Analysis
-
max time kernel
117s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
11/07/2024, 05:52
Static task
static1
Behavioral task
behavioral1
Sample
37f133f563097205405b5715b9f7781f_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
37f133f563097205405b5715b9f7781f_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
37f133f563097205405b5715b9f7781f_JaffaCakes118.html
-
Size
6KB
-
MD5
37f133f563097205405b5715b9f7781f
-
SHA1
b7385ecdf29ea1c6cd1dc2f789a735b764b3567d
-
SHA256
469fd7d0edf73f47b7ca1462711f093f7de0ccc723bcb6c2d0456c892d284850
-
SHA512
99428578a7ddd654497f64d51b3c116d4ff39295f3457062e6623e5377a6c644b92cb4d819fce3e750ce60cfacb86b053edb4809868397c1cfae451f1cfe1164
-
SSDEEP
96:uzVs+ux7FrLLY1k9o84d12ef7CSTU7JgwjNTVcEZ7ru7f:csz7FrAYS/pcb76f
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000b534006f24d720ba7d0f0ca83d2b12cf7433cdaae6a21eb61d7a4a856be3221b000000000e80000000020000200000000cf3bbb8371a71abfefbd416e02a5da1d1a1e2aa553d46b6323d29f347eb2b0720000000508a55b2bb799e6e8c9763caf95b2e0c59a6ef10f00bb412759c8c6b61af442f40000000a3f711e69e395f93a721e3ebe29d7c05148977cb6e603be22291fbc9ea36655e37685eb5be45933fbff461304263bba3456f6682b6961c84b640503015818ac0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 300c7f8e56d3da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B7F30BC1-3F49-11EF-AD83-5E6560CBCC6E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f000000000200000000001066000000010000200000004430c942a1ba49f6be6402900c4ec3540789ff2e079c13ef47841c945e817953000000000e8000000002000020000000226d351f794d6b1310840348b18851267fe8ef407530bf1bc66745c3a84bf22790000000a8e93a0b4660db77642497d9570da957c7bd8f5b788668f746093b9fb7973694ceda203fbc011b1fa2cb33c5bfe8b6e72875e2192f3cecb2cdcba9f0a94be55bb23d6826f60af69c98552a12bb8467d62643e3197ce9c6db5fb4c069007964f2f0c7f92ea784b9564b266b3823379f6e0fc56e33477ae01176cd1e73f5ff839b484119c92421f106b9ed6eb11386a06d400000007bd3274b41387e6ec3a323821651b46593bcdfa0d1abec7b96171f1a5724929f356c93cd2640b37be4799bbfbe75b9eb22aa8b6f0b6c964795010d15406d131e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426839010" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1688 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1688 iexplore.exe 1688 iexplore.exe 1696 IEXPLORE.EXE 1696 IEXPLORE.EXE 1696 IEXPLORE.EXE 1696 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1688 wrote to memory of 1696 1688 iexplore.exe 30 PID 1688 wrote to memory of 1696 1688 iexplore.exe 30 PID 1688 wrote to memory of 1696 1688 iexplore.exe 30 PID 1688 wrote to memory of 1696 1688 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\37f133f563097205405b5715b9f7781f_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1688 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1696
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f3acb0b8572890ffc9df52cd0cae551e
SHA12616f8c5159836d445a0eb3701d01b8fdf9ac87d
SHA256b44e3483faeee0c0fa4ac57de398b024e42b1886ad81730b029a3a0fff14258a
SHA51201c5d981774c69b84e7589ebf6766dbeb5f9bb2d089967bb062aa17fa8a7ef23b67a3b9b80de6762ffd030a240d98fd80d83b38463f0f579a8da305607fe55d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD551228d8d182e97fc8f6ad041707425d5
SHA12d2becb46f4ed2458dd48dec6558aa902e321a24
SHA256055361a923010e2c0cfdcb533211011cced1daf4d6ffa6a3207fd1b4dca8c38f
SHA5125c15b6fb4df0e2a4c53a57f713b4e0a736707d656e4da5337c40dd481328f6ecc71091164b450704264864dd60c397a2b08a87260b8ab913d8b5522f54118ce0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5845e6d4286794ebe80334b80bba42a63
SHA1815fb147d3d70f6970cc5904a7eca782bfe828d3
SHA2565f8a5fc265f7996766d6c2e4708aa0052e81bd4b9af702cef14894b3b3849f88
SHA5129d244ffb802c236d20673e0e8ef7f30bc44deee9c2137bac9caaba2cab4c262e94189d50ce50b2e8fc065abef3b080252388300c89d59e3178134fd3db24c9ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50c469b104816aea0707e9cb86fa3a6ca
SHA1087ae9e3fcbcc04024fa9d628171766efa64efa6
SHA256c45d554396f580eace872c7ec5a87f07ca1acb1e963aae2e7fdd6b63efe61373
SHA512d894e451e098dca51a61aa57ec4d3aed4b05cdaf9adff5d6a195463398fec8d6febcdf302c1e5560333fc4ba9f723ccf9693ae925eda21a3f526506a76a1518a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD545df819fba95ddd8115bf674fb9984fc
SHA1bacaac64fe25cacd3c5a37de8f9e9107fb3c240f
SHA256bab0cf0d2f41d26c316eeec237df650880d15b0dbaee160199301439b98a3481
SHA5122518e12860a1dba242c56fa62406ab65dad6991220c9d16f77e87223c5f2642f6f85ede975de09912a4ab92d638e0c127267f94c93f53320b92ffd9114c2de51
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57dde4501f53643bbe14dc3cc1399eb01
SHA1a416647e608c6e098f9d880c88920dec71bb0f9e
SHA2565b8a00a8de73705811d777361d6a11f6d170ebb3533be48335906ae1ebf2462d
SHA512f3846b452577933b80bdd0b4f2cdd4905862411c4fbab63ed43003960ec7154d63c34a2285e962587ee8a2e7599af4301d9ac707d658a7421b0e9ab42707d92c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD578121c6c2907f29b959c96971b9f61d0
SHA1affed62a351b32c53a00a04f0ff6012a8d630e70
SHA256f6ece04768206a9c29f5598d10a5d069d498824f87e7ea9ef4dd3a11cf5b96bb
SHA51210cde8dd05e379032538f21886b30514aa5ff9e0d653fb2d682623ff0b474b967b15e46539f92c26fc7316e74de437755a7bf6510b487d4b81cb0d6612e9c5b7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD508d7ef3e493387d46381bee37120b8ae
SHA135a1b033db09f58ae0dcd449578c26c2fe606d75
SHA256d8a2ebabe3027b582fdaee126f0f36bddfebe0ea56f9f7b5ff59c3c5251f1130
SHA512e336dd1ee6113b8c7ed6e8fc57bf06d49fb34eb5053beacca6e2854e4ee020a7c0222b0bb77c34b980370250f497f7c072b52f2c601c7ae4f0675cf129ad82cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57d347fe5b039689481fbd7be17a8b2a8
SHA1fa73a70e77871d7a06b94cc19f42d7e91bc63aaa
SHA2560a25ad6890a3f3f2cf86b25a7d0455b9ac1c547e824f4efed43039ccd0ec3a8f
SHA512b1b7c41cd6180455309eb58138277af78c6f25015fd34ee387fa48c6d6816ac70c620f67af95b158aa60d561323dc75f441c3f7766015d1b60d86d24529c0193
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ea173db626b0db4fcb8924848d7808e5
SHA1095c4aef2e0a080333d504b451f083093e443497
SHA256292f7bf93d5171e0aeb544fdc6e9f9cafa48b1376d0aed9fae3e97b47af73913
SHA51284b7948f7c774b277683db1db3cf1842ddc29990b56d4001e4f844d601a599fbaf79712e76d5df7eb83bc04dafdf938b72e70bedb882f99d4b2658ddc553b0b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e1aca5108ba9b33fd053b1a623cb4eb7
SHA1ff9d217d548d7a3afd7dd36a2cdcab44a13ae32c
SHA256cfab7c2b46edb3cbbee7aca7b63862602ec257a3f39d5819392d6855068d4e5e
SHA51275fa6aadbab0e80fc3d732da54ac26eb5cdda3f5de53ae5239cb24ca1e155bd22ebb947f80bd6d2bd00377fda0446bab9bdffd7d3a2a1a3b82cd4408fdbff611
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5263dfafbea72ac03f538746278c4b1d1
SHA12393f40caafe99ba068d0443c59129ac6ac45b48
SHA2567f729b9b1bdd4701231d2b5b95a273fe8d215adc645daf2e20dbf7312312de9f
SHA5124df0e8c3718a0ff7164cc4409c7138a7e0938c3aaa93e7dd1825b749a34a50cd8ce2ef24df99f834f5a92026c4e07c957800d774926d530a713ff1a4a585ab02
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51aea80cb95071c555788bb6e27ed6186
SHA181427c162978bff1f063fdd1c9bcb57b302aa17b
SHA25657347179de7fd2da1ddcf5acd50d5fca5cc90d0cb12c05f0eca4588b3974e006
SHA512804ba90f39e8e1a7be1a4b8ebabd07b2a3442a61a01b92d95168023c06fc59be3444a31df9b48e88cb362e1d1046f77debd73b7398788470d9413a704dc53c76
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a2112c3205a5bd48e5bf26f4f3d3dd83
SHA160d409d93297caef8beaf2cad218edb49a793089
SHA256b4773df7daf6483eb35c19a84792ef54f196e5c0fe81ed66b99c7907ad2ce928
SHA5124aeb0aea4ecac1312cc2741111a9f2b624ecb728b2f015a8ff3235878620e997eb56bd1b08b044201fb3f4b1e44f1c4eef56b7396a26b1704c5b0e1dfc4a5527
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c672d98ee6fa58749bb14fe16bfec927
SHA1acd1e5587cdfe2133446ff7c49ed4c1982974039
SHA2566503dc9cf8819532de075fbdcf6d349416a25a58013ca16194c0a0f1534659fd
SHA512e57200cce86db45a2ce72a13c829ec2d2a15785bb226822c85dd3c9fbc153c203ca1b80fa1ae7d5113828476468003e59da0e4fdfe1e6feb171da8fa03bc8683
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59ae30e9db07ab178ac50d49cf6e4d729
SHA123679c9283e76299ba8a68015f2422b00ed97a3d
SHA256301943697a9963c2c309401d35d7bc5a6af7eb46bfcb703ad3a721e9a9c1db73
SHA51256e080f05a5b9e9020db8ef3930588f4af19180691af2443cb5f74e13e4d46e1d2bd5f5395e77e863370a85cd5e957b29022ef49e213162d60b87935c7477560
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bd7a979736f2d427218990bf5576eae7
SHA1bc9bf2879f7c23856e42451b87437b9b9ef0e014
SHA25652e38394ca1b3a52483a2278bff5fb5f42b2ada77374b9b03b91afe9e86b859c
SHA512a033a16f843a7a0adb589ff5e511f97d949c825de06b93a4349064be88495d28ac4a10316116c781280584dd273cc22c9c3183d6445741bf479f946b8b41ee9e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5646496d3153f143dfbf298ea775eff73
SHA19977c2bb20477afa8fdf7138d50fe0d0746d50fc
SHA25610098f4c6766786a813407a5fbc243b5a4f8eecab9b97c6f7c8731acd91cad9b
SHA51283b656f8bb0d26501bf0eed95c8403e1613bf3ccc0134732e41995706414bf5ea828e6fa270c534676f07a4c3da35817dbd6e329823eaa96a3901e82582a72bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5738270a47a127dba83f4d5831f006189
SHA1e549cacf0eecc4111309831d3afa372daa45686c
SHA2563fc054c9246439838980867d698c4e25041aae97d1f3640ebeeb1d5f3c6ac482
SHA5123fc9a3da3c5b7f9d9d660776fb607ed82e68c0dfb7c5400327022f6fba940c72e06c25981655089e844ba19d0c5c2b02dc8c6a27f2bfa1833ff83f2c62e6be39
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b