Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
11/07/2024, 15:50
Static task
static1
Behavioral task
behavioral1
Sample
39c5b0779be533f7fa08f6fb0d4f809a_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
39c5b0779be533f7fa08f6fb0d4f809a_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
39c5b0779be533f7fa08f6fb0d4f809a_JaffaCakes118.html
-
Size
19KB
-
MD5
39c5b0779be533f7fa08f6fb0d4f809a
-
SHA1
b9521f9bf7249b9fe032ef961ccce79a18a973a5
-
SHA256
871feb4aba2d71f68163fea1299e2a6cafed1c07b89862d93ca5eafc5884d729
-
SHA512
fd98c36bd38847b0ea287ad5e816783b5c3f6918333687e032ce67b67419c287d8eec1d2794e9c09bd760ff99d57e6b03311ff06db69018fc0cf4c23fc2efe7b
-
SSDEEP
384:iwlPItv4PB42xCPjJeKJzr52T9GYDkuTSXGNFecYUHsNMjXDoMcE6jNo6J:iwlPQgPWg3RuXGNF7VjTpcjjNo6J
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{50FC0621-3F9D-11EF-B74C-7EBFE1D0DDB4} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426874904" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000411b1f9e2e4b60d7d92f6efff1406537cc18b756d74bada9b510ffd6300847ef000000000e8000000002000020000000173b762da54e235320bc01e89cab2a05c0f650f978873073c091395ed7c38e0e90000000234d2427d039b762dce600ae1c593bef593fe686000e977ca52d784c67b61a77a7742a284e521468d452fa4eb40986f2d2378e7d665e37137621196b58148f79ca3611d51d8f25fece4ed378e25b23ae299fcad58286d569520ae0fb75cfb5dee0293dcebd9e422db99ad3d8a457e2eb54fcc653475dff4afa2b67c4c10f4d30a63a5802edd1c864400a8921f05f278a400000001c1bb4e968acf9769b425d77e99788e4a9404abb05050639679146d139c24386ce24a85ac0e14b2018aaeacddd798bde44a895029ccd1bbbecfe6ef800f582b3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10998625aad3da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000c535ba8b9a6e105be0a27d9da6a4695d1880523bbe9eb360b80ee6d5bb88ab07000000000e80000000020000200000002ec95734fff2bc9c32547cb8f5ed8d4837dbe8feab0092d34ec7b359d46ed81420000000e93a501e50cbd6b4d3575dd0a17964451529be583898abf9ca3c32dfde0f55e840000000642d61fdb3157c45c0ca67eb0861b207b1c47a6ab4dc1b26fba2d216f3cd3fe8755d3d9b6ff1c000a795879b9afeac9e47d17841a0eef4fe06691c560f98b4c2 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2524 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2524 iexplore.exe 2524 iexplore.exe 2144 IEXPLORE.EXE 2144 IEXPLORE.EXE 2144 IEXPLORE.EXE 2144 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2524 wrote to memory of 2144 2524 iexplore.exe 30 PID 2524 wrote to memory of 2144 2524 iexplore.exe 30 PID 2524 wrote to memory of 2144 2524 iexplore.exe 30 PID 2524 wrote to memory of 2144 2524 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\39c5b0779be533f7fa08f6fb0d4f809a_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2524 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2144
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50e82efb2f1349f06dcedaab6a1d13f44
SHA165481bd8e4b4f4789268c331e4232681361b35b6
SHA256d68c2d0a56d63c81cb7ab72890268a0dbe409aedd32baecfbed738ab3d555063
SHA51219acd0ebde302fa050c0d54c61a15e539f19754f13e874a858da2454da06e358d3236ff5edc8d0bd64557fd22292ab9fd64ddffe887fd7a5b91fa011c5314fdc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50d272cec21e1179cb6829a3f03315a6a
SHA1b0570f95a089f33b23a9c97de00e56757a367650
SHA256abcd36b42e5d0b8d65d778773a27406175062257898e3d9894b7032d54cd903e
SHA5123427e366ccb1eec50d59ce31e576657635a520593f723d79763ec0943486539332f0f756d9fb3bcabc6115fc58af6702f21c04dac4259eec3f5dcc2dc0cad541
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e0bba91e4005f047ae4f3e390c5274b7
SHA1e1eabef4c1fc63798168019773c58585cccc0358
SHA256f919479f0e939571b9b6540636fd7391c1e3f5e9090857db959c1089b1b710db
SHA512ad0b39805c1c56672ec339f34cd482c5cb944fd90d8a3c0c1847725402260ce1e7324f8a2ace6c4153485e98b73f0de2e315c2dcae7eada56f7bcb6705660b29
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eb6c88d4504ae01615e81f54a858387a
SHA1539e044d99edc4611e4491d1094c8c33b7500cda
SHA256da8de925b66eb251d3d1c9d904253180c5329205ed009391f9a5d5eb8107cd9b
SHA512ad5a471bd407ee2dca1e65b26ed5257dc6652676a50d2cd0e506db9e97dde469f2656daf84a3da84b4c5afab7598ddfbe8efeae900c98a577aa01a395b9b0a9a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51914c3b2c73557efabee16e256673019
SHA10bb8e21d393643e4272c23ae72f1927144a35497
SHA256c182d12f642851fd1c01f3043a5804faddd6865530b1bd98310e78f377fc3f09
SHA512587bf828b551542a59f6c3a2ae246ee7181a240c0786297ac23270bd6b2c2868c8b628f720b92459f6b85773a112d239d8a74b3804d6206f345998feab486807
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58f349bb1ea2648e247b3497fdcba948d
SHA1e34ef08a24c93f6d09486c6eec847d5e9e56bbb8
SHA2563aa0f65be279d75fd6032a73a19aca2b1ded7aba6f155c0c2aff18578ac16c57
SHA512a62ea3661e3b05310f6737bda6cd9fd35127ec1416efc22abdd60c3ca66b3b81967af420ad41f61fe5e983e4ac0508e91227c0f7dcddb820fcd3047f4131f150
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5479abd3cfa2c6eb58a5f7f6917717444
SHA149322c666c11b074aa28fbbc73599790c4be1eb8
SHA256b998dd6a28ffb19e3a2c6aa2128954cb18a1c38b7586fa0f35336f282c4e98dc
SHA51219f3466fbe31cd83f5537f4d5eb5ea72e238363094254350b6004a1f46b16efccb6b7c4131e3c02dd1088aa4dae5a9a0e85d33cfe088ba2ab74d3139077f759f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD589589016f65b6b632b7ead0d4b82f2df
SHA1858552aa21fa7f0bf8fb98bf7f0493a6b108ade8
SHA256c44816f71a5128051cd984111585ac6d2cc030ff34bfcbcb9d86771bdf36ac71
SHA5120e6dbdd89314310a034c3d252d3a6c93c41dc163f71f06872316edb54e4c7068018a931f3fabd4c53bb36ebebd102fff4ab147022110ad153c9d3a81ae86d525
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57aafad0dee0b154c6d9f8606f8de3f48
SHA1a3c41a9e1e441bddd22c20ebadd27c55bcd6c728
SHA2566f9a23df0e52e116cdf039d3034ae5af0e8d49e42b126f6168838cec08dec6d4
SHA512df5142eeaefbcae4c81a9535d805dd52b2514961b87658b5edcd95b7aee9123b46366041bbe63c5234ac53797e9042b6c7af5f2887a5a3f2f162bd3e365cca0d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD518daa5a17bcc7bfd8b899491f8f02503
SHA15a099e7c784a5e6c8be43548933bb95ee27a561c
SHA2563ac1447d8f725be01d9c34e6b611d24b80626b322c13859e8f4b96dfdd982d8f
SHA5125133dc89cda1801aa3bc0006239cd312b1091b9aa84ceb2f159b6d4672bfb32aaed88b30e02eda1a6ab7ffa6bafd108b87d9ac479854b76f5be319b82e9ad3f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5878b6cad9f6b89a95a0b4f3e347239c8
SHA1aa2539c88ce6dbc10c1425a5311290f49418b5bf
SHA2569a0f0f2a8ba937a24f44343e893ffe6020cf44ca520c3655bfbfc830a62a5aa1
SHA5129fde9bc21c56fb508b8c148c631570837c78b4f1469ddbeb0fd27e43794e02e88ffcdd2738c7f1bdc4f6b1af9ba5b924184818e8a137ed160e9ee38224f919b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD526f723fb47c44fd84d63ec7d2c291372
SHA19072e0fd7923f958cd055e6dfa91ab3247131c7e
SHA256c0ca658d0ab333e5c49d5bcd1ec7ba6a7f4dbcc864c83319be1cae7352940f7f
SHA5128cb37c8c387755eabec8fdea90113977f7cfa60c6d090a56ff1a76a333cfba824c029cf9f16383363fa3f26d1e8916706ab83692d668d290906b0d7a235f9379
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56de47e83c89fd1a683a6ca7641e52e02
SHA16e6285090daaccb0070ea75bb42fb56b6ade65a0
SHA25666cb35cf739199b44fdf48716d235c4d1ed89e85735040d73e1b5eddaefb1a17
SHA512a962059f06ec489d1ab26967bc25b03841410e164e5cf1d8e0228883bcdceae814e4228770a3610b1778c2a92c71a58eccc730f2948eb1df2992a88e795826a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cd1a8dd232094375c3031f45e7b4bd8d
SHA10f93b7c2f021144126122001f8d8aa34af0adae4
SHA25676f8d2da00f1927baefad4d5883598a3220fe82c563eb98b3236a25d76e649bc
SHA512c08f26b92345506af688a8b80e4801b2802c5c9707346003ca07b4ac007f146f9974630ac75c2a0c89439b79a9339ccdbaed0177b1893c9134e9ffe75cc72ea5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56878094911449fc9e42650a4931aa58a
SHA1c4da459968f6d60230356ec09419cfb783235590
SHA2560e4a625c0753a46357b186224556a5837f7c3539c14b8a1e8ae3e5eaad6ce925
SHA512d9b336809bb3e667daf9582e876d9c4a5cecfa247cc613fc84de03dec9935df7318cb528590b83dab59111f17a4aba80a41f6db1a313bac426600b19e856ce89
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ed1e938cb1a6a50f0097ba6253d62cb3
SHA18249bbf568446b9a67d72a6dad2f3ee3fce69fa9
SHA2568520ae2dc10e14af747c764e936bc142c7cf94d7d4acce38519242fae4905d4d
SHA5121b2dc4ba6be0dc764c0684f5973bb19fb492631e6b3d9c2106a159e629c633b2ecb50e252d4cf982fd0d23de1200ef3e3e67998118c4339737b4053fd5f377ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5176a6cfc97b7e36e84e54f646643722d
SHA1af8e88c1e52961fad4d86154736433fff23f3700
SHA256a159d13c2e17c4485b27455847f57bd6f6424f7c121f77f1944f1e9faaface6a
SHA512f66632e4e4ca8d92600b0d872b1e1d81c9bf4bb512271bb474cdcf7712c93cb77b4be13217996df93129b4831b776c4b3d90254255f6af1e9f65629a92a0df8a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55119d7cb908dc938d8de95fa288fae4b
SHA1094c8e743903458cf8db453eaaa7606421afe682
SHA256e9b7d72d1845eedd03e9f9c0f0d2ffe22e8ae0845da2801ebabb0cb1f9176685
SHA512ad1164a8dbd8e49d47d7035859bf394690ad986dd1a6cb31c417559ed980234231c08e1716539ceca96d225d9f8be115801bba5a0f1f5db8efb87b88ce34f793
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5629f663255ccd2c94427a0415f2e3111
SHA154ae57acb02f772f974107d0ec21acfca4df1abb
SHA256d474a1c73b5db1fa5c85c73ee5f99f728a1d1173015986ae06cb306a546a00c7
SHA51264c71c0ffd8e7243b02706fbacb1ce1ca074aa9385c240e0818b13d59a6468fe2cdaa9c795194dce28dd8d60c66816dc297d09c8a3cc8044963376e656f6526d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b