Analysis
-
max time kernel
122s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
13/07/2024, 18:59
Static task
static1
Behavioral task
behavioral1
Sample
42f0c284001ffafe4956adfd0890ba5e_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
42f0c284001ffafe4956adfd0890ba5e_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
42f0c284001ffafe4956adfd0890ba5e_JaffaCakes118.html
-
Size
910B
-
MD5
42f0c284001ffafe4956adfd0890ba5e
-
SHA1
381aad046b3064d945c09087d89c9f23eac4bfe7
-
SHA256
a84486b3866c77d014627793ff47a509d2f2cb1628a0bd059bfa9173afd1576a
-
SHA512
31e0782bb6af9434a72f5973b7132636a7fc285faa1aa5d679a3b4edcab8e622c917be8022cc67de9ce9822b37b393fb35a8715a9cbe3a1cdd23dba1e8a1e36b
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00e9d5ce56d5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f0000000002000000000010660000000100002000000046c651f31124f3183393bd4ebccfa3366d8edb8da636da8ab846fd7a1e0e36d3000000000e8000000002000020000000205f89ad8c31b8824d5cd81cc6fefa3f2c4e249f01612c2bbb1724b3ac730bcc900000002d860b83690355947183afdfc53f38cab3d64cec4f2d2363f4e714361aa1e016d64138d738a9c606dd724210b471c39ac81b3471834016fca7ce80aa0312f1144ae643ff04cf7a8e177fda242c396397b38c3d82ba4073f8720bcdce59545a73d115ef0392f9e0b05c25036a65af656629bcbf9d8f101b46c76a48635117c9aaf3517bab12b2a7bd5ba5df71ea0fc1b540000000af2b123b4db893d882d2e6740c16c1755e46a703dcad2c1125139f71a4889e568604cd4128e07f3d856fec4dcc8cea92586fc61833ee4f0a7a5519e41f352a28 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F8B2CC21-4149-11EF-8153-46FE39DD2993} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427059011" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f0000000002000000000010660000000100002000000085fd35f8ae9da4dccf919677cf41c27ddebb8242c7d14442f3b806eee65a5c0e000000000e8000000002000020000000a81164c9333977282d90c2c078edb09f8f038e3a909f1918801b32d09ada555b20000000daa17ddca9a6bfeac4efe17ba386ec28410eb7a2c3f336084a6f6d85b3f09ff240000000362e9cb392fb6765ac77282c40800024219134d3c476934648250a6b8d1e7a8ba9dbf4b734c461ae053aad6cedcbc2893efaa001296e9d7cf79641aba3630a69 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3016 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3016 iexplore.exe 3016 iexplore.exe 1032 IEXPLORE.EXE 1032 IEXPLORE.EXE 1032 IEXPLORE.EXE 1032 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3016 wrote to memory of 1032 3016 iexplore.exe 30 PID 3016 wrote to memory of 1032 3016 iexplore.exe 30 PID 3016 wrote to memory of 1032 3016 iexplore.exe 30 PID 3016 wrote to memory of 1032 3016 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\42f0c284001ffafe4956adfd0890ba5e_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3016 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1032
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c3559fb6b085e4177715f4236434b92e
SHA1e49841455b7128b82f2c856e85040eab16b893bb
SHA256a2201f3042cfaf04e3cf655e4052f8982b004460e96ad28ac4f363e194d4a009
SHA5129de4130949698a8eda6ad7ef260261a9ef46177e298ed26517bc69cbf55214585bcc0748d390b1b849893cf45fd104cc90e8871ab657204816deec40ab2308c0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f3242d0bdee74c764760db4701346ba6
SHA117d843ae746528bb63e62fba34089eb9d3f8bc99
SHA256492a55e62bc11aad6ca77a60018709b7dc26dd19797f5d49a6decedc85304c81
SHA512b416bd74ff8d94748dafb1ffd08e791c55424c17861973f8cf7a2a1bffbd1c916bc70f1041cc030409e3fac97b68815697c9f6314346240b965fc6c6c9e60537
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD578a596203d3b12e23e5daa55161628e3
SHA179409f4fccf9d466a7804ed94281c56c9a4dbae9
SHA25682ab74a5a0685c4a369806d211298c48139174534dcdce0dd4212640b5e41d5d
SHA512e2dbee58ff042de05b0f8e15f12281258d620a6fb2bf5cf16b8de5574ee518906c5a2deeff5321c26b37b8efa4d3b375db2503b3c63dfdfd5c72c372e418d175
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50977f77812bd5a80c64302f12bcbb0d5
SHA14c362f5df51cd9f75255d9babaf4f21daa049bc3
SHA256ecfcecbe6379d1b47252dad19dea1120b625e186c1b292473788c96c76ab9cf8
SHA512a7271a120f0c85c5c94189d42c3cb7d00ecc83c95d5ca030b3e9dd1e74f212dcdce605b2b54e4ed1131067ea8a8452956ce3268658d5b31e2be471acfe1d0f06
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cf777c391febe0d8a4c466de89ff2512
SHA1aa4e279e1cf1afc1d7cc76a4c8a0827f367113e7
SHA25697c9fc75b94d759e7a91eeb30d8563c428c5532600176f273c9228843793e555
SHA512d993eb28a2fcfffabfc8c7983c9a9518b15948f88abd6aa94785e32ffc4744f78fbbdbf84a22d21739a8d09c313c6c79495dd0557de3a38f7784911e6c29fa3d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54a059bbc62cfb08d01cb4d437bc0eba0
SHA17b9c8dc3f4381bf5f92d3e485e1c0b2a350c9f5d
SHA256a88637afc90e64df079c0dc7e43eb1230427c0e955cf3b3bc260c655a62a7b56
SHA512bddb6137c166dafd41e094a3bbf53ca9805a7b6819ada5359293927b23b5d7ec523cbc106b8875b605e6d73a1f838da8cfbed387c748f039efadb9ecc5231c4e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5050a7462903c82efa9bcc68c6d583cc1
SHA1f28e74dd5487355d328dacd38305b5e4de8f0500
SHA25682f81c2769738debdb7839caa0fd1a958863cbbb402e7b9983cbedc357e6be65
SHA5121f0798759c43f751e4f15ae977a1d792cefe4676585e14d58148d427ff6ed5009525a6dbeabcb5df1d9560674e497c8cf325d3af5628fcbac6f78d0ff7de4a94
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b128fbc0388b21b257014fedfb697373
SHA1db680bb2b9608cfabb7af3ab8d2c7148d7e01bdd
SHA2562e8d264f7345106f22efd13faa89a97af69cb1493172b6ad930aa59f77367d0a
SHA5124ac24bda0bcb43ab2534288a9bafe5d1a894e428ae7973bcb48e6eb7a2871568e40d7dae5e43611257b18f78b9cea9881a7c3a8b4956c1debfb9a0b8960ac780
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50a7c95f20423c8e27bb7f49bc812302a
SHA1623afa49d298e61a410f912f9ef472332b8b654e
SHA2569e94e69a2f3d146060b8331acd1766d4afbace449236d9e26e3eb2547b121f61
SHA5126fec5b58c79e9131fc19f5ef598a9850cdb6ee0089168ec2dd9442bf6e999f67c5d7fd36620d2a456fe35c55ac8b1b95f1db0fb87f96291caff3784f35352cac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5066de5e04e2d6587abf470cb0465c08e
SHA11366158feacaa2ea6fc1975beca73a5312cd25cc
SHA256824ea3c40ef01b47eaa867f1d1f4bec2fe62122d45303bee89791e7ba4b1a16c
SHA512cac07bab5cb390f8b13b600dafed84ceaa50cd8d0b858f5d1a64ad65e8b8337a06b985e3ade64d099f9f4b3f2b7bd94bcdfd7db23a5c16e412c3a69529ceac31
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD523b58ae6a2598fc2f4e38798116a4831
SHA1c7c0d9ce589fddea8ae43f57720cddd64e0587ae
SHA256d08a74fa4663eeb069f0253853c648ae3d86ee7227199e3b7ea90978f0bc1ef4
SHA512dfb60662641b52e96deb145c769209ef4ea885765e261615e4c3ca625cc9ee95ab968265dd8f5d8ff1ec58d6f3c52d314189e2b1d5c20bce729b71d0a8c463bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dc163b251a404f79040d9f3c672516ea
SHA1f4975ce17f80915b157c47a7357cdfb238c24ce1
SHA2560379786744d1555dff68e306e1c702255c847ff530a3a2b25a069b2107ea70bf
SHA512eb7b568596bbcd578a306572ff60f363029a98e15687b63a9c6696e0d282a5ddd4562f6f6fe5f885bbcccad43cd252c1bbe37cf8240337a4374f6ee5a11024bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56de02b91c9a2177fdac23526aece4b89
SHA1bffaba973eaaa24c1cbf89c83617ca65da1e7346
SHA256d5645ff0c596fb21414c1e6739c702b2536317f530cfea835ddd5c7d2abcfb5b
SHA512763e95f59390563da6d9d92305a6ee0877ab22cc5562609b5343df1b381d011486371af4824f515b307d89b02f91ef91d1022fa7351501cfa419283f446caaa9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52782b8683e3b9bbd21af453a54863c4c
SHA11198bb18a474144538c74617c5222d6a3e2fb60b
SHA256b4996bc6f48c2dbd8877e27a2b2702cde0f8263b6879ce90f6db23741c19e3c1
SHA512de4b9f7edb0a41d494ea339b17f9e5ef7dd2f892ed1969b39f2fc6ff8de78d6a9911154544cd701519323e2929fe8db991d4b1119b5affdc50227258c23ac990
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5764c0ab7fa127bd775f8a47343fe78c6
SHA1fbe8eff5ea9f548f9502251bf96e6fecde731a83
SHA2561d1aa45bf7ca504d17e9f2f20c51b3a33142db2f68dab6bb3847d30cdea3b02e
SHA512bf60bed44cc8b19e182e6b45e432ab7d7873bdd74a702c040d5a17f956e6b8bd7e0d3d7b07c82153eabeb2ae99ea9e76f81a220124588ab2e8fa5796b70abd7f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54c626defe06ab08e3a6eefb604d3b498
SHA14b3cc5efdfb6ed0d48291cb0fd778059339ef43e
SHA256544ee97a362d41d1df76a5e8eef59de9fe5432d53340b42ac18f6e173e6a6e8c
SHA51214af835da1070fb9e48572e5fdac752a2ebceca3f0ea5495fe8b11cf546ab1e40f99912c050e580f26f89d8b6184a2e1751b2b73358c1b74965e44b14bcf2df6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55d3c8d7546edacc4c38d92d23a0665d6
SHA1b53767a0b420e8842bd88cf4d00819afd4519e5e
SHA256033518af1748ad373ae331a5a43d6af4f56ffea38e217350b14203b5a29f490a
SHA512181898a1613fa78f732ee928f4180509bede2ba080a4a56fc698c443c3595db163b08ad23928e32e3533f36eb5d208dfcb18876a6ad36e2c41effeee5fec2e37
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59a1231b1d0a7fb203e832ecd3405fe0a
SHA149dbc769964680973bf9cb61929ada5c491143bb
SHA25679e85b2d3bcd8d98aa8edcd4953255adb3f33f26ee5209fbce7ed8e812c4004e
SHA512a1b8025b6ac48a9f23e9228ecaf0a5f3422292d61b557b1c46ace8dd592ccf387273809a5893ab81b2c537368716e3b2d9cb5a4a09f0cc19fc6831de64035fd9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5781cac7ec09af16055d6824cce4adb23
SHA104e2644a8b06f159beecdb8fbb2c71ff44ebfca5
SHA2564722886d1b02c7a97e2632765b67b23941062ca1d46da5ed3f21b45521819d24
SHA512603a4a665658b8a237affea71949bbdf1b44f9c3f506c8ca19e8e934395d8b77cffd1c10b1c0e7181eb83afa1f59861e631a025452f4119968e964c1dd2e4b73
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b