Analysis
-
max time kernel
134s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
13/07/2024, 17:59
Static task
static1
Behavioral task
behavioral1
Sample
42bfc8e036b9b3b749e7a9a075c794ba_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
42bfc8e036b9b3b749e7a9a075c794ba_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
42bfc8e036b9b3b749e7a9a075c794ba_JaffaCakes118.html
-
Size
1KB
-
MD5
42bfc8e036b9b3b749e7a9a075c794ba
-
SHA1
ec0e7e19a8b543ac9297588d2993917dd670c244
-
SHA256
0af70e7fd44a8c205083b7511627db486a91df0d01a2862ee0601531cea867a5
-
SHA512
e56e4c9e3233ff5120a3e6107dc65c42c1863d93b9ccfc8d50261c98d9bffde737fd66c9eaa8a0303e73e9f4e8d8b2cdfb5501b10ee6fd1038a49f151130bed3
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0ec1f764ed5da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9EB5E841-4141-11EF-A14F-CEBD2182E735} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427055424" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f035510000000002000000000010660000000100002000000025f6cfaa80e5a2c74879899696fe42e95b65ce9ed9d9f8cb3a5396861c58dae1000000000e80000000020000200000009fadbcdb3d28cca22d53b37381cd4e895b75d10d7fe33a9882bf354f783a10e79000000095950813e6955f58c2728bf53c9de4a54684128741e70c2f4c79efc891a5ed4365adccc609a74da091149f49b61ba3a89435b5d6fbdaa9be3563e899ef0bb3c900789e26d7a932d7aaacb8d93e0e3f9eb5e323d49d24fd30ef9af6c0d7b51d06a82fbedd4a7a2b69489650a2c84b1953619edee7052a806b05d1096412c1cb6be794136b240835e1cfb00eb19be9c0d940000000d0dd62db188ca39ed8d6d76412850ffb9eeec2cb582703ef35b4925aba7b8ab9e5f1fdc3f215f873e1c1edfe7090873657b330e23684677a80ecdab7cb93ce6a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f03551000000000200000000001066000000010000200000004f94bb02f477b2005790860ecb6ee5e8eb15627f8bc3381392aef5580832293c000000000e80000000020000200000000aea6c5a94de8917cbf4736c4f37ccbc05bdeaf4609d787184711dfe6d6a783c2000000077427febfab51ee99886e72923113780a94a4ee037e210a5dbcbb3b24281f66a40000000bca3f001c4a6ede700936c3892f4bf4e5c7afd03abb9c28ada8290e63a8cc9715fa342d8cea5989514a44f9974565fb8f43db7ceb2e63ec86bd9cafb0b160507 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2708 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2708 iexplore.exe 2708 iexplore.exe 2724 IEXPLORE.EXE 2724 IEXPLORE.EXE 2724 IEXPLORE.EXE 2724 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2708 wrote to memory of 2724 2708 iexplore.exe 30 PID 2708 wrote to memory of 2724 2708 iexplore.exe 30 PID 2708 wrote to memory of 2724 2708 iexplore.exe 30 PID 2708 wrote to memory of 2724 2708 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\42bfc8e036b9b3b749e7a9a075c794ba_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2708 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2724
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54432a6a84b5839a93fc34f5ca337f17e
SHA1d9743a69f8f14df17089a0e06b6f608093b837a0
SHA25689895db7a090517b1b33c0211d22f35334b0473b70aeb1fe08acffb362c03e9c
SHA512f568e607f6c459a4898a8ae452cd5ea9eee7587fca4ceffb57b6121996a44cf5524d5e97ce1632c2c2dacd9cf78c4b26241b48bf0d985ba34bd59ceecfa40f27
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD595448db2b07b42e02b0bf019dd12a742
SHA185477d6473b3f4585f44edbdf3c6ee9ced318673
SHA25678c7b3dc89c804e2684b21d061851d57357ec3d5b32c3a89108158fa346fedbe
SHA5123aa601f3b1ef96bb33f77eca9a23adebf0e9a2209abf3caa49d524f88bcece8f66dac9792e70a16d5b620d3d0d5e29fd48fedc40496407472f9ae5b893a2b705
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD502c14c3aeacfb9ddf5c20883f78880a8
SHA117f4179c80d3d24f0be56f428b0757de904dab87
SHA256529c49064c7f6809735c78268b4d714b39316258f00ff6122155ab6394a215e2
SHA51263c387c97c10dbb23d2842b72f8fff9a7a27e296688ee02441231eec606fbe09782667c103b2d6316c416431cb2f18eec6f44a8da515bb30b1601ae104e6a0f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c22cc62883f4836c9fe5eecbd0ee1331
SHA1ef50d7b38589292bf9ebac13bb01e90aaa18be1f
SHA25637fefe17910b0f499dd9963ad24b60a5d77595b5ffc3c428a4e87f2bd546bdf3
SHA5126f6f6df05470940c43ec7e0c333f9cf946d8a3fc99514c69d08f908a04231924322e8a64ecac24a8dc52a7554a4e7c0fc34e7d95fce7ce42fa52e5d1e8fcc750
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fb2b5dbf150ea846a79ace7ed90bedff
SHA17455bf44afa316601e6552af27ecc6f79592b2c7
SHA256504e9a96d7ba75adbf366bfbbaabfc70f29f7ad49217a975b00bd8040eb98572
SHA51201857c29d45ff92d2a8cbaac97106acbb731542903df8d6ac3ec097291685073a6ca039b7f230780af453ed9eebf915f0d56844bd2fc7d1a5e664d2bb43b7770
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d5cc89dd2a7df8167fa3bd20cf9ecede
SHA10d60256cbf0d2226d32067758d220ec6e241644f
SHA256c6fb8923e7026493e337bff78cb9cde652d006ebb67f7254706d9eba4126287f
SHA51244ed29cd2b632b9d8a8de5caad2923d3ed94f7f73ce66eb5bcd2c125f95358cb2670a572ce53e98dbef6a796e63ebb35a4bce9f34f3f844f79a8188f0a8648f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f9a84b0b79722cea4cfd8d0e79ff84c3
SHA175b712c359c05d493875ffa7d7b630a07bffc683
SHA256932d57dd0348702259957b7d4cf1dd4870b73cf86f3728ab366d515fee56b0d2
SHA51276ed7bb4a0dcbf974e2c34d90d2d631f7508d9197a8715ccc404d01df7c847ffd04f6f0c5feb8067cfb8455d45d8dce5ac98df7bbe7a2014f56c8a5a1bad50c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cd510c42ecb27521eaab3b77e4f81ea7
SHA1a013f9ef8445fadee192f2eb4706c9ea20560c83
SHA256acd15825cb7a8bc5765cc98399608cb5595b0ab9d50d120d711a7ffd74cc483b
SHA512479e14296fbecafc49f700a2160300a95db9cc56529ff2de88c169f7c0737db8f50134e5eeb7a7f831d5bc170bca59376f020d8abece58a0161248995a9d8ef4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d23187ff5502497658b4f8fa1e728a92
SHA1c1771da623b3e8c8bab88d00a17a893a033d2031
SHA2566affcaae6a45ab5fd21c4cb7db2a549f578d631a03112e45581ef08c56997d4a
SHA5127757110c18a89e061f287f94227f057c2602d0569aff3d139d3859c23e71df1af94be45fd40cf334b7d1c55633c5b8650836e4dba89b676a10c8632d2da01f20
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e86d78e1066d6135515f412102e04000
SHA1b7890d19c450eee43521ffe9c9d10bc0d68b4e26
SHA2568092544b015d641e5cef99517be3f28a3f4699dc79f99ebaf4831963532a8ada
SHA512d46b2378e80cc6d82fd1422af2f5373918beb5a4400f398fb73762a0fb0ab33ed1185eaacc1e5ee0246198a5002e553f4a2fb1fcf80dfc1a6a09d8aecb53e05c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52019df84dfb47bb1ca8b8339b120b0cc
SHA113dc19488ae63828862b5f6cde1468449cc00065
SHA25666a68fe7fd68b240aae70ab44ae1b714a2f00238222bb1bb2064aeed8bc22ac9
SHA512ef42d7cc73e70a4705be88bae607e946792b58efaabced3887a6109c2ea7e5aeef69cecabcc06192a8bc5a405f5d48184edc3f2327bf50302460487592339943
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5448421db03bf1ec507ebda401a579717
SHA199827685737784eb5cffe867b18fa8765118692d
SHA25693f289a20934c7db31ebe0fb5db87d15ca60296b40372ac3dfcb72ce8c23f7fa
SHA51291562b3b3356fc1ca2c7a5df59b0b93c6b1275eae2f4b02a01f5075bf4da12a6369fe7825e7ff452193299dde8b48b055779cc53485af286e4e4a55688b248af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD545d64be5a8f7fd1aa3600ae84341bc2a
SHA10769f04b95395ec760d905d0fa0f917da1dd20e6
SHA25640b151f463e9c56bd38ce25bf07e315911fa9b303e8785a10bf73c84eaeca984
SHA512a26afa020342b21652cab8052bb70e998170f2c1ecd18e30a3119a8cbf1db3b086d18db24a17f5dc42b393cf27eb6f8040f1474bd98d8b6565acccc843897adb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD594f8bd5fa1c4c8e33766c4edf5d07d82
SHA138a8475231338aa44e73851530c3f4ee98532bcf
SHA256d8feede9fd5fa78d46c0d2d2307364475a20724e8384d5ba796485fc986f8047
SHA51280594fbfcb6e4d8ec25cabe47ea37a6ea1eec1239a645efc4add280abe3ad84b30c3f01702f9ac83d928b048bb180fcf8c4bb0a53bb90d2b6d873bf0c9475f70
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5626c7b6efdb36c03ce1abc565826eecd
SHA10e27c195eb8965b280ee333dbb1dcec0ecd614cf
SHA2563635679bb6aea2f5370cc118a30840d2f2a4a5ac232d061a4b0e652ddf3dac8d
SHA5126b4e804ca572c3eddfd1dd4236378aec53f12f3a7b5eedd3e9cabb212bd56da6d67eb41dbf111465f068178c5e726422d767617de5bc05cdb00d0fa702a1af4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58f6b6b74599b4377f98b58016af5ed7f
SHA170dfe01e9a20a5e4c17ea0c05d2972df9cacf250
SHA256241c4820b2da82f0079d60cb85f111b92ac4e8fbe20f53c32e2a443d9e02e425
SHA51289a594f9ffa9857e75054bf2307b56d24a1305b2fc4a4a1677ba084e4d32faedbb2bbfb1772fcbab137d8dfb23698bf9b5fc01ceaf81bfd1a0076cbe4121e3f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ea2d9b730b7ab26170dc5455d48d2930
SHA145b8a47dff51b90cdd6da39535501f5070db5caf
SHA2567bdf6f329653416409a3267b643b22e9332a0ad08975d173a8ce79205d6c27ba
SHA512850075b066e30595ebe217e7fffa3d4e4ce923a3c3b5ac2160c29c4b53e4b83e6304404650d1fa30e6cdaf051ca4ea2badb8b3eaf66430ffec8e7a89c0700c5f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD590d51b77b3d334ded9218add5d55cf2d
SHA1a845370f3d5a1f5ccb7449661511ce088f7fba24
SHA2561ae189564b4ec449a26f0d53e95c0f665a3e1323a9e82402555072ca04b8b11b
SHA5125d4a252980f99d0df559593d74496ea5bddeb3d57b56b8ff48a7adc9d66de99612c8ac9e40e89896c19dcee00b8fbf56840cc1da848117e9ad4368815b17039e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD537575bc5608e56f08fcb1f0614cf6588
SHA1c6018bdb9a16bb4fdb45e87935edf104b0484bc8
SHA256224927e8d6a4e5aed8c5c3733cdf4488d71f066d70188a017c76bb77adb4d0b5
SHA51291973b4d3cdb0e1c7cadbe0d0da0f0241b8dbb268591763e7851e0a93235898547e3ab2c94b17b1ae2d421c6a09a8ca43fff5b8fa3287471a81fabf176b055d1
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b