Analysis
-
max time kernel
133s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
13-07-2024 16:54
Static task
static1
Behavioral task
behavioral1
Sample
428c19e907a5af7e23a6f76aa83de81c_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
428c19e907a5af7e23a6f76aa83de81c_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
428c19e907a5af7e23a6f76aa83de81c_JaffaCakes118.html
-
Size
91KB
-
MD5
428c19e907a5af7e23a6f76aa83de81c
-
SHA1
86aad1d4a1f7783aef0ff348ad7a9eaa19b24682
-
SHA256
39dbbf62592d0eda195b173bcc612589903c82400f4365f88ce21f9f6691a947
-
SHA512
777af9695495bf57aa53384a8fb48ae1e44b0ab3ceaa4a11e7bb534fce746bb0fb343143ccae24a6aa3b69dcce58a2adecad69c0bf2fbc0ece4784488d2796c5
-
SSDEEP
1536:EiDTgdwxe9d/4jbYtKyFOdNvj0SxEaukVN+O7fjet9ABuJtz3gYrs8clcR90FfeW:EiQF9dzOUSF+V3AEP3G9S0bp
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427051520" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf71000000000200000000001066000000010000200000001fae750751d389b9f97bccb5c91c9fae301481c5cd63dbc19d57fa8c4d9be8b0000000000e800000000200002000000083ad893332eaeeded57cbfb6025fec80b99694eb930071826209a999adef93da200000005c3accc8dfb1898104f7bac6bb04666cc7cbd0e0b5ee6ef616ad846be85c31b940000000c808f8c8d30cbc0a53367e0fcbb7be14bb692a44c416239c3c07ffdd88138d53309e6579d1a707018748cc473b539ced94219160528db077a9403eab0c798483 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf7100000000020000000000106600000001000020000000907c1efa08fbaac55d1df7052e9ec7e26c0f846b2fa8fe4346e56ad303ed2777000000000e80000000020000200000008afc724f99f536213cdc25a3a527b4bd238a82e2b7cb55caeca208b5fcc8833490000000609d9323535cb0434da9f2f02d6a34782ab133e12ffb2e5169834e632eb236f71dadf477859acb80588b4fc0a1363b19010a95b33754586a49bced8212f64e8e91df9a3218da236a45b6505714537aefaa5f81e7c2bde9219fb0913064607ad8f2bf3c8bb9ca1772e8ce8cd58bc5b6fea4f2772009233e004552a6fddcbcdee59310a52c100bdf411819cc40851ec6084000000004e7bcae4485203c0db9bc15a7560598379590f8bad9b6ea059ad1eba2cf553432acd1e5b3eef7fe0c99ef61cecaea89ccc84bbb87686599037608ce92acb69d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 505ea05a45d5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{85FD3A51-4138-11EF-A850-F62146527E3B} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1820 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1820 iexplore.exe 1820 iexplore.exe 1272 IEXPLORE.EXE 1272 IEXPLORE.EXE 1272 IEXPLORE.EXE 1272 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1820 wrote to memory of 1272 1820 iexplore.exe 29 PID 1820 wrote to memory of 1272 1820 iexplore.exe 29 PID 1820 wrote to memory of 1272 1820 iexplore.exe 29 PID 1820 wrote to memory of 1272 1820 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\428c19e907a5af7e23a6f76aa83de81c_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1820 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1272
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f1238bd4607547ea9acbd9508c8bafe7
SHA1d63502a9c683696446a39064df70854a592a3394
SHA256a510c986ddf36445f999ead288d89e71313d27acb83fc7b4b050d6efe4b375a1
SHA512ae480466b58f59b35482698764b89e409465bc80a339093b6302f36119bf0839ede15ffb297023555b37a4800e421fd406f525c68232a4676e8dc119e6d7c7bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5538cd45cffe7b7da241fc506c84197c7
SHA1c13eb90cb9fbfd863a274972ae99e82df0e26847
SHA2560cd101203cd4f288e3314bba9b29aee05dead919f80de688db3f1f42e2c3300f
SHA5126f4702c6f0329823e2886a7efdf762db844142111eb1cd027c1b4cc1fc83a88bbbee4454c10ac05426ed11e3c4e746b11a71324cbaff2d6dc445189bee2cff3e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a54bc6257b811b0c9b8dd5722aba88ed
SHA1efd9130d16b07d60743483cb5712a2f864f86199
SHA256651862a87bcd74b082b44387c4ca7721b5ed4067e9ab4f89e01dad1eb9df2c46
SHA5124322adcfd825e998c23c4a53f254147611c33715051d40673bf131e7f0fe2d2e5fe81150bcc4d91d0e2aa05f5abb1cb0f6f378476fb4d5fbbe681a6d9b967328
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56485ae276969a3967c4dc275a5227da0
SHA17a1e0899b6a3d26bcd11996465ae9fcdece19b25
SHA256789dd6cb7b6d5539734bb911935bf88631631e479abb51afc26cf28144b9e493
SHA512b4ef16faefb72e3990dcc4758c9628320190508e499f9591f6f2c96eb04fa8d66ee8c61c0e53e7484dc0eee66f3740bbfa9a4eec3b8ab2c2ed4bf9f55d8771d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD520b69c20bf98601d986385a1e59aba1e
SHA1ddf6ec382d401ad605d7e55f40217f4353b9a255
SHA256da616dfe9e18f0a277a9e10b9ca00a3a2ede499dc60e023f948d8e3b439a81ff
SHA512e87cb8ff1f3b3976ff0e60de99298827c2109efd6d813783fdec60d41dd15bb74b1010f8ad6c2f66fc68557a487b139c5109b7544553141353d37094d5831c7e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b8b14dc7f752680d8d6ee049267cf106
SHA188bd5e8f20047a88ab38c07599cd6f413bfb5e57
SHA256c94f6e614d3e65b850a25ecf76815c3922d631e765a54fbac0bcd3d6a4a525df
SHA51220efbae46d28346f738311c737fd93dcd54188beef989aca47bdfdd9f988f3b7fa5ba646098afea6bf99143642cea4bcfd45272e7e4a0fd9526a2a6b1f3e62b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53d6d665a90ac0d6462f275cfa560f460
SHA17f89e122a26e98fdb12b6249681b56dd0b34eb75
SHA2569c5784200effc38ed3680d1f4e582d85068205d41a8b96a4c5e998eeb38ee487
SHA5120b814032494db81038b36faf5dd8c56608baed0d9abf5e605c79fc7b49addb5322fc8cc4a779754d99684cc75e6013d8df1d5a137afda403ca0bd2e66149394a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52e79a8417971d173c7397ffcc24bfde1
SHA1b79b6af896b5cf08fde6743c72aea8662388799a
SHA25630bc8fad2e27a8c64672d5fd54cf3bc568bdbd4d54229c771109b61e104c2204
SHA512460d4234ace0d1df0d34ae8d5db812f9f307d37132e764abded73ea48f2fcc7ead144af14217847117fc7458191bfc374274c7298e57fc3998c7e1b1eea61346
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD511f0a473dabc7cfa99cb934765b268fa
SHA10dc0ce744268d15d8e95c6f9861a86420555513f
SHA256b96e8eadfd7226eb30c914f183367d125e4986c3ebce2aa8387af74e62b2a8fa
SHA512616ee61859d8c1db5cfc9bc794b4870ab454f91e24b78949251cfdc6c7ca64f0dbadbf37c7ef99050e18358ea30fe50b14d230fd6dc40d0723f9cf874d1aaf22
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b3bf1ef5304166cd9856b8f1f6ac33fb
SHA12f04c130124c547a82d5b6433fafbf589a4bc866
SHA256a15b8dedbb4084fc3e76ef4a1036bcb821c5335f3d4a39606e354684ae0d18af
SHA5124d1facb6c9e686b709df53d48822901716981dddbd6210214481fd252774ce07a1c4abcf5e08e0e7a40aef496cf41ff66f9839012843d0b658862b66e5b2b2a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD563ce517521720a408b2bd12647a62a3b
SHA1c2ad94118b6a8b9a2bb48ef3e56d28c0ff187b16
SHA256322fe02f93b2d38d324be03f1420ddc0b0d3e4175c8ae11728a8ab4adcae8b4e
SHA512cf1b0f3275b8132367bdd903aaa219998433cae28bd8bde70103b8820403101d42f6273b5e5f809fbec893e03caa6bff86c62873e26a3b89daac9e2fcc9c6ad8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58532c5c442c7d11c3fbe6d2f56faf6d8
SHA1d6ee9b65d1e144655c9b810ccc04ce30480a5f79
SHA256dab1435dcdb62c6c641c5562e49f0f2c6aad990d31008e67b5be5efc18bf070c
SHA5127472c03c5e8c8245ce10b33e3273f3303687d7a1f54ea12ae7eb0d756991d9a4b3935a2ea5ed20434b0b334f2cea2fd05fe974d4e8a96a566716667e4edd878f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d985c86ee9a32ceca64775a53c21b333
SHA138c2e7af495cf9bf66d1058424453c70b2f0d4f3
SHA2567964949575ce78fef0966761ac003364406cbbf9a5506f7f2f34465a9b384b1d
SHA5121c5a165f66f75f526dd797b7e0ca68f1e7588b2f7dd645cd3ceee3c68da2b2f9a07a3f0c7641e57a79e3fbf866a7c91493fc4f430625fd204ca60ec1beff2140
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5664ded688de066129d993e806275e0f1
SHA1811ac671c5a6c7c80c68c8d3dd384fdb2c010fcd
SHA2562fc4baa740667dddcb22046e38aee72f7a6eef86bc4d02b93b35c6e532e7d996
SHA512f72eca02e68d7f2dc6e2f2dd45b6d9436b850d09786d7fdae41770f19b1ae90ae2f0c1d9889d1e59c23709b2219203c275a97c18afd565e5f19c70c2f7a088f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ea60e2a9544b03f467d7f322b8e9b897
SHA11ec691bbddd8b46284db366c5649b7cd6749fe58
SHA25685b2730b864bcab2e5a4e4fd3bce81de5c2cdb271e4bb7c7d61fb7ff883fb050
SHA5125674ddbd0e472edd98bf10dd7904d6a86809b0152c53e52eca4b7b29b2ee2cfa72323730ab0abec524766b6f11cd5ef2c53f536cf13870dcc929102ae2de30d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD560e512777ce1ebf50cf6f0cbff2a3365
SHA13b325dd49183db711bbc41fc047994e1be9a32b5
SHA256c712af70954d0d7071a2084a29984fd9d7f685aeb7b86bc2d616cd03764166ba
SHA51241d41221a13e8a3888dc25ca5417d074d14b03b9ab30efb3ffd4ec9e01d22922f2321fbece82c350f7f96b232f922171424afff5237bb5e7863c5a47cb2cf1f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD584a11cca096962b5eaa45c7124b9aa7a
SHA17caec6169593b763ba0dfeb322ec9cd8be6fdbf1
SHA25668f8a96bab90bd7ef059a02a678431d1cbadc8e054df39cdc3b3c5596e175ca1
SHA5122fae1337a9ca85c2b08e116135bfc3ebb0ec24e26a903ee566b9f834f43df10b4bc1dc78d4dc114fde12cd8c896bfd32905df49e80b56bbd3fb144870e9c4c3c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b9423431c5dcfb3fee90662cd2b96785
SHA1fe9e48cf2b089f5ff294a6cc0525141951ebd442
SHA2560621a3e2e3b4b9d658843c7f1c283eae44899c0ef56fa0b13c997721455e4435
SHA512e2cfb467a5cd2dbc8ec0ba2bd70701e3a64086bc3bb2fb4b7d9c7ac7aae2ec0a8fe80d1a2c702bdaa4b85812bd4521fa5ee52ad5cd0756f8fde79d5a65bd048a
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b