Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
13/07/2024, 09:43
Static task
static1
Behavioral task
behavioral1
Sample
4128271e90f9a86fea20a834dd88b084_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
4128271e90f9a86fea20a834dd88b084_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
4128271e90f9a86fea20a834dd88b084_JaffaCakes118.html
-
Size
6KB
-
MD5
4128271e90f9a86fea20a834dd88b084
-
SHA1
319d5ed5bca4e15dc8dbd3c5b02c75a69e65e534
-
SHA256
9279fc731dfceccac09c42420c144e6cfecf729e7c80f2e4b527932eafa3acd2
-
SHA512
3c740a828f9f85e9d42b4b7824f1a5a0512ad71044db20be9ae7f298e44562e80a482156f3e415f99294d1ee27da930141faf371df1bee80669e5892715a9755
-
SSDEEP
96:uzVs+ux7tkLLY1k9o84d12ef7CSTUoZcEZ7ru7f:csz7tkAYS/jb76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{56B89B91-40FC-11EF-B170-4E66A3E0FBF8} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd000000000200000000001066000000010000200000005b0b58452d8d4dc0f2e343aee370770331b1617a6be30b6bbdaceeccc7c80edb000000000e800000000200002000000074dc07be92128f0e8aef783cf73f1bd6c090a065ac1219153fea4d905dbfcef690000000f1e70e1f4062127db237c2f7e11e7558c39370c68cc8860f0c19c6f9f43fdaf0c5598703d2f8b89300187a53f256d0c7527a946a70fcc4318be613a934f407aea35cfc29e4d03ffb75b38fd0e70e7162260ce982174a053877febaebb04c98fb861d47bfc2bb4f449ab7057d6b2689c41301a0db61b27e28a4ed79d7e5c7e8a6826b02bd96e5f0e650c9d331cb2e3c5b400000002e5bbf3f4a8d90b8639e273096204e4191323af02050fa416fd4bb5f58c1941e9dd3056e58167c0bb229c02709ce44af25e760fae49ff14ba70c5ff82441e5ef iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000cc81e0358797124e6a25e7f27e4b5a664e433bdf0fe3358cc26e35c3f9c4c0f1000000000e80000000020000200000000e11c1e1782c621d7ed14debb1b9fe90e2df8a7317d99385ba5f1aadd5715f2b2000000062806b9e1249d68da65445211af1a5d6cbbe9ffe70f7936a5faac25ca94152ff40000000ca60aa3e9452a482d78306adbb9f12d29c6129526753674fd4fa3f20298eb93795c6f80876a258732c219230ca2c21ce28979fcfa2a00b16db809d554b932daf iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427025667" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0679f2b09d5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2180 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2180 iexplore.exe 2180 iexplore.exe 2804 IEXPLORE.EXE 2804 IEXPLORE.EXE 2804 IEXPLORE.EXE 2804 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2180 wrote to memory of 2804 2180 iexplore.exe 30 PID 2180 wrote to memory of 2804 2180 iexplore.exe 30 PID 2180 wrote to memory of 2804 2180 iexplore.exe 30 PID 2180 wrote to memory of 2804 2180 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4128271e90f9a86fea20a834dd88b084_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2180 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2804
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5869b42c71561b23b09977502c554a47d
SHA18dfca38a48efd6622ad9a44ee46f6fb06f1aa7f1
SHA2560eede40f3b599e747e15fd21a70b5e76601111fdcf1e46eeab0e21128a9c381f
SHA5123c18a558e561f18c65b94db9a5bf57c072e150cbafb667e2fc9f08cb8af7d6b9591824d22b6f61eb5b6821df00d8f9f86a6f04f4d7c9352715c6b617cf989987
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bb0e7e587268cc1691b8ced0763b1b52
SHA1e694786b9de159d2e859d1678b2495d35a4257ad
SHA256a0783336ccb21cab55bd047c199dce6622b70a7108085d5ea430c75b6b080e01
SHA512cc80ab01911777caea17549ff28795ecaf5f8a0632bd079d34966eccc266f6b7819ee3158c15e59a80691529e0b481fa69450a2e1aaaa3562f536a5559b77b34
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cf7c4435fcff68ef92fe9c3b48020d0e
SHA1332ef83ef8008f27a0af18698079501c680ce71a
SHA25606b93d086a08689453bb303a935d775066e350a896c80660f492d801f8ea58e8
SHA512f2ed04cd73ada6ff25f2bbb1c11d6c3e15c3e3d2e75444e3d18c754ab29d4d473c4f38f7920d5dfaa38316ba1c1287806b6b1c253e469f4cadc1eb5a2b88aa98
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bde173bbf4033251ba3712020a9a2f86
SHA1ae2c1138c82782884dff78ac6e32b41228a56f59
SHA2564c264dd7c9fc6d260bd38b53c87558e511426d80ea01412b100c9a6359e30b36
SHA512cb5f465748cf5b15107ab19fad51fa46c0f76b30c1cc133f0ab3388e90d1e7a452826461685b0efda4ca28e7ac1d37786584bf998d39d462825a9b8af4a345ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD545f16cf44c4c2f9312befdfba788c768
SHA130d503657ccf12c3b91888f8b13d729e9404f36a
SHA256968fc3acae43185963ef35fd371fc6a98734be3966ecfc5565c72588d00ba98c
SHA5120407dfbd7b98d35929b58b7f97599f1e2d66b83e8f1333a9705021da2f2fa7b37f03bcd8aae8439a9f3b715125d60477fc082b3eb7b65a217f816f1f38153944
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD524d19022401537a50f0f1fc09fc4f0fc
SHA178c916d64dbc796a33b2aadeda4821371a1eefb6
SHA256a12563ecfdcc00ef7f1f275fc0d1f3ee20edc047e99ddab0942a5d49d9602f9e
SHA5128bd13f3ad363fac7ba2f0789b5a44bd6dee622b11e724d0f10b3a6c622bde0cb53b8ab6bf8e168b420f71f6faf7cb936d9c32089cfed863469ce5d27459aa5db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54ed2095d4627aa03b8ce574887c0f8b6
SHA189a7ea6f39f3d684e258bd449b09a0ade6e26a9b
SHA256a8eb3d99f422efc80e4ae755898cb4c6b8c7433ad0c45fee754dbc7981a9fdbe
SHA51259d64dd93fbbf6c46d1602029409b45cf511e6be7dfb636f32920436e386bfd34614c55d52036585fd6763d6ac799b8500b99f663f84e89165bef09cd1b29cca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5844faab40fbda3c13ea03e5314478595
SHA1339ee4ba6dac0ff1cb7eeb20146245081a264a67
SHA256453e9b4906a3ce3dcb0e0a24bd719413f132c6bcb48741da91f562b72e5ded88
SHA512e118e5877e0ec9d123d659ddae4c5224beb8dcca34131d6a3da586b8f79daa48ecb98dd978415f36572785179d93e9f86d403c6ff9273805d46cbd8431dfd834
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD525cf69a8aedbd449efcaf0d5eaa010fb
SHA17b110abadfc91a0f1ea3b1a4d9f1aa8bb32a13e1
SHA256f428006c17f360e87b6324d68f8efb77fc124ccb6ccd98d4aae1c9e1203924b4
SHA512d6a4c24bbf9383c084f9684d5476be4d7288309a1dd7f5f2b45fe688236196d0a9cb4ce8adcff86170fa233c303a3cfa7ad70dffdc55f6f8d8f82ee14b7fdbed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f719f363babbd5ec781dec2be51fa507
SHA1dd0be2a5041e5cda39e5d882f75108a0b7cb6dd2
SHA256773a8583f622cacb6878daa412637bd232ef1bd971c78709d3a186f76fe01bd1
SHA512da233c709edda77c4e0474e44a3003a575aa43495442696f7d9adc2ad1981db32feea9f84f40ba26fbe863d1d1ee5ddf52a65092cc92c45c98977bb0d5240b76
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD595eb8da66a3be574862a1c62d27884f4
SHA1c1f7bc9b35091ac3d0446cee8505ad72e570cf7c
SHA256c911e57e89e98e717ea3332240fb7ebd90a23d36cca9c2f0567efec0288f983c
SHA51262d6873fb48065f5ab1c4dfa91d44c3e9294884e6b1bb49983af27527e8e220550fd4b8b7a1dfc686d0701ec0b379cb90202501e3540e10aaed6bff713601370
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58d8f79dc8174cd88b1e966651a029b61
SHA19ea70c18d2a5f4242b974781a7eccc42a83fe0b2
SHA256db732acd360f3d1f992a599010ecca436921bd818a6b790392edf64fc949db3f
SHA51279ff75686dacda13942458d89c1ada60cfe529d4a955c85759cbb41db6e6405feaf5d34a3c12d4af240f739dcc84f533163dd0c0da99e177e2770c14d0f04407
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55055a2cfb1e6c0990099295d6b03570a
SHA18625aa884f875de392a6443acfc88b2876d0a079
SHA256a5259d79c2131ac599808ba6b284974d20398f761f818836e85a01f1f06a02a8
SHA512b5283d2ee0b4cdc612eacf0f53b7bc8074d4ae10129a808d905f5102f4d28116c960c7a3b572727eb3c259bc54210e3d28bfa1143deb47eef499e9e0a4fac74f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a412cea50c4ed44c03caf86c0b46d514
SHA111c1d2a228a3f21e78e956ffa2aca3992664f9a4
SHA256de11d3f187c6000043b3c86645942ddfc6cb38e5d1d6c60489fe681b0fdd1e06
SHA512c39c2f0ba04a47fe2ca24dcdda0a8fe132979b0b60c87e8743a1a48c8ca8827d45852be5d3c5e48e25d598b0ef614ae7c47a340b7f4c0b72ce02f7557ab74abd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c99b1a6141aeda7f1c5a2ddbca7eee7b
SHA1770598aa128bb233f4c4d5ff1ce9d289ef854859
SHA25643ab67d505aea08a55f20be6d2b612c12b86795713228617913ed2f9c6fb689c
SHA51231d781699ae7841bd108526afa75d239350d2539b9f8910feb35b742569e75d3e5afc27847788de833729281ea0f56c37417ad94ee1ec5765856b9274c91da54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56c86b26e5f2ab94cbe33f12634aaded6
SHA19a04d80548d998af39c77d686e169d30552126f3
SHA25637df3bd2dbd3eddc54e0afff1f078a03a5eae939f0039e2b42811d1f7ad058f9
SHA51239c3147f4e7fd52a3eb3369bd2877dc2d6b79bf8c95f836982a22ef965bca936faf4ba41ed5bb8f81ef51ce2cf8015c3454eec8301753be1ccdb306058f0299e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53916f2789d9491b5cb9e00e84534010d
SHA1e2792a69f1103e44b0730401a4104e609d450be1
SHA256bf451ce4f3935c512615a34362df2a48a1a42a56b29c8f79a9bd7104b831abdc
SHA512ebcee8269435ff8005a6b47215822723ee8b3f3abb1613e886ea0c52534f194a4b748923390eef6003b0e77cb270861f46de1fb1667df815c1cb2fddf270fcd2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eaa96194c583d50088e765bd1fd8c734
SHA1567cb42ad95cd3c2775459a428ecf1df38a6b5e3
SHA2560ccface9f1c9b7a95063f6463c7d99676b2bb081acb8ac556f9be86e94278b0c
SHA51203831f254a3c3b4bdb84dd040a1d543f7cb839ffcdf2cb8e6ce43d077c7bd98a6971616764c69e919513d33ff7616f71cb4fc26fbc09e15d103c18376f757837
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50f5a4e9515ff54df1218e89b8d7ad80d
SHA1c345703396464b4273189b454642ee466fea6863
SHA256c9530d83465c3e3d01813c57fd4c26fc12ee0afc4931d50f938684b5e7860024
SHA51257ca4a9038ce879b1d410dae26333617f77b15e6b5d88822675cb733bc5c80d826f8573efdd4a1fd8204b7c7896d4f08c958d1ce754bc6cacb1996327673917c
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b