Analysis
-
max time kernel
117s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
13/07/2024, 10:05
Static task
static1
Behavioral task
behavioral1
Sample
4139f6736db0d637bc18e4082f47dfcd_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
4139f6736db0d637bc18e4082f47dfcd_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
4139f6736db0d637bc18e4082f47dfcd_JaffaCakes118.html
-
Size
2KB
-
MD5
4139f6736db0d637bc18e4082f47dfcd
-
SHA1
8bcd9c7a22f3d36b9a0c7a61f253d6f3dd8366c0
-
SHA256
c3d05af5969cf32428e08d0be6d4d6392ba158e00c3ca3fcd21985a9d004efd7
-
SHA512
af36edd08c8883ded1be51250e93f6d52277c956d6d4cfc6916d258a15983796b4ddbb0d225fa663aad773fcb4a34c25c1440a617fc3566f1e192d894b1701f0
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427027005" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{73A97411-40FF-11EF-AAD0-E29800E22076} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000fc286c8434cf7ad617ea5b35f71698b23b5e792455a8665a185723ca78731b5e000000000e80000000020000200000001949d92ce2f484441bfc94a41e99a2aa5dccdb89cc24d62a0d8cc73b9448cead200000003fefe65e575aa134303bf2ecf7ca783b37ca047db35456ced10c7d5582f0719c4000000023b782d7c0ec2d5e1a3f5acb782df80b3da4fe7d7f12c2d1d63f24e8be460a088fe5529b6524156530e85563b2e8989363148925117d8c79fbe6236bb7c841e5 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 708162480cd5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb000000000002000000000010660000000100002000000013b9a23e9eb396e975a9c0d3fc54d83bccfffd81581cbc97a0cd81633608cecd000000000e8000000002000020000000e79248ea6e705183e4228a827609422aafe283a3a939f2ee8fac533462125e6390000000a8c9780e7142f44156622e49314eb2575c3beb7f77d38bcdabb7ecb506a9c39e6e72532a9e05d8a906cb3374add18f953afeed7d4767624d28b8be27c6bbbfdd030cdec5659569425395c8e44b2a089a61a1276a90d6df5d81024d664b9967b96e2b7a3a3fac63275349de7caadb8bd0dc6fe3245dd4a9368392c8f9b59ea320ffe3c78a96cf1e6d58cb66152634cdd940000000f66cd1714b50d6c446791e6daa2b8f6f65b244e101c4a703701120321e95035f7d94cd50e7dafc31d73aaf5e10143193d517887fb4281823fbfc001c71b1ac1a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2688 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2688 iexplore.exe 2688 iexplore.exe 2672 IEXPLORE.EXE 2672 IEXPLORE.EXE 2672 IEXPLORE.EXE 2672 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2688 wrote to memory of 2672 2688 iexplore.exe 30 PID 2688 wrote to memory of 2672 2688 iexplore.exe 30 PID 2688 wrote to memory of 2672 2688 iexplore.exe 30 PID 2688 wrote to memory of 2672 2688 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4139f6736db0d637bc18e4082f47dfcd_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2688 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2672
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54de4444a4840f785d089bb6b63344c2f
SHA18bbcc1a1730469e1225a6dada100474835a5c193
SHA256ffa8d88c635ad5b789cdfc1a34f7a52ca67be395154187d053aed0d230f250b8
SHA5122413a9356f51ef1f00cc44c96c9ca0696e22c58a16402339369bfaf400b1631a01bb7dd397db874d46c395745ba0d76765ab77e4c2c2df4799ce3d5d52e7ec6e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a20a878767a14b8bd7b4e3a49c70a9bc
SHA147cbe31e2d8ff1d4de4514690ac09a438c0f0cac
SHA256496fee73e3426eb1729c97e9276bbb9debb75c1c07735f21017b3a538d88b6b4
SHA5128db8ff91db34b390e5f8445f8a89104058ac5eadcbabad666848909b2b31f392bb99cc20252e556e4f71ce02f17d25fa6b2ea3e2e12cd8eeec38ec28942fced3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52c684a79f687195d0e1f60081b156ad4
SHA127d86f1e66b29573a47d631f6396a97d94fa15a7
SHA25673f492dc286fb65863eb3a411a7fd4dc98e8af1cf4740027514fcf4817951b99
SHA512ebd200c62738d0d0231d799ca72be26955df1b4b13ea4c2e1a55394cefb6eefd2707f3ca51ef87a900f144d1264a2cd3e6e7bb68373a332e4970c27efdae9086
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a681db09463b92cb35ea59bb1aa76c74
SHA1d27eaa0dcf08529c2f19157661caf12409529675
SHA256a503ecd2ad06f5491c4b28714175ecd06eb6f01e10b1215b376286e56f7f24f5
SHA5127f2ac82914b19fba05c7df8cb6a60841dcbb1cdd09330bbd555fbb078a7a2457385f48800236d85d25d101b7d4bd53fdb378a250d0fbf54609c45a078df60546
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52072444ece8a678c9aa06407ce5fd466
SHA162fea0de7c71948bcc8fbdd5197fe58be840ada7
SHA256cd5ed4c4c249984fc060c51d8b51e355c2ca05236353aa7ed7a941f721ad2cf9
SHA512aa748d10bc4eb0245131a08932523fb38cbaeb1b734ab3d07140b172f73fbbea72a6fbab6cd822fbd9f7dbbb6e8dc1a7e449333d511a4a5866ee997404c155cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD589a7898533695ede96eea9432d396047
SHA12c0aeec2f68e2fbf9f93eb2dc6c87abf27e7bbcc
SHA256b190ed2cb962d196ff6033cc10b0e84835ff4baf5b96507d8d4f4f3049ad2401
SHA5121602c2f4821965e2bd868795919c3c12d9f97f555162ff227cfbeb6ffbfddde0ff3ea0c86dc0c20a760016b1e1b4402018f7885dc66f845f0867a0b5b60c3644
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57a7d625f9fd5027ec9bb5bbd38c93466
SHA19691a29fcedc9b13be7ef9fe074b08e2ebd3bfa5
SHA256c2c0f59d75e84ff2254c34e33ae90a1825f72a7f70ea17065a2156b240694091
SHA5122a402b0fdad3b126fd33d04d9916ae79505e7bef9a3386a8618dd8fbea9158b1e88b1fcf83a1dcc413b65392677ecdf135b63bd9c941065bbf88e74d65e20817
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b26fe087e49d826a40968b108935ced7
SHA12c08e38614b27325d6c016de934af93c308d1bf9
SHA2563b617fb71b140a87474e2ef926f40fd447affa409b2fd5a5ecc4af9ccf6e6562
SHA51273996ab31607239a280e98915fa6e5f503a42d4f926a786f8b76ec5f402726a43a79a18482740648a9108c8908681c7a5259389b324775a333ad8a60c6830274
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a651271423e322ebdc5e50db25d3eae3
SHA1627d779ac6c2f823ae5e715c4d0cc22edc0707ca
SHA256e5d05c3607faf1dbc5e6a103f4765b75e51bea676065f6fce346a22841a22f16
SHA512d70cbf4132f42c159c73a7cdf0bb3d507eece731bb1ef9ae4c235d075aa5b0b26a62e649a19bc43b125d7e99322c19f6a7092168f09cfddd6005022b2fb0c68a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5412da28d16f0fe86cbfd5a7ad20577e9
SHA1ff5a8177f9cf7f34583b477ef05b3475df8dd7fa
SHA256b7d1824f93368f724f64278041c981ee82b216aa2e7b1e013f6605213225ec57
SHA512ec979c068a038e17a3a11af1a2a86657d0c4738ee732ed08b2bcffa4ac84b2228a12be92ef1ff260908b6d57fa17855e6e1bab98c29eb679f932907ce5a071ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ed0822a6882f75d6efe65cd9a3c66531
SHA18471b75db73938c2bec1c5b1fc8d1bc40787c2e1
SHA256e83153f83bcccb7fc806673bae31fe0169fd227499e7553e9b081dd3450fc1d1
SHA512592bbdde59f4f829e2a6e5682cbaa7cc20909b532acc5d0dad01ac07d885c3fe26d18ad8756a23af0822b900502ef5ff8ca5773451489b16262348c376150c68
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5af89dfa6c2ae774297fdd99106513c6d
SHA1c8b4690ffeb6758e7e5b5cdf250abd126c30df3d
SHA256aaf09690854326031b300291e7a41e2e6101afb8928cfd6fdb1e90754d37e1a7
SHA512bcea83bf6c40623fb0982138cfd47b3e47d68fa3a693ea6e5a9d3b70014819d3afc646ea1876edfb022df8586dc3d248a8e41e2339a0725409771ce99be5318b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f99288e1884b75560ea026f07136c0ce
SHA19ffc7d38fdc10916ccab58e999c5d71b5d666151
SHA25698c5cb36ef7c7e09d83d0a1d4a1ed79ffb22cebd6209dbe5c5b9026020724146
SHA512391e56793f9afd8b394810bca18180b51b63d221f43582576551d5c5e52a0e456f708f3ac87de1d61c07776797101d3aba37986ddced3589d1bdc7b728873285
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD508d4c7e50b93fb0933933a6ea3f31aaa
SHA1614c1fc73a459f1574ef981d16e2d3b7334baf31
SHA25660b5c1d12fb3632724e49dcdf93af85ebcea555cb122b756a4afeec4094bc613
SHA5124405d744a6fa7fc52804908c45a65647e3d30a293dfd1ab4262d3842ae5853d382223041c7a35b2823c07efbaa099a8e076240a94a4949e83874d392babdf064
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD558c15a7344c67191e3ff20e6faa07e1d
SHA16ad2c71dfa6205d6e261c2a34b83e2a42af5dd90
SHA25691ee47c9a135cc57dd7e4894537050a5bc90d3a016c9549a3982d39fc5242285
SHA51238a13aa579d98aa9066b702381d9534e277085ace67c4f467fba607d3156e3048bacde9b2c5703b7a69e2dba180912f81671bfe9830c2c52732db9318da7c786
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53f0b23c5c650c1ed8a17e7675d21d8db
SHA106813bdb4d9ff3eca4ec43e0c32c14b3a721dec7
SHA256a10ccc6872079f70d4aef8c80c15b6e99742c886ccc1041a54a3f806595eedfe
SHA512557804f0bd5b80f20c8525b5bba0422dc4d82e8e577992ff8381b157bd792c635b510c7b53faaf8e0781e84f1676d1551463b7bf06c230ab3f203e0bbf7668fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b4be58df6a55673d242fcef90244763f
SHA1855468966d1a4b1ca080c83871f3c902bc896bc3
SHA2563d84234cc8d86834060562909b109a6eec8ed5dcab0d6933b7e87f716dda5b0f
SHA512c4fb1b9816119689c1270ecf9090cef70a143124d3b119b2185c74ff4bdb5699bce646d606cbe0d3883c913a9bd900945a3c433848f04b4af5a848f5a42f2d4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57f2191ad4ba6c869280a6444d4662599
SHA110a7ea116248187fce65ecee3310df3a370a0bd2
SHA2562265bae967f2eb92a68770f6be70f3e401a9250d2fe6c0b1947c5d8948c0ce57
SHA512acf089eee06887008730df271e06ef807ed9082a92720a313df5b8e55038acf4e8fa528feb999de2703ecf23564184266950962225a8c1a98462697d9b1ce62f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59387551f0dfe9afe46841abbd15c2c5d
SHA1361b72624b2c1a3889399dac502037622f823d71
SHA25669d483d804b10afd46a8b838f4e4da697b2fb04797f531b299fc7f29cc8d47af
SHA512112c563c652ecb672e30df7451409613f6b064de1860a3e0348b8331680d2bd6bb32e71a37f1c2be910d8043d8319f013361bfd2906b38815a27a39e24abd046
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b