Analysis
-
max time kernel
119s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
13/07/2024, 19:41
Static task
static1
Behavioral task
behavioral1
Sample
4313fcf44c334383a388afa3a5ea42cb_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
4313fcf44c334383a388afa3a5ea42cb_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
4313fcf44c334383a388afa3a5ea42cb_JaffaCakes118.html
-
Size
70KB
-
MD5
4313fcf44c334383a388afa3a5ea42cb
-
SHA1
6c8ff93b9be29418b2621d3674c4beeed3c8da54
-
SHA256
16663097a9ed3c1fb9b4be41319b150e742d98a81d3bcd6ed93da7d2cde2e6a4
-
SHA512
0889bc8be600c61a3145a4c500c0ee174fca6f430bfe31ba3281ee8e3515904ce8dfda9f99c0481a5519dea5e9158dc278dd409e46becee58f98664eede64b0f
-
SSDEEP
384:vKD0blfkuuuqElvZ/14URMNbAeI/VHWqb9yRV8uXa+sh9nVdgOY4C73Ig0K:75f/ZN4U6bAeaVHWW9yf8vNK
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0054ac95cd5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F061DD31-414F-11EF-80BD-DAEE53C76889} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000fbe9ac8cab700d2f7545c79d3e73dd9f7f2c853a1f0654254d7693c10151128b000000000e80000000020000200000003bdd7b749ecd58ec01265a5b541e638956c40e97a41f482d552fd630cc36afc69000000084d6f96a35a129a35aa7f0f1423a51f60e2bc93df5b79809833ffc6a896d87a65aea15b2c77fd4c9ecf83b5445d333b60a4c3f9c719a92d5eaceb77016e6fccc5510b03072afce4dc3535dd15fbe9b48537141e02f71c1d4d006d76ed2721d10bf1a90a251e5182c54dea5129b00992fd733d2f6a2e1f797b13bfdc988c10ec3fde76420aeb6a975ab34a5ca28d40bbc4000000002d1bac86a06d5842da92834b7efee401d070192226182a89f7b2fc933ff6c95848be9bc298392bf43e747beba2b8d136aaf6d49c4449825db6587203b0d2519 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427061574" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000887e3cf8cbe261a23f3e0c188340d92ab9fe51108fa79805bddcab98391f7b05000000000e8000000002000020000000e9b93666251349d39fb0766e23a637586feb5ad56c7bc641ee4573724e013c8220000000ae5045c4ca59ffa01c4c005f801a73664a4f271d15a20f36bed0c6783e6ed187400000000addddda62265222b618846956c4839f754b8b30e2b3c98516737f7028e01100fe91a7e0411e007daf766493c0a3fdc9f042b599447737878c4ba7e0ee1e7387 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2092 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2092 iexplore.exe 2092 iexplore.exe 2952 IEXPLORE.EXE 2952 IEXPLORE.EXE 2952 IEXPLORE.EXE 2952 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2092 wrote to memory of 2952 2092 iexplore.exe 30 PID 2092 wrote to memory of 2952 2092 iexplore.exe 30 PID 2092 wrote to memory of 2952 2092 iexplore.exe 30 PID 2092 wrote to memory of 2952 2092 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4313fcf44c334383a388afa3a5ea42cb_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2092 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2952
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD511aaeae184f3242cb29afb403ae01c75
SHA1b184a4ef8c7da9de87d79cae5685b2e64c923e27
SHA256ba48de220964efd22a2a4d61a4d52801bd94ac4bc4f52f19388f533152ef313a
SHA512e301c45ec3d345425baa875db0e97478cc4cb349772cdad24c21fbe6d97072866bbdce72ffa988a972c979476ed288db50dc95bef60b1167b0b9e5b19a4cbb85
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52a735208fe7a7821a302c8993078c5d5
SHA109630c11c74adeb94eef49740e20b8b43339fde1
SHA2565c1fce7f1d512a17a84b78e40d4e53c37bd0bc46c1cbb215079665bd52c065bb
SHA512a12b087f6b6e55ab4b60f852af639d2f7cc1014e74c4745ad26f927e0715593dc0e2696a0de768b9c5fa586a6ad5d5cbcfd80e401419556763e57530ba08d8d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58031eec5a9084f8886d8b439a4267979
SHA10a95f7b08fcfdcacc3d2b7cc9b4151538182c53f
SHA256ac06b886074dc711dcfabd161296f66a97195c153af5dfe43f4cacdfa9dce592
SHA51280744a5e6d0d156e2f9b84794b08934510a23281f5df6fc8bdb787d19aaef37653207a3359238c571c159f9a8fa56e2fbc6b1e388c6aac715c5c26616bcfe6f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD515d8f0c953230aff6b4c90d117b9151e
SHA16b9c17aa8efefa03ace0c9dac9018af986839c86
SHA25671ba4928dacab54a59baf68dbdcaab3581655ed5a95b262c6c31b3724b1d3b17
SHA51206359c4ec3cafc2d2f8199dcd9dfeea7a532ace980ef3d12f83a99623660ec4b2a67e71a069f28af4b8af2f1a360cd362742cb99690b9fa17b81e6d2c4eca83f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d76901e98348846d2088994ce803e00c
SHA149007f2b22ddab232d80005ea29030eb0f763794
SHA256b6b0cb96ac712678ba867b0cf33fed31ae9bfd5d6b953d32ff97e2c7b273c4d8
SHA512acc132816b002f7d890e17444d803a596b98e8915a93fa3f38fc585b74976a2711da62865236a24b8022e3043f8d6e892820dc328c80abfd862ce27a5ada5a14
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e2cec165fb797765bd7b7747315775cd
SHA10739964f7cb90e4e4a9ef36f10793c8668da06e0
SHA256effc356cadf0ea98e381666b0115e5669847cb35312d891a09ac8c165476fa58
SHA512541d842b4555eea05560fb0af4721c4b9c1f01a4cfa12ea31adea2c22c754e78f7d8926920daf69d28d93e24885c33c24c73009b7a814f18f1138d5615454a14
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56b4c7ad8ef8802cc54fa68fb69807b57
SHA1a984dc05b2716e6634520065c860eb0048622128
SHA25666c86ece86385bd33294ad8422d2753168a8ce25460f3bd73344c2519d0f7582
SHA5126ebb9f5d94241b33e109b62e6c2bc480401466d17efabac77f55762f604226d380d7c8378ce225116e967e8f2e615c4392314e58f4632bf47e0315c2492e539e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c9229cfdadcda10998162237c6209f6d
SHA1596d5e8981be88291a5005e04fa5a3fa592d89c7
SHA256c3316169bc6a8ecf79f7fc118de0467ce3ee45bcdedb06b72ed95b7219745cad
SHA5126902747067c6f614bd0370aed809838a1b6177c98a66abc6a49cbd5a5aefdb32a660d2f96967f6c8ccb8b8a8d898ecaa5e77551672b6425327f563c227342956
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bc55acfb1331a55c15483ccb8109d492
SHA19e4a96d32ff9ec29ac8ad6173b12e7c44b711af2
SHA2565af7f0aa0ad636d2f0431b35fe88a11292f7b953210ac7fb03a8ca7b2e7e4b84
SHA5123a5a5d5c7c971202c78cfa9162050750a257d3b9b5e29c7342f1c07cde3bf266053c0d55d64e24929eb5a2c43ebd802978767abb391e5723265d78a0214da16f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51040968704e044402746f5b7cbc5bee2
SHA134cc97fb5a52f9ee68e22bbb666bfc84598c8204
SHA256cd444a89138fd9bd28a568247f719aa94dc53e6313675492e03ab6ade05c061a
SHA5120eae301366b3f179b7d00f1cf2222fd18af08d2c5a6fd4d5d2df5a9d733dc0de8925692ae81f0c19fc62bda73a2e72f6d7540aaaed46717d01c274d9c6630e31
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56083482cef85c92498f7321766958b34
SHA17f1463ab9826dda7e7d147090bcb57b068ba2fd0
SHA25670a935d87ea7d7825b222a10da0cf57e1dbb4aa7901325e014db5b46c675c737
SHA512969615cac1918c581522210fac5982bfde6ea3069bfe8cd0a66fa0ad681764692213ac16e434bace10c739811f698f0a614f3a64a7a8de5c40103e9341c115c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aae52425ce7fe352b2573ef6d3ce8e56
SHA13e6197e18a756177a3194093decce59204601652
SHA256580c4b01ed01bb74b7c545c64fd2fd9f2d477fd35be6ae950715ab8ee023809c
SHA512300ae7738875e5159bff735a9640ac80c3213c592dbf84ef099dd34332f4c13f97e6649e9d21bf48b2f078cc3f6336f43bb707d74fd9b72683f7ffaa70d4e432
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5192147f8b5af42bc488a65ca44312696
SHA1f6f428fc74ebe9190f0e29d026d073caa824e386
SHA256271239661eebdb611ab01d37dda9328dec228c343b5d2edf6e0893276033324b
SHA512a739304cde4ea17fc3e9947d75398a7d9f6d0dce3d32f4fedd63a5bc7f519cf1a54c41362db126f554ad607ca655b51bcbdd97e96aa14d270ccf9c63c4e2fa68
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d1093a17d6f3174e2e6af0bc0e4dd951
SHA1d3ca38733ca5392cbc2f09d5f88e3c9422b398ad
SHA2566a2f198666a1c1098b43b0c9c35e60cf0f22059f536387fad455ba8e3549c36f
SHA512b57509d61195fd6cb0d649c62ac9bbb14d58ef60d74a8905bb78d69fac7a3837befce7982c992e653aa9929ddc0eb406e86c76cc225ddc5c32c04372b45e5111
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eb4df79aee4d0572971ed45bd15e0e22
SHA1451928777efc0d4ef9407947509854726d18a48b
SHA25631fa6dba1155011c661a2674dcf0f218d9034ba48e2ef939bb0c391a64ddcc6f
SHA512d9ff36517fa5b27e66fae5de73c30fc7374ddfe59cba9ea67c263ede14694936831426e885063c4465dce68dd5d747cce46301842aa0a2f8c88d0c0c0a43cde4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55acd2b781d88535ddf0b9905879850d8
SHA1a56c2a41279aa4f1ee45d8975bea48d353a546f5
SHA256495b7f263692dbb4896db16aa187689ff8054b1cd7e00fd9c42e52f68345f148
SHA51207359b0580f29b2a82c8b676ad3d7be6ccc97849436d2be1877ee7e3a27f9239d82b1f0e4194f18fbac4dc25080bb09bd224e53dcd02aef8fb37e7017f0c6449
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f54374dddb95353f8b3b898f9220fd80
SHA1eff2676a3d47f66897e2a43416be4252dd25a1c0
SHA2562e74de4b161e436073fb0cca555d78449aec767992b6fcd4c23bd329d7226913
SHA5124b1e0aab845cd47e47e40d1daa56b281cafb30cdcaf41f741a9490472c24d8060e5bd1dfd6c6c907fe23655510629253365e7eeac453a2e66f29d54e7ed789b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD524d068c62deb006ae8b3bf6e3d49c739
SHA12cad0bffda673872488918dbf13c2a47dcb49efc
SHA2563c27ed17a67f3b9ebdd4410a1f8216c006f8ef7e8d99c45b9f8857cca7c2872e
SHA512256cd3dd680a04ed551914bdb608efa66850bbf6ff95313cd8dcbc12a4f60024e1a33d93d95003cacc69cbe3c9329d6752559de341a0a523b3f2ec1784c9e8d1
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b