f62d11d78_JaffaCakes118.html
-
Size
6KB
-
MD5
1c5759a75f9c8cc38e23ec4f62d11d78
-
SHA1
2a527744d300424dff3f586b319240bda00bb0bf
-
SHA256
13ea9dd617ce386b8267f9f1451dfb419306dce3c1ac56a667cb88fd6202640f
-
SHA512
d5dd1b0a381cc3e1ac2d7c7a18cd3891baf4e54a2a925d55931c294373161e9ec33446226ed1f3ae2140a1a41b50c80879949c9544c837623f309351364d8252
-
SSDEEP
96:uzVs+ux76MLLY1k9o84d12ef7CSTUiIcEZ7ru7f:csz76MAYS/gb76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a0390500000000020000000000106600000001000020000000343ec8244fdd53fb865e37ebfc19b78d8c2d54318552931fceaaf220fb0132e1000000000e8000000002000020000000163d3fbe4cb4378dd7294b5a688313db85902dd44d9d36bfb2e7948f6931a1fa200000000cfb0b360ce1f5e5f5e7f5e8f52fdd7a64b53b08bfe1b06edf52e297a82bb37c40000000b5e057e2553aaeedf89a76c3282d3507f7eba646e224b226308e5e4a49e00b4aaeb5117f0a7012b901b83d1048ae7a3aa3d7c238f13025ce5de44cf568475529 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a039050000000002000000000010660000000100002000000022c108de408d72f9fd78d6a3aa785a32a8804a653a531916d1fbfd26655bbd5c000000000e800000000200002000000068038e9f7f78149ba7a1774bc105bcee8e58b2962be40a30b45c52bd8f91e0529000000005acf79b264dd10246dbff38611eda7e12a50cf460d47ecacd7d9c16fe558b454ad6d93bb028118df2529f13bf0563818aff4ec580b23850b9b7093988406b4218390ff16573d13a0aaa15e2153495a15272d10823d0c8358ec23e7d7068b150db28a617a08ae229b245ce731e085e544ae9ac64aed826888f1174baf0b16846b8b75d174138dc429c7427d4c3596bc1400000006da45f6a3372a84616d65cf8f3b9c0ab8993b6472b4a1f043a18191763aabb01dca7b0c659f64f8b62f6c700e0fc532b4f17ff4cff082f2906897198e6f2761d iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{49ECF8B1-37E8-11EF-B267-DE271FC37611} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0d0ef1ef5cbda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426027496" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2160 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2160 iexplore.exe 2160 iexplore.exe 2164 IEXPLORE.EXE 2164 IEXPLORE.EXE 2164 IEXPLORE.EXE 2164 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2160 wrote to memory of 2164 2160 iexplore.exe 28 PID 2160 wrote to memory of 2164 2160 iexplore.exe 28 PID 2160 wrote to memory of 2164 2160 iexplore.exe 28 PID 2160 wrote to memory of 2164 2160 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1c5759a75f9c8cc38e23ec4f62d11d78_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2160 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2164
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cd0e2108c54df0c9092904bd89d0c796
SHA10c27506131993e4d7c369fb7e7932ffc45bbe27e
SHA25605b3ff6586995544f56c761d597f1b41d75a72f86349a52c82191a5058bd9c9a
SHA512fd6f8f3f8d5b61f6efaf3602e1880b3a1ad512f2b86c76bb2a954a32d853efd426f8746795c5396f7891c87b512272181558e4bad899fef3fac6b13202b6e103
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5199f02ce2d600799581a2ca3796e795a
SHA15e0c0960ca786e63923b9b4dc82aa500817e7af8
SHA25602f893d70d8a3ce316d01499122e38cce360a4951c8253e8c3cc41aeb118872b
SHA512bcc5d768a7c91f114c7f2c243cdc8696029a9c2ec1585119d9d4f8e62c5f4f911f1c20e8476a5b32c5433b0c83c35335bc7621563952ef1054214aad6feab23e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD500013efd700c44fe7a5de6b87b576841
SHA148c9c7b080467140e0b39fd29b455433f3b2df7f
SHA2568404d7406a43bb493898b88350fa80f6acca7d74503cdd109ded3e27fe52aa6f
SHA51252e8abe8882a5bb274d46e8da068b890b7034a1ab54ba94e1488f3eaf58e2fb8a60e87be4c61bab7f2cc45ef0c081584c33c54587dfd48e44f1906a87606565b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f10e8a8f2cceab68d7b5100abd0a8660
SHA176dc5dc9135579a4b54cfb06bbc5bfc508f0bbe9
SHA2565951e330ca88beb85576df4f90a9f06b13cb499788f43b81d79066bf1c1ab421
SHA512fd3abd90eeb8a2587b1561b520bec476bea250ada54c302eb742ae60babf3f2925870edb1daf651183ba3d8e10ba4b83e861cff046c8d9c1505cd06dfec512d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a69a8870a6d7c9651a5e6f7b87674e88
SHA1ebb21b0c80339edb2d01b482cb178da1c8fd6e5e
SHA25608824aaead29d9982150995f1d6cb706ecc9cc6ebd394c117301baef3f8b4173
SHA51219434f32d1e1139370ca1628e619072bfbeef9aa374e8900365ef4dd247200599c8937843d252b805b04cc4b05fc245f0201cbdc2cd4a77c0a049d9eef4b2b6e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b62d3a0e0612d2251dee6300f461e9ce
SHA17a579c555ffa61f754a335623ffec9072fc0bce7
SHA25666771d41cf129b56883daf1727cc452147d839d691407da9d36f52997f9e751d
SHA512a09ce5410e16905d306466cf784d85ea8f285e70759289c74b6e77cdeff7569e9ba612937986ade216c3b5476636aafe59e70160bec097ad990444600212f90f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5796e0f0e5768c427dee3ede3b4221795
SHA152e691c3864eb4695004383aafc3eb2478d474c9
SHA25624a3b01f90f937a80af9c2bfdff5128d0fa7cc51fc42e600778455406528f4f6
SHA51246ebe05950663eb5981cd26adaa4575c59908beccbfef3b68ae933242e57d3d7c716876095b4b2adb6657365ecba2ca2cfdf902206b8c7ef92aa582b6f08b52b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5742b07b103432eb3241e404e59b967f3
SHA133c5e68139408a5bc7551bc1df58b8127b578816
SHA2568cbff404d14aedaa9acc626b138b1347597664359e78772240fdc1de011dc893
SHA512c3c2428fdfe6c15dfd52fe0ae87cd25cd220625518c6d9a93bd7595e523aa0d923ae1f606085b2d67bdf6b7b1c015afa15005101ca034b312d4d4e5c43b96f27
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e4ac8730345234152ca95226c5d9c8af
SHA1824498b645a33e693672fa8aa78d17642abfec11
SHA256a60d1fbfc6b9c22aa386e7f44cca2b1aa6607cf1360716279a235bbeb0887a6b
SHA5121c1a432bb6f65016a5322865866ef24bfb53701c27775fd2371cbe4219beadac8caed6cae74c76596d9aab520d1242eb48111bde92a0a3d349f5c85c6ac09354
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5964df7fee1b20515eec8f8af81a6a7c4
SHA187ad4046b76a3cf7ef0583bc86a753e0e11744cb
SHA256d35da4e93f6cf9e85a7a381644d4939bf0094ffc98ed3a9b1a8703682660cf74
SHA5123713382ddf7103a733e8a33fb7a20eabcebb70de171d394b1258a1c29d1ef3ffea84f4fb78a9ef5c776effe22a60a83afee6314368e65a1fdc541c275926e01f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f1c390c9a38b9256e90706861c9f1480
SHA107388fadc400836278a6532f51e788779c646d30
SHA256b10383ad5739503fcfffd2c0ea27cd3282d8615c74e9c4d3766af4c701cb7a49
SHA512cece3f65b0a90184912617ca36bc800f25121de59a590108e0f6efb9b9a73d72a5785cce22689f5e8000ab856b419ed76552bf4dce6abb644998365e59930bc5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51de27e5590d14b4824901c601fa69e51
SHA1001aa8dd31d5c1334139f6e699eaccdc37963dfc
SHA256a0ab9d207610e403a950cb5bef4d2569c98163e73e74d872e688f1c68b849c37
SHA512b760c4a88d8e6b0a6eb35c0068b3c067cab234895c2c84ab08f3025b2c7942aeb08723a192064c4b829e4e99b395a6ab90d4992085e00c55a43e64c6841eb015
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD595ab3980225fe7cc817d0312f1cbc8bb
SHA1dec67a2b6aabde5a8c02643202f43edeb7f63804
SHA256c2b35c92a45d79490f0bbdb19d795aa5986e2595eaaf1444729dc4501132c176
SHA512fc60d51b34138a38cb4644ef0ad8aa0f35f72f2ef87e3390e33ddea2f56102b55247b609dcb2ebaa5b6416268c0fc54106f2be2730cea276ddf63f1e4ab9ee31
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f168db80191137e6e3d46b37f5626161
SHA1dd4e0ad3f7592859dfe354aaa7bc8500249c9321
SHA2561353bb733ee8c3f17661240da4e5233234cd12b0186ab5e85010a9e1fce53039
SHA512f549c69c61096ed5a0ea69dab3fd4b80a312a1806562488bfe64b0595a1985f12320f275a3c1cf79e4dd656abe9ea566cdf3593e92fdd661dd268c613a114374
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f477cd286b822526371bcdfe36d116c3
SHA1e4a0fbe6b4f557269101b510f9b649f76bf97a85
SHA2563c06cf167503e1448e51b0cee7c57ac77e7c598731a0466af818437ef4ac826c
SHA5127630b1e3bf1e5b673b482c75f8934d6c88c9ca68621fdc4c09f4e5178cc1b987debd6735415baaad06205f5e46e88a7db425bc470bdc8acf39ac6d3951858241
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53247d4f5813193d9ec249497fd8ae15e
SHA1463d027159c97c9b95963fe6aa985950d3c9588a
SHA2564fc2bddd178a31a5d7c88f01d7256183dd2a2b5f7139971a803bdb3ed0acf50e
SHA51284969a3f9d8d060fbcc1685bfb0d12ccb8926dfe552c266e7b9cf96058cea706c5b22061d6fed08eeec132ccd56933b7a4a001ad115b40cc10b7e705f2f13167
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD549fa586dee8e10529faac531c2fd1309
SHA1545ca66bb01b3e29ae022013e606ab03229c0c37
SHA256c8b8368f572e8e2041640d5a9c2433205d2e7510d7bfa1d5f0c583ec8514a09e
SHA51201b271bf54830698196f15866ccc1c09861d2aee071672a2f92a8253ed2368844ad88c71cfcb85f0c6c830a60da671d3596bd3450fc1e670fe79951399783dad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eaf98ab6b6d3256a6365a255952e1852
SHA13f36379729d5090981cff55d62be015873749da2
SHA256450a5eeefc8c9f889aeae9cb084622115d2ab6c0cb7941ed2dd131dd96396cf4
SHA512c5952e6d9fd0d34e6dd9e360995476b8348e7eea693ec3441253d8110cd1509e69278f2ff58a318e18de50cf8e1764653d116252d9478b39a69dfb57b24ef0a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59c11fedf536ddcbf3c29f1b111e8e5d7
SHA1b99b0ad3508a25423e816a38fab6690e88d6e210
SHA256d498d1312f8c43656921ce44ee5fa5343c7679abd3ac2ed88c0ba3099725fdab
SHA5121727886df3f44066824b4deaada45891d5313109c2a04d846f58c46ca4efc89908fa83120ac5f2b339a1b8bdb73a4276e682d8cf08b0ef30c746fb05406dc366
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b