Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
13/07/2024, 18:17
Static task
static1
Behavioral task
behavioral1
Sample
42ce3beed6aca16528440f7e7141b9ec_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
42ce3beed6aca16528440f7e7141b9ec_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
42ce3beed6aca16528440f7e7141b9ec_JaffaCakes118.html
-
Size
254B
-
MD5
42ce3beed6aca16528440f7e7141b9ec
-
SHA1
c327250ca2985270180c7258f97ee60c6ea2f520
-
SHA256
ba5346e36733bd223d94e3c10a5cf4efb22188d91a834de4fd2fe16be8b300b0
-
SHA512
9082291252bee2913b2751966b0c2a1746baa0964215f821486b8ed3206b599b723998d260ae7bc1388da1a3ea53270c40833b8072a26a4f42bf49c6f51b667e
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000d05f95b25920b07bec85d1fb90f97542d3c4403e87bf563da4338cd07da24c82000000000e8000000002000020000000f89170156a0add08644d568b1b2778e246f2b4c4dd4248fc01e6e110c61694b5900000004b2a6385c85bba81fd1dd3876f852ee15a0e793a2c7d033c214bd507e739ed90d97b0185d555d6209d448ee8bf66196338d93dc48789c8a8dff5ae1725cfdcd7faadb96ed2d2aa3be7d0e2d64d92dba12a82515c6e16b007c4659beffcec6142b0ce7539ddf99332c506b00c8a76b71ab14c8586ddf364c892ff83f6efc0032a7d6eddc3bc31f3015fc80c75d6b494cb40000000f135558c95078846dc26b8485be7a993e1a6ee9cf4568b1eac080907d339c9aac48dc3c78c1da8e3d9253c8e9eba14e10df9fe3285d5b35164df7410101605c8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f03551000000000200000000001066000000010000200000004e66c9596357e3adc1002086ffeb42e2fc9fca358daa43b5d000c54acc35eadf000000000e8000000002000020000000bbd507b0916216827d56a767c8c3614f1463dfcbeac7e2568915168443eb55f720000000df5f9aa0f51fc9523c9dca8281f9aac8aedf525f48d9631b83a285d9bd99afe8400000003520c8a4c0b6bc4b11e21090e22a131c8decdb3458f2b721a6b2d22b910a02a6c4ba9301d848804f60e00fc11d2f0425293117589bf4dccdd5747eaae9e088cc iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3C1C0EA1-4144-11EF-91F6-D6EBA8958965} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0f2b91051d5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427056547" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1760 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1760 iexplore.exe 1760 iexplore.exe 2624 IEXPLORE.EXE 2624 IEXPLORE.EXE 2624 IEXPLORE.EXE 2624 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1760 wrote to memory of 2624 1760 iexplore.exe 30 PID 1760 wrote to memory of 2624 1760 iexplore.exe 30 PID 1760 wrote to memory of 2624 1760 iexplore.exe 30 PID 1760 wrote to memory of 2624 1760 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\42ce3beed6aca16528440f7e7141b9ec_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1760 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2624
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a433f383a70710687222c472277d4b99
SHA15260f025b895a5e14bf5da44c48cae756fc7453a
SHA256b4f471d82c10622cfa011689494d006b6a965d81f49a594424a5820ac0b563b5
SHA51235f8891f0685bbe15c6ad0449c71299029a7579033cb7155029ffd8d4ef2f48b16c5238eeac54e850bbfcbe97c7ae84e79d721575d1335236dcbd3e09c818ef2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD522ace799517dc1baffdda1648fd981cc
SHA1069ac3beed50949cb0109845c91609004ea69bf6
SHA2568b2728052f1c9e6c3caef66f86f92c179698509ff6f6113adb691b8070084a78
SHA5124e349ab8ab7df5e4b71415517c4b830ebca743969987d29b73a7d516a3ebf87c3988e08a4d715f5071a1f083388eb90cb7e84590391076d8ec4a955cc51e55cc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5949fe7d24eac6bacf2d6b111dd3ff10b
SHA1f9c317de92faafcf4bbfa5a58a0dd710f3284598
SHA2565b8c7e850c6c7fd9ab6161363ec2ee4a35a3257cb298e00f9d78e8e3ab3e6ad6
SHA5123790351e09f3003c2d218c85d13a4bbf9dd0737bb8bcf3e1ef5264324ac681bb833deffa942fc663a1bd30f11d3a2880262cb07b0f20d2bd1604331deb5dbf7e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD534a2087e5508bc645db3df4465126dd0
SHA1a2df5c3e2b9b3e40e0bb5e9c7bf25f3d4cca40f5
SHA256069130ffdac959b837e0e782937caf7773cc5d536c82ef2e500a3609046ace8d
SHA5126c107a6fbf634d0a803a1fee136c950b05682862bb0f0a85ee15b99b3d5f7cafff2b1079aaaabf7e9a8ef598b4d48327518750c8404a9544f56c1dc518451a14
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53eb744daa99ecea39c088b9854cbe1b0
SHA18d1df020b509028dde00c5635c924feebc6846fc
SHA25626f8ee84639bed234c14d28e83191fe8de2c5c0c911a0db73cd1688c3ed8a095
SHA51234c6247d33ab76e4a231f5a296308f7421ecc54755a2b556fe2a6c72100d2ca0eb6931c95efbfd806d71a27c389adea0a7addc897a85f8f47609a1214e1ca083
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54769878da449d6a54b0fedeed8b077ec
SHA19a2a3baa6bb7f846a3a577b80d934ff30ad86b21
SHA256231b03cd694095ece361943f03067aeb32aef36f3e8861b4a268c12ef8e1a6e0
SHA512386e47dbcdefd4a0fbd9e04b6e963ef2c371537f60413fc4d3e4d1d3b6b46618f6342d36eb7e0e5595d7fd3f459011199ddf2096f5ba29de2550631b91a29aae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD545f1422ff9541f7935a734b14b085921
SHA1d06b9040b0c539153bbf5d04e38fc3b303f4aa34
SHA25610e689b7c4ef09151e1fcd1d924a60332df7da8e30716b6009edf86b8f6953dc
SHA512aaf793c283e6b5bc3e04d3e464ce0b1349cd4b99fd1e014b1cb6efcfade574c6a57cc7840c220f219b6017ab211cc3a6b317096eb9c93dd3b067aac74ec3b9ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c0e9c21178d3d5e72554a8c2a0aed0d1
SHA118efed860b723547d03ae55cb4b7010c01272691
SHA25608b0ea3eda9161297bef0394b81bbd7a74cb687a4d9e8d60db2cd9c595f237c8
SHA51277ce6ae48886453e1bbc34eb4ffe7596b7e640ba9a1de7aad1a2d9361e5d72c18e1e59afa1e479155ff5045ad761028cb0f52b4480c62a1f8c28f613a139e4e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5452f9d9cd3ba5e52292938b329594b97
SHA1629a92297b2fa77d3063e6b5ec47ab50666f3616
SHA256f63150562132b5fa01970df2104ff7dcab66736c136f5baf9f5405b083aa42da
SHA5124c32ef60670ee68c25b45c7515fd393b23632e498352900f933ed7f594410058f179c7aa3e330f4eb054a2acee9629651a544450878436cd2914a03d426dc71f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5488a78fe33601ffb4586fe08043ed0ec
SHA17890ee5febc219ea1e7b8a986f7f0c9472076004
SHA256e2b76ad0052d84f620b870a394b3049615e082b828a695c6d598ebccba6522cc
SHA512ef78aed9be62103be064cc9494232a17c18884819751337d74650a8b05cb93e84951fc2e7727d7c5a94ceb607ffb404f43bac22796a1d9d00f8a7ffb2ce05505
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aeec19e1775b91297319cdce2cd85dbc
SHA1a0fad6ce83baec36a8ec6ec3cde150a9d4f7b213
SHA256cc108873a45d69770227953c6d3d6b6ed172331c26446096c6b062d5f5009b56
SHA512b92544d543cbf732b97de7f3e524fc2534a84ab60a7134c229aafb7b204e9521fcd85749a3846919ed2892f2c912a43b8584653678ebfcd0cc124a6d4b671a07
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5db14aab4c08df4bd4743e30691c5b54a
SHA1b83afae624046bf781884822e8bbcbca548c2ff2
SHA256ffb3f48d4262b56c375440ce9bd6bb816c053a99260b4d234fbcdef91f7b3831
SHA512311b59ffc541da254e5e052b5ec0b4c7dcb30dac581baa779a13dfb2f56d5d733d97aefdaef2298ab45dbf607b606907c25de34f9f92a4a0a2ae5a1fef74d2c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55d8b685c79cd952c2931fac1a35c5cb3
SHA1776d8c8274658c1a5997e8b477d093b25fffca8c
SHA256c414e53947c101087f7c70fa544ddd7cc3c90474ccaf98a9aa9079f3c232d30f
SHA5125dbe92fef5573bd2e839946d30693331c9e8c34c02b0b3252dde20a6122de9bf2a54338154dc71b0b61baad900169433ca9206997a426d0aa9c70d4961819f8d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a97ca92d45a7164c181cc128ddcab464
SHA15c28764187af5e9ac9a4708e9313e3455bb023fb
SHA256c7c01ef020b6e909ebb0c1feda7990b1acc9d6cb675361be669d78d8aaa43b72
SHA512c5f41ee2ec04688eee7dcdd91dcbb581880ff7ddb69e5f5b84361542348e2aee04f63648a3fe0b3b375e49d41868fa093f43787767ff231d4fedb2d51021ddd0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bef60432c49133862db87175a7593cc2
SHA12cb1d8f5cc65c1910c0145f90364cab39179fc68
SHA256751b3334530b60df6d68dc266d08340bcd6a74c2fb80c70d7514b778c2f5580e
SHA5121b58880f08919b946a320263ddb80cae8dc2f047d68e3f8bd8f8c7f78a3cfc0b5b529db364e9bcff85898e4c97cc03889020002ca7e5437504581e1bda04f75d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56b18a3e75a9bad503aeef3c19312b1ef
SHA1539f9a3c04c401a738b35e148182f2262ad7daaa
SHA2566d31133048dfb6a3c1426896a966770d4ff0a06e16e2d74f8a2c7963a0c8f1d2
SHA5120aa923f248555a71681ab49df5a3273bd3345531463069437a88d7a44bfae60c2580e60c625d19ffe10ed894fb8efa81e6ac8580c97258c7c5f906404894b9da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53f5f8f884d305f161986a3a949b4d066
SHA18f55e6e0bbc1733b388733d0cc6008248e4941d7
SHA256ed5c4e2c0afa3f6b46dadaf4c9d88f69f8f4e618d9ca2ea2e51f7d62bb1981d3
SHA5124476a4eb7b674899fe457c6c1f3df2693a08797a4d17fb151d56f22fa9b0e2b756abbf579e83118c49b0b77b665b43b9b028b0d0da7c8c724494321bf084d25b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f63c7c4e752b70073c18551c0bc75cb9
SHA10a55c7efe57ab9c432a6b17b49e94182122b276b
SHA256917e4d73bca5cb1d31fbe38fcf0dc66080870c67aef26e9eb68f0d67c65e03c7
SHA51238a4c8f3be1acc7362d7bfd3cf163a981394c5e00076fda896492572c9047660207dcfb43557fda0ba29914f44f875405f8e32d6aec72a1b85095d4632611031
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55c8753996cfc68df318ed7584e9bfd9d
SHA107ad975098c5eda2c1bc9525b0c06c762d4a89a8
SHA25696dd860ac0b8dfbd4fa520c06427d3a4ce963ca2c688543c7594934fb6466e5e
SHA512f1f6ba3fa1f9b08892f63b5dd5ecffb8e5da8d51e8e6b366a00ab055159dbfc30bb909d09908491376adb66ffe9dc5c98f2a803337bfc87cd39e66953337acfe
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b