Analysis
-
max time kernel
118s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
11-07-2024 12:10
Static task
static1
Behavioral task
behavioral1
Sample
390f04db534e18a647d0eebcf8760b71_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
390f04db534e18a647d0eebcf8760b71_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
390f04db534e18a647d0eebcf8760b71_JaffaCakes118.html
-
Size
53KB
-
MD5
390f04db534e18a647d0eebcf8760b71
-
SHA1
0f67ae28c8778eb71d2ff6b8d188961e877514b6
-
SHA256
963fcba0d5b53bc7b5405ca457a02a0ae367a5256ec22842fa777a3d7ddf0bc8
-
SHA512
92c16079278fb84d974ac2b10cfc45adcd799fe6e1eae26342b8f84745b24b600d779cb955f7268638f5cb2d42fb59fae48beea77fd32fd74eb58679f1e50553
-
SSDEEP
1536:CkgUiIakTqGivi+PyU5runlYU63Nj+q5VyvR0w2AzTICbb6ol/t9M/dNwIUTDmDI:CkgUiIakTqGivi+PyU5runlYU63Nj+qC
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9B2AD741-3F7E-11EF-914F-526E148F5AD5} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426861714" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000f630b09d1060c1327e4a8d64622629a2dfa4ac07a12689607027d81c876d5260000000000e800000000200002000000059747307e82f5845a53bd43e4576f5d44d6f15fe01bdedaa16482f0cd894f5be900000004df2c392fc5bd415b7ef2d3451ee4f7de0bbecf1207ecbc67a5c4638a15926d6140a41903e554c3f631772e82f667f5f8c06681774d90a07d28ba9d49f3cfe15b24d9a34ff0e9cfdbaf45c842f7709819e146877d2f989b7f51b1548b78dcf1b12bc08acda9ddb9631f4fc8bd2626993be64f0a00f66549ad2ce9d92ad10f6ebbdc7d89d8bdaa80f70707d926367d62240000000ba73b072406091afd757a4f27bbe43fbd66910ee82f7b209e656d41fc32f351200189ecda3c26bb028c6c32f59e6275f35a80b9789c158f3aa38bce309b7c08c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000f0ae4413c6019e69073dbd38a54dbc973944df339d414ed49131190b06cb289a000000000e8000000002000020000000ebd3facb6e9aabc1a0cfceadfa26a7f0742a6bf370a522b9926b5bbddd674a492000000073cd850171b5aa45bc83062b4de5fc9d84b8bf08950446768087188e304494f240000000b4f80fa56039afaaff4fd18f109972e0f46f0fb4776e642d0df9b09f21bb13d99c6d57e82adb0025d192141a5f12b966e9d21698e42cd5d0b4baf0ec714f9e2c iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0b989708bd3da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2692 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2692 iexplore.exe 2692 iexplore.exe 2696 IEXPLORE.EXE 2696 IEXPLORE.EXE 2696 IEXPLORE.EXE 2696 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2692 wrote to memory of 2696 2692 iexplore.exe 30 PID 2692 wrote to memory of 2696 2692 iexplore.exe 30 PID 2692 wrote to memory of 2696 2692 iexplore.exe 30 PID 2692 wrote to memory of 2696 2692 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\390f04db534e18a647d0eebcf8760b71_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2692 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2696
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fbf374acfcb9c4e6b5ba43bfe074c0ba
SHA12353c6f0bf1cbee73c34069272dc9f4f187a9160
SHA256345c51ed7e3b5c1b5c4f0b75c74217d429d84a93794bcb20fda497dd7a182524
SHA5127e116ae119ab0b96d63badf5d863db29679580fa47dc2515285178ea3d6e303968ba1e925b31de5aa86b8aec72aeb8fc5cc3ccf66ef5544741ba2442bfffba20
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c84f374502dcfbe134ff37e74371a3ba
SHA1cdae44438f2f029f641dd2ab5afc69b776c84d3e
SHA256664c529ee38f31e946e763619352ca343ce4b791e47eb5f2748e7261170997ab
SHA51204af6544a42b88282d51bf06326005f8db3d371d5476c559df01e694621f27f48aa12bd922d92048ba72f3fe0b0bb01df50782d2906589582fa2da07a201e4c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a3adb13d86bdbd590fb5d61e3032c523
SHA126f2ad7e5ba56e3dcc478927f1b1080e9e65d378
SHA2562bda25c287469ffad05921175c08387fcd51c60d5014660ea788724ddb752582
SHA512476f910ebadf18ab9351f48afe8d2e34dd06d8e3ded874ffe09121e5e2d32de3da0ac6e82904d0818e0588541fdb1dcfb8d7d2b3e6ab1e05d21b6d78c88a6f58
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d2fae4302036bd30d7215d1ddd172ebc
SHA1b485b424d448308c37424c93ca197cd0045b99e7
SHA2568f9ef8e75ebd12d2667308196e09e0415269f8c63980fb542cafd452d4ac387e
SHA5125a5eafef753371d78401941132a8ffb14d1ce2b9af4847bad5888bc14aa1c2e4a8aee850205439065d5ed30c843bed0e70d4f79164406999c192f9a716d16a18
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5826c958e1c23646931b2d2ab93678d2e
SHA1d2f75b2ac8658db1b397c4a1e40c903378f64030
SHA256ae68e13d91a4774ba8dc91472d138c5f00d074bf7605a6270f8558ada642809c
SHA512a2e71f2ffab5485d7bd0372d267e314be93062f99e20f15bca1c061faf527ad309873d2c5f289de3562ef96358ae1d24fcc612db5697b7d2fa63c30bd8ab9e51
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54e51afceb5833af7d70260d8793d229f
SHA1d497bef05850b35617ef8c1e80d53946db9def35
SHA256140523ae3b6af5c793215ebad77647f4f9e0a08b337f1820f4b0ba73bd5318e7
SHA5120dad1e2cb34927b0329110d0cd2c26e68639e48ec2f325f5dc7a492262654283abd044bcb3a827ef093659d6d019e997ebe98c87106930232da70d2b65f829d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fa075a191901295f13a1364a87a25a6a
SHA12ab5e73865b243907f74e2a83c3af13816941137
SHA2565f1b3acf38699f9bf974a5b72eb21ee3364450ca9a1effad546356773132f881
SHA512553f29ee543371a143cbbee9534dad7c5fa8213fd0ae5f55fe73fd3125d27ac5a6df502ac8ae3a96be82196ddbd2dbd9a64c167cc745f5eae7500bad3404efcf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b9872dfb2c1a86a3e1799b2c4628a86c
SHA16aa750bfcff6684231f03f80f330e00d263a3a71
SHA256dadf4ee9e0aed9a5957866f0a70163d87cde54eac25fc92624f1ac8ce75b38c0
SHA512d52b65d67cd3b0f0c7c2f455e38f474ed020ff1d9e44e2b592ee95628dd56b41bb26d800eee304b4a04d7238aa42df66d217f0b6b77353f60c4d450570f8e191
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fa8dee06eb1d73640a7413051c52e65e
SHA116d7a2c1cbfebb58e8433bfd07c69dac75f49598
SHA2560f72d88e1308e84c28f8b9fff735aba4b318515e63fdca86bba2b04b2092c62c
SHA512b2a0e140b02dfc81438c50e2171e488c1c0886973920f87e578770005afc3404b75d97b915f38efcf0e3cc7724b2e78590c4809610c1a75b01f8efb5f973b600
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55a555b084d33cbf0e0fdf43a9ad32a22
SHA1f4e58bb28e9358820067eead956521f62ba6f59e
SHA256a56fd21c2e5213fe70237846caf7e8cc6f05ba2cf05b21ce4a284e76ee0a6b3d
SHA5121d63ac491b15b3788ae419f927826b8254ccfb3ec95168cafc69596b404c2955ba5d30e713f8d729f068e05ff36cbcd700332e0de4fc5f19774234c3e8588bae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cae2ff7e8b4fd0a042efe7e83d63ee68
SHA178c70386a5f40ae013ca4e8a18979d10e1ac8868
SHA256f4d9ca602178c903521cd2de1d591ce22297eec1b34c01e132d3000a627a27a3
SHA512cd566e66cd7ec901f11503c0015084fdbf70cbb646700e3b16f162f0bda3b495ed0895e36588cce02611eb695e6b045b590a35e82b91432b95c3f006b704052c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56d1667420b9dcea4d3b537498081c450
SHA123294aeac9279357cd3bfc91e4921cbacb2827b1
SHA25671735a994d40d1575588f5d4967c2e67730b6d3e9fdddb0f50d6db51ab984909
SHA51269dcee830329df7e23b375ba75221e82c4ef4babc4b38a9c604098b79f96988f2a524f5770f8861d516e603e3229831607f3a6751cbabcf872fa7683d3503d18
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53300e72533eb5d9c64afbba4633aaf38
SHA18c5cb0792ed60737bca726557cf072312fcb4fc1
SHA256848eb4bbf31fd1dc056202b1260859fa6ae7ba32e2f8f45b55f069e0fad54eee
SHA512b205dee38cb2e356bea74da3039802f72baeda5cf6ad4ef2bf810ea964c8e93c939abf31de66c58ef0045c7d870863cd3002066cc5cb04cf38b5c2f97fb07c87
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b8bf2f3f817278b35879479a3ad0bf0e
SHA167ed299a2ad065f8362325de38df57e5393989ce
SHA256fd957a465b03c3a16c609e17aedaeb4cf178052ea66d67e085afd37fc9c82c53
SHA51224aaf1f3c6da56de5c1a6b88b0c95e3640b1f000ea2a7d3ac59ad2c6e63f87beb0721fd8ead237ecbf9fa50a5b53f78f7fb27b2360f07594dd85112a47b7d22f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57a2115aaaba0913e847e9d9716ed4b4a
SHA191e835df21ed4094e8766913989154d32d5c9944
SHA256e3f65453ef736453636826ec367cb1b9b635bc900e356236773b90b9e1a10477
SHA5129e710026a6f4e9d46a559a63cdc25f5c8b15d8891e1f1adc5827b5f47bf20f2a2b8d4960295153d2374f246273627e880c00614791496b631bff179167d2b8be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57a58b2689a26ddcd51c6a411bfffbc6a
SHA1a7ac9f34417fe9dfa9b13602f3ee5e1bff7ae065
SHA256fe9050c71f9e43f4e5a838e100488d2019bd228fe4571e58d54ac4288e6133f5
SHA512243b7f1b6cea54963105a293e4c51a1513a886277e6d8b91bfc90f0757ff4b484d94c7f2c3006140db1c2b9acdfd1d7c86069c2ebcefd801bd2193c590de7937
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b5052d165c1b7805445ec43497f018d7
SHA14facf1ca15dfe8080f47eab60978b2ae396c6330
SHA25606689c46af6c2eb0bc680a1c00d3134711feb563cf889f21695487c1ed38eb5f
SHA512abd0c4783f45dcb88269427b8da4293c97d754f477391c37b481fee58c6691ebee3231ce2f043ca753680b3aa210800758651faf356b1f9bfbfd41fc4d8fbde4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD512c6925e2e748923ef9b38c498fd1811
SHA1aa293466473292533cd5f03799d6bad6ab710ad2
SHA2565278006d98b77ce87dd147308997c53aaa1589c569541c1ff41e4ce04e3f4c86
SHA51266b868ab3b4078808747404d56f861879f3c6ed2b2a20a10a178a511415122bdeb1885a1cb7a2f492616978de4f53f609cc2640569e06c1a5656fdeddd2aef4d
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Z2D3H3V6\print[1].htm
Filesize706B
MD567f3a5933c17b3ab044826d3927d0ba9
SHA15957076d09bacaa6db8ddc832b4fd87ed8f05f8a
SHA25697e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64
SHA51203ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b