Analysis
-
max time kernel
119s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
13-07-2024 18:35
Static task
static1
Behavioral task
behavioral1
Sample
42dc443671cdb6cf24729d4dc580a7a5_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
42dc443671cdb6cf24729d4dc580a7a5_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
42dc443671cdb6cf24729d4dc580a7a5_JaffaCakes118.html
-
Size
2KB
-
MD5
42dc443671cdb6cf24729d4dc580a7a5
-
SHA1
c8b86ff6ba854ab913e6e8ea2c5eaed06975168d
-
SHA256
3114017ab759c2c94256c3d3f1434ed8a18c4d428abe739617422c55ee5e865c
-
SHA512
8bdef72d634a7a13bcee3b0e0567f2d8539f97c2affc1ed1691e62ef912e325061fa7a06bd96062d61d902125f3d5284dfd4f12bc0dccd5fe1b4a5429a7975bb
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1076e87253d5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9E6760D1-4146-11EF-9A68-F6314D1D8E10} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427057572" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f000000000200000000001066000000010000200000007abeff5a23190a8ff79e69d9e8591b96dce02552fec0fb9eda7b67ba34337bf1000000000e8000000002000020000000ba1cd57901e0fa74edd19efba667375b2736c42f4f82d2a22921bcb90876c42090000000a2f8ca10c370f6135247797af836418f6c27ad03c10d4ea73ab8091a5a07697290acf316f63e4581e39d749a4850e32dea004ee27005f351b5c8c59025484fca5875d385a8493951972796fabc28bbcc0cbd36611b403fc38317d69031f0fd83f4e2de4a61378768498426719bea9b619383f107238ef60b26ef5695b39ec38601821cd116e36a238e4dbd0cdd89a0a74000000033089bf1c06b0015693d09b19a6c17311a3c847d2bd6c0187031a4257895f5aed66e0b118b13ad0526622acdab66b80d221d62d64bcf27708b3d0a9574143c37 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000a2d2264a997031c77f064b15ae513ea58f161a4d271667468e520ed10cf98bfa000000000e800000000200002000000031aadf3b459487af3086b33e67b2fd5299ed004a666423295732e2bd090e3a0b200000008448fc0a3a1104068583a31aec41d581968a55f6be39d1ac815fb69de9a88f9f40000000837648e30d9b8e9487eb54618960e3b6adf4b7a3cab2f0e39463db3df2692ceec36244b18764d81915a3813efff0a37e43b36e446aa3ab23560ba1a6c0cb6f7c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2232 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2232 iexplore.exe 2232 iexplore.exe 1760 IEXPLORE.EXE 1760 IEXPLORE.EXE 1760 IEXPLORE.EXE 1760 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2232 wrote to memory of 1760 2232 iexplore.exe 28 PID 2232 wrote to memory of 1760 2232 iexplore.exe 28 PID 2232 wrote to memory of 1760 2232 iexplore.exe 28 PID 2232 wrote to memory of 1760 2232 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\42dc443671cdb6cf24729d4dc580a7a5_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2232 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1760
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a686e9993c0afee1b70d13b682d5bc28
SHA1b909e74f678dfbb1cc6cfe60f8466dfa87b8b1e2
SHA2561bbec8209a8d05931e0f95c79c9a9b250794dda045fd369d333651386799ffac
SHA5122558baf940f0aea103d736b55379c7a4812b29cd03027b7c1edc0557e537d7b9ac2c705150a1a799515266e14cbdc0719eeb1391003aefca34e6e1475a15a62b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c899245c5633545d7af85b2c19164e4d
SHA11a2ef7d9baa49b17c83be3b69c766d90faff1d98
SHA2567accae027a18ca3415bc2001c150791505da9d71ddd9ed883f7579c353a03f15
SHA51292c5ad75f44003cff07d2bc393e604a4265a597d5180464e26ef4c33ad2521677cbcacb72a501016f8d591968af32f3cb66c3f915dba5a4920061445c2a2061b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b806ccd380dd848583aeb3912e1d8541
SHA17eed85ed9c0c246339469fd75b80909c87cb6b18
SHA2560607243880721d81e1d73d6e840dac5c53edff3eb52b57f922300e93608ece99
SHA512465ce4b17f6dd52417aba0da875a7379e85134a370dd8543b602461e4b160e9e25a84c947daa7f2479d982ab2731d9eff34673c18f3dc049af95d98e41c42e7e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55e5888cc7ede8dadd471bea34e0466f2
SHA1c096031e0abcdd9a5fa0a316809d7cc570232a3a
SHA256bc22db71415ced69e2bae06961b6b4711549df1ff28648733525eee2169bfe3e
SHA512a889c24057da0cf5b42dd89979130f172d68e2770a86bc4c06a32d031cbc412b41ec777644ccc4077651fcad89ba37cb90ff285f40a21f05622d85484278d347
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52e74d79c49f118d582f029cf7f9b3c9d
SHA1e5c7c7acfa5c37f07e797a2670454a7debfcf157
SHA256db43c390bb07fd9f0b41ba16d947a1cf7c5d98908357196111035f097dc380ca
SHA512b1078348a6ebeda3c70fb23423761bf9c3bf63cd6cc49f24fff5f4425b90aaab4b09f68fd76aa21ca82778b760e0a64ef2e5246b73cf754671ce9e2948f3fbc6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD505ee0804e76345c5a0d474ce9f6c231e
SHA1b422e2c6b0d852bf9859f36e6e382541c09b9f4e
SHA25668326326b458aac270409da4d027fb6d6855e6d8ac9cb1aa3ee8353265a21c2a
SHA512f1755cf3986d49c2b84dc6cc573399704187726e51ec256010575a7700962bea8e7228b520324e91bd2f99e093dcfe8e75f2a421e95d398996b6b70ce801ad6d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD540b9d613c5daf5b06a805073336c100f
SHA1be02b54b3dee346a7943a0b5b05229647e0aa3cd
SHA256b2b4c8b2f7b099720359a7ed6b70136a45c986228c9851a59dac92bb2a54a6ad
SHA51259492f9eecd9b3003b1b72be52bb9d433ec71325b9258ef5a16924cd11704b1f21a5fc481708bc5f2e9c1e300d955d42f95211d5d9904423d007fe3364b8ea87
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD567c3a86c801c03024147814462e50800
SHA174f6113a48b8aacf433a5cbaa5c2b206ca6274df
SHA25647ed667e5f454cac60189dac22167cd74ccdfec5ed6338748cc09d4f2ed0140a
SHA512d3138c5bdce03645094cc24f0883d39f10b77d0ce5b50d5b222e65f9facf929f76bdc1f1e5de797750b92917af866a2fd2b241f5e79bd33f5676e1a21dabb1c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a40bf375252b16b104ba3962ff2af9af
SHA1103c1560ff43a116148c6e904c8f5575b5ef6354
SHA256d9b558e39da277c0d37b07e064fbc2e0a4869b1068709b93dc9661d251ddb806
SHA51272c09936d04a02e1cef1eb7506d39357bca45294951137392e04cc7e6bc3e5ba323c1e47a0e27d3c8650a67039860ed1385bdb6dc90d03aac9a6327e96f7d691
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51f64c87aee1ecb6018a1feff8863faf0
SHA160cd7d563dbf2525b6252fa03f4df65b35c9db44
SHA256a297a71669273cf21dddecc11d8ea7f999b1e0c6d5e233771b5c227c770f9073
SHA5124074ad179e8b6cd179afce2f5c7cc3340f8e615450453556c8a3d72c2300f6fc042ea00334cf0f3b4296128d7e8de30308193d12a553d2c5a64713b40f2979ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bf0153c208ac5284494371c3f835a394
SHA1d6f54050e4e0442f749df1b2c8638823f71e859a
SHA256266e4f2604a6c943089bf19cc41e03d99034d19c2dbb279476a297793309c744
SHA5124be0df04eb16f5ca133dcf415d39a305709beaee856d5b7868f2b8c81e263c9ba722b7d5ddf3e7c8ec85317229edf71a87851d1ea98dda9639f30d606291d12e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5796203fa9d22f91c9db7c5eb69a93f72
SHA1749276309736f106538d9a52e333891ad3f8cc6f
SHA256a5512a5bbf061ee08a0e45d0a857c30c6cdfccee0a782f8d9a3f58f9040e5fc6
SHA5124c1c6388c2cb536ea39d0093b03904fda709fde1166881ce5f8d5985da43bce02050596edb5d408882ce40bfdc3ad51c54e1769da762fb19dd2597c79c4b0c56
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52480e7c3040c70a233bc988ff1500e16
SHA1e23b5d21ada486d2567f6a7ad393a09eb5a0c323
SHA256f9b69b8f6d4968a00bacbd01f10bcc13f6f128bf63f4111726f183300ee8e782
SHA512e117239a0714bce8c97ab4cf2f28ff6918eb95488bc0b2a6e6443ad06406657cc8a44e658e0aba0ede2c3ac58bb3ce61573d8970130f29b4f0e16e49a318a668
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cec2b954eb75b31180fa86ab289b70ef
SHA1334196ae6f5f40c0278db3ef851bfad3f09a9cdd
SHA256a5d633274a2e36c329f6be400559df175f702fcd2a4520e7893a24c4c4eaf75e
SHA51246219800d4d0b7ce6faf173df4f983c5a85525392ecafe9490ece2d2fbbf83582d8c8ad866b637042c2580b031f9bb734557951b944f6da4100ab310658a8eed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58d9130aa42ae54ea5b9366a58a9b10ad
SHA1cab23cfa311fa15f55e85a1605edcd99d69249bd
SHA25630d999f2dad924746b1fb5428df578c2750af0316dfc5583fdff4d71800e929a
SHA5120ccf0b3eeeceaa2fa1322210811ba8099c263b473adb20dad1688188c529c6240cf098b6df6b3584f1fbfc385659c18e33dd10934e82d8d7ebb328166993ef33
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ee01a81984a3e6c67bc75665b7251594
SHA158ef79fca2a4d7c6a0c5845b3d9567bf8f301e64
SHA256b5a438fc86ead6df543b92391ee08f200fcf6fcdb4ad5f25edd9168ee393be0b
SHA51275cb888575c6aaf34eb21c4eaf054b2b7bd63b33d1bdb95a01064bae4de5edfe7da2076bff47bf4c07db37600c604d9a441b8fcda6e1b75724ec2aec65838476
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f93790caaf8af346e7b233ef37a13a26
SHA12eaabbbf94f064a8a7836b0f640e34a4453ff990
SHA25640e255e2acd29cc0c42cf80001348b24e0fde69a8c8bc4694ddae789f971a7bd
SHA512fc23b2a4a79f7743b6e6e7c3cfd0540ee720ada70e2a78f43e3268a6cef60dc5e62d668b6cca0053c1d79427f0893f4f67fa09466ac6ec847ef5800c59fc399a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bf4b4188a35ebc60a8302ae9458a5672
SHA1df8c3416e38fed6c608d152b1636286004a33713
SHA25671d3a36bc9ad7276a25bc49a18cf7491f0dff0a3afb7188a3e5157392aeebd04
SHA512e960fb1e107dbf2fa620c657e4bd3986046907e24a28f3dafdb9dc8be0a6acfd080e1454907de86f74cac74314a80a849de5e7f5a3212ead5c9511e9e10a4767
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b