Analysis
-
max time kernel
85s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
13/07/2024, 06:40
Static task
static1
Behavioral task
behavioral1
Sample
409720220a313e4f402fe30b09d7b197_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
409720220a313e4f402fe30b09d7b197_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
409720220a313e4f402fe30b09d7b197_JaffaCakes118.html
-
Size
11KB
-
MD5
409720220a313e4f402fe30b09d7b197
-
SHA1
6aff7b89b36c50a95518b3980506883ea9a0a70f
-
SHA256
2f7772383dc804407b08791c7c17084791338040f4b312b119a10faaa10833f4
-
SHA512
5f2011c1494d8d753dd344edaffbfe22c1dfc1ffec7ca52378a61a45062ac7d950a33791b55edc88b5d93dddca2f571125e13a72cbfe5f4ed46d79ba8cc887bb
-
SSDEEP
192:2ValIsr0r57MHxET8h/w1wvqa1BLOXuBuLbdU8d:salIcIQHxP/ggBLOXguLZ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427014709" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb00000000000200000000001066000000010000200000002c795651f3ebbd378654ad09d8042a828fc1de1a0c15faf1d4d50257657cd19d000000000e80000000020000200000000e362f6715b18e8960cbdcecc8c05867840213601785b3483f57b85ccba3297520000000f1deb9a8d96f39b6fcecdae628f12af598698fd43b36c04d859f4de6a827f1d940000000b204fb1ab5eb95e3df0fece2bb11c7da94e72a7645313b58bbdad6097cc3b32c1b6e76fcb47b33cee5bc22814ea2b251198f6c6ba2fe2abeacaa416354dc5316 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb00000000000200000000001066000000010000200000006e4b096fee476f748e360cfd6b71a0bca86954267f2186cb0664daaed385155e000000000e80000000020000200000009d4a1d2e015fe8232c1d7e76c774a2aafbcd76deb0bbbaf7583f6c8b8bf5bca390000000ab0733733052dfa2ee01b20129f033267d19cc88bbde3329f75e4cf3614e941b472af23ba2f677305c54a27baf8d1b91284c727ad4d09f6ecd02fa2a31cc941b48d42480ba33bc5ffa28268b85a74cfb92c94b817ab9b3b5365b526ad30aa7c5e030b52b83f7deb7f721ea87f4e29000357366a3b45be9bfbd15d4c704f2e581148959992f9c88060464da646673574040000000329d907caffe531c1e8b9eda69528659f884dc1d4d2a0b3f4be59abe1e1d0c93551211da2e55ff5af96931a3c9c4b2b99b822ca2225314cc4470d94cbac038c8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30c181c8efd4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D33DFBC1-40E2-11EF-A2BE-5E235017FF15} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2220 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2220 iexplore.exe 2220 iexplore.exe 2592 IEXPLORE.EXE 2592 IEXPLORE.EXE 2592 IEXPLORE.EXE 2592 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2220 wrote to memory of 2592 2220 iexplore.exe 30 PID 2220 wrote to memory of 2592 2220 iexplore.exe 30 PID 2220 wrote to memory of 2592 2220 iexplore.exe 30 PID 2220 wrote to memory of 2592 2220 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\409720220a313e4f402fe30b09d7b197_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2220 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2592
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dbadef062176b99e6d47c2a922086d9b
SHA1e81b361638629710668ee42e699678e4ecbd033d
SHA256944ff2c7ae880a47453f71362e05b08ed59665906326cb5704282c797ced321a
SHA512c3d61b03767720a5338c6857e31010531b47349a2a834d6e9326bc1c5b33e8e35187f21760d02d297c42829e29fa35b092afaede69cc7471d6d814ca52aa8b29
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD565bd55d7c5e53f4e7276133c4cb4957c
SHA1cc804543bcce6c52d3a1f088e9d0dbb2e716553d
SHA25640e6332c60561308066f224a6d74e9c531b63b94fabeafe18532eb757caa1757
SHA512ebbcb3febb7f8ad24a3fd1b219c82b585481079b4dbfb47fcdd21a7170c7f7782a8db7348510e1afe450af79ddc09b8aa57c902946b08b4325cce89b53e8da49
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51a7c9cc5a513a9c124c927cd8e759c8e
SHA1377bda987fd61fb6b43e56c41db373a72147737f
SHA25614c2e4af7862db7af6205741510b3da54e107749f9c081c71271e9b758090a15
SHA512695eec842624ba4292db16485613dc6da4bcfe9c1addb371f9694f1184424e00be989864db2660220aeaf745381d8fdeda9aec0e2d08fd35a8d62cccc780fb5a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5af860354125ea3238277c0cd386e14f0
SHA1a5a9389cbdf67cc45e339ba426de54f982cfa823
SHA256615286e12c7a49635680ea6f6bf90dad434e98a0c3a4dde9d990d50cfaecd2bb
SHA51240b2131543e6d1aa79c3c289f7a5a0720213beead5db5393d59191b098ab5d4b8ea6f9631cdaa55946a19118fc1c338d6bcec972b04feb5733bb10ea2e5edabd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ef478c8f654c83e5bfbbe6544fbb04b9
SHA1040071a3015eb12afad41fa858da4e0cba3fa6fb
SHA2567c347ebd89f7053afd5c4a7035266ac0ed17a281749ac0a5c79cf9128b7ab6ab
SHA5121743fe566526c159e218709164100959ec841f3578514871a8211051d0ea8b23a53ec919fe5f1cf434473e237f997c76b8d77e788226981e5c41a5f5edbdfc2e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b9d0f9a86c0ff0f00864fb8c30d4c09f
SHA1c21154383d240a6e2fac09b3d6de34808c3e78f5
SHA25642b767ea582ba90683b7c56c2bfbec1df671d2f09189aaca8892ebd17bb41399
SHA512d5de5fe2a4df4b64045c42f8cf170f54f33ed734e83821a7983f2a33f085cb53b4f62279fdfc0046f463b3b84fdd940d62374bb1ce9314f393ef789c44241d46
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD580097b5a372bdf382b42908cd62215a9
SHA17a4065993962c821b4514153a072742b0c11428c
SHA256dbee83af06cedfe148e1f6ef1b9a34c7d226aecc788aac0273070023ba20cca1
SHA5120d22f0d6e12153f32d05f916d45a95a6abc41b6e0847d125b80d1e34a66f639c9ca2b486fc7865f4382b88db562ce3f2a928464d067e4388b52e5a91d070153f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57db62f722323a1adbf4f73c1a7d1ec23
SHA12437c76fd4c4e5598b04108c852e5a8cccc08c35
SHA25622f2ee9481097d3334ee15c21f9adb257adeaf6b04f3487750e05b06eedcb022
SHA512fb036ca71ed78f21d0c5ca6202aefc1c35047c58df8a622f6cf813d5db59b86481fce2b3fb4cfe37baf5791d2408d911a547797765077ed849b6718da6431673
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD589b27c85eef99effb6822c4b2c137d1e
SHA17464fa9255d6d34a5ab9cc5706a5979e2ec8de5b
SHA256fd1e50016922d8c31c708f317ad19a7f9fdd918e4ace9bbad00c6b9971306faf
SHA51282259be20bea2c369193310706e12138ecedd8a019227fde82b9d476ad411116d07ef83017b4d3ae20f696a1e722f9b68cb5af98f54e4b0cac0ff5573fd3ae01
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ca02d884ba34379d36d6bf42a439e95a
SHA10c1d03cd63ea5f24e3d75be9739e903b74409347
SHA25635746032604aa46fcbc8716d92d7842b978a1eb90faecce14e081e3166664254
SHA51204bae03d92f50a7b0f0d7a4270000d19dc05117b6884bd27072ed096e86d44dc9ed35a34cab2cd5a4940065ff15ab2bf01138ab70b7ea78b023b927d4c108942
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fb0d48f3c33da28054a068e1960a494f
SHA1ebb99ae94b6cb2911ae0b1e526a05a6bc0c7f436
SHA256aef7c95d6cdb3c4d1efe7ba5d10a59efe4e4d37c33470ad675b6306e300e5622
SHA51203121b931eb33069ef2aa42755fc09c9fbd29cde105c43b98fade501f36522bb2eb9eefa180e86e000ecec4a02a419ce12f983588cab7ce4b96da02296d4c814
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c43b511dd4672f4d50907c65c69ea1a9
SHA19eaf31d334296fd877459359f44eef60bedb8f06
SHA256889ccba298355865ba61cc1adfffbd2c0dba54ba9371ca3b6fd8314b6563d8f4
SHA51205f2ddd4ed14374ea970e4281cf25d31883eb44ee428974ed892420c35b8734fb536b740f190b38a4b2c507147ff9b2315d4921e6f15c825d3b8ac40ad4c8beb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD571222702575b74cc55480bd3a4fb3b7d
SHA1b9f7ae23dbb73ab7991e3f284485c52f843cc6ba
SHA2565b3e99e4a8b2f3f0657c9782ade56450c74a983cd5eded940c48a03816d9583c
SHA512c63ba328742e89eef00da46cd6f3c2c3aa1ed46965f40afd704b12b48375de4e6e30069a5e2db9cee7e706696684bafbdae84cd136f58a85ab253c8eabc09a41
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51e41c782285e5a09d201fb705e56b06a
SHA11fc337103df7be7fe26d39f0070239140a343759
SHA25694485115a29c6ea6e71761dba0ed35778439a08d543c786706a62a322c76be81
SHA51212ae502cfdf82c97130cca3c8ee6844b353a8db1de9e95bd1dfb4ce1372b2a5f743a9cc4a97a10f8c188014813f9c8e3c2815d72f0547e8ffb8dd2674195478b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aeacc1e2492221998cd3949352118312
SHA1c6cc71fefbb990141197ff2aee7c954458e3f717
SHA25687de9278b27495abf2b6d54de181c08732383830bb74657df41c7dd98c192c4a
SHA5121f2eb9bdcace84942d2d8f73939c06ec8f043e425e4fdd096a567138b231e5ce787b414e58f86c50d28a8bc6ed074586fe4f52b230dd6837966d15a66ed6f6d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53a1625404b1d3088f9e448bd7693f799
SHA1a2b0e3dfc7b1c1e37bebb02f46d9faa5be6a6b19
SHA2564cbeab24226a3018ff5e5098e3e3b8f0a8598b335ef1d7322a0fa8df55be84f6
SHA5121aa1a1b23a6fb8bc8b4434bc342e9210d1c9a10be72486a03567486829924f26f02007dfd3fec99fb8efeefd90ce4f773a203cc1ad2eed339d467b9ce2bc306b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51ccb090de5bce9f6d2dac923ce4bd3bf
SHA1ee9ee2b9e7a7b7dc014551aa5ebb420b70318042
SHA256cfae1f8866c5b84017d0cbf321ec446108b2e785863ab82611e716de8868fc0b
SHA51292ce117ab129a7685abd347b8076728aac8eb93ff5b4a48107a6350515fe47c1eb74bbfdca0510e25d6fda591bc48a1a2a3bf94a87a2f3ea1b8999e69a264455
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bb857c6174662f497751dfeea282fa3a
SHA17d9366915d4ae388689a05648c94658bdbb8399a
SHA2564561006731af01b906ecfa2595f452a35afa034a932d065194bc9472e556b2d1
SHA5122138b1789e0bf367a7d3349bee388c0cd4361e8784a98d2ffceca2b6ab435bfabb2867e6cc43a1713d9b59932dde34e61da63f866285214ab52f4a78a607f835
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53a15dee942ee6d616d51e4b4313b1f1f
SHA1c111982f0c7e74394aba6197c31fa21f630aa2ab
SHA25602b5cd209b77f306fdc23bb0b9c1a1514c002c7020a132051c2569bdd0d7a4f1
SHA512a06d95b81b7c259d6b60b03137409795095cf9868fcaebc53aa7b8c3cd50db4410b45ecc189aa3c5865128489dda3009255db5bf436f196d7230d320f746df7d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b