Analysis
-
max time kernel
147s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
13/07/2024, 21:15
Static task
static1
Behavioral task
behavioral1
Sample
435d8d4d39728f80dae1132e29237fa7_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
435d8d4d39728f80dae1132e29237fa7_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
435d8d4d39728f80dae1132e29237fa7_JaffaCakes118.html
-
Size
31KB
-
MD5
435d8d4d39728f80dae1132e29237fa7
-
SHA1
9e876c79558bc8aceeb3c0e3d6c2bb03efeb3f38
-
SHA256
2db293010f5e9c773ea9a6a9c9b30957371ed2ac13f6f123132752307616f836
-
SHA512
167b909c7a9500cc91985affd182f56ebe2c296c814bf257ebc26e325b4db4796d956e0f15e6a6270c6dd58f5e8ddca976932e190ceb099149b01e1f30598700
-
SSDEEP
384:rPlIc2t04xfGTHe3UGOOtz9utTGNfkZORrUtSuxyhkxvjpJc0/gbpLOXguLZ:ws4rwyGg9ExLZ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1083931c6ad5da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf710000000002000000000010660000000100002000000060e58621ee31b155e7d0c4145a76608c0377c66cc1c36d584b7f3aaa85fb965e000000000e8000000002000020000000fb1666889102434e75d8ccea88d31b954a4afd89ac4c626446d1ee690f927c6890000000c291e64aaa64a8d0d82e9426166f9f849c8e15389b32fece448a1b4de3e35d7eff7df6e6978779642163548b939307e6335af0c24c2972a17dfc3afb9dd0042e005b3df6a30ee5d92d35f5b7dad0468adb659aaacdeab515282b028bcbecf535a70f4c55dbadc0cd8c633c097c9e12b2d19f6efd52bd9ace73e8aab78fd62c9bbcb278be35ba2e5d0a5f36fd0875c05c40000000fa174f485f5b45df732cbae6aced0a581f1ac17e4381ab76b5394c64968bc9d26cbaff667c02d3baddc7717e74f7294e8c70494c8fc37cf0e92230f5e3f3419e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427067188" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf7100000000020000000000106600000001000020000000c8f6e041a7ee1d5f56d77cf8dd4f1254f8fef23e43169e77f285da17620c5db2000000000e800000000200002000000018389f4c26ae31b085da4c04f97703e6915f6f19041e4436dd2c028c6be5339a20000000c93938eab54a5bb3aef1abd0937568a5c60ddc399e73efeda33dd793fc045522400000001b4906392d582bbe86f2ded4efd8cd6a168400a89afcd7d609b8ba0f37949f18c74901a44c1223b76d7a7f1564a56576e44db821615fd8d3209cc35b0cb56010 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{029BF551-415D-11EF-9449-66F7CEAD1BEF} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2320 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2320 iexplore.exe 2320 iexplore.exe 3048 IEXPLORE.EXE 3048 IEXPLORE.EXE 3048 IEXPLORE.EXE 3048 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2320 wrote to memory of 3048 2320 iexplore.exe 29 PID 2320 wrote to memory of 3048 2320 iexplore.exe 29 PID 2320 wrote to memory of 3048 2320 iexplore.exe 29 PID 2320 wrote to memory of 3048 2320 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\435d8d4d39728f80dae1132e29237fa7_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2320 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3048
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5591543dbf646ed4c4e5459b8e7a4579b
SHA1070082911bff1781849af804dc25b25c8183ff8f
SHA256fb205302e75084037b36e9576349d7534f2e24519f92e064c5bb4673a06cda57
SHA512cea3b63f0b377dbcff46c792aa96afdb334ec09a796b4bc536d0dc622f82f692b211a858f30f461b391991695e7f8c7b8a390c63502e374ec3ea5c2d7ec6823b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD531928d88b17111d9f80ef9b1c3219192
SHA17bc99534e727ae8a41047ad0add6fb1a96188739
SHA25630a81b39111996c21d9417816c95cabc5e8e81c53112f431b8f4da6a4f2617a4
SHA512d3193341f8e2aa3454db83a41cf646c45068fbddabf9ce638d66af32b9311467afd0962e3b980721eb655a9e5e403e8ccf006457e00f5d2c61c22b6bd93289d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD529f58dcd050138ea0e1137c4a0d6754c
SHA1730c40bd40aa57ed6be35121dbee337d645a9e2e
SHA256b6f3f5b92e097a7a7ee5c99df5bbae6b0dac7e1b7a030dbc6aff777b73e6e025
SHA512a8d4389b440e2e010f6549feac603f85e55c4e854d8b6ebea6935a2e7cbcaf495b803ac98ec8a2b36196137b87bb615599d8e69ec4739ccc22937984d7b88437
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51d57b1f70daa4815ad96a6e73a6f4712
SHA15b09d378ef5ad90b70fa80b492464f096248993a
SHA256a5fae2b9afa54951b84848c0224b2c20bd8ee7dc4b7e819ff4e8156304331684
SHA512989981fd8f40795109272af8a9b0b882ed2f862658aee7d8c93b14fa2098e0416fee877c7041db216103934b5b04bed0ac93384d039791e2d73b9755e29dcfa9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5acdd6428ba21da7b2464ef6db01744e8
SHA1a7a56a8297b5ad49c96ebeef2eb029f450cb810f
SHA256d645c1a783471ea9e1f70763c03247e2d01444dc2e5939403bd9caae98756577
SHA512580524213e39248c0b8f610685a74c95a743f4fa018af5616cef2f2b38339e05fcd6b8b6cd101038baeacb6d2621eeb3f92e954d4d1847ac4f185d36a447e97e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5db44b9f643feb3fb92258b3fc153c02c
SHA1f483d01f459a46aefd2d37bbb37b4591fa417520
SHA2568458c91a10f0531dd1abe89a6e137b536d4211d94dfe995e49474b1c916ed187
SHA51257be720c6f6aa8e863149cd1f09b559f98de796561d3aca3842e402a70072406e510ff179687b92f3937ebda2b8aede05e18bf787e8820d502251d08c0069583
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a618afab4d4e1779e2fc6555dd85b546
SHA1cfb17d538e2a919a9047382840d9d0224a5d59fe
SHA256e42983a23b9d25acb7e071133ca92660cd7e3a28de413f9067d4aeada7f14db2
SHA51262d9e8a4f3e3080298009986f1d0e5e56f56356f5fe9e835082c2f05d943278923be17aaee9cac5ad7265a6606879b7ab98edca99a3b01f48e899d34e7f7e7f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e2651e42a6e75855eee1d5673a75b3c5
SHA1493c85d6a72cc9786a05a131c0d0ae08318b06b5
SHA256a66c5e5172f29ed4408c5ab089e5b90e1701e1ff1e0468ec2695b8c33cd11320
SHA512548467f4e6665ff90a66c056e2bb135163864a886e767639c091a092ba6e4e18bac03ba5009fb776b5c23c84f563bce806b8327ce9282c817c4ffa4648e219d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD554d69e78ff1afaf545bc95609f7bd2c3
SHA19eb1a50d10f893a1ad31e76ac3ee0e9996880ec3
SHA256ae92d9929bc48394f4d477792fbccc6389bcde6f55f835db1cce7f8174a0b70e
SHA51293e3f04023c934a4d12a0f58db193fd9aff79c99caf31fb26085bc437f07b1d97fe6f30fed272e58b8e7cf3d2a081a13b3828024db4342ee2183daac34b01557
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55ca5026df87d24fab7c7e3fcbdd14216
SHA1126af73f3f72bc36c3bb2501bb601c007c1eab1b
SHA256c91f22e1e2f75ec9054551caed8e79660f49b87a8afb7c83e65495cbad98360c
SHA5124cc08fc3a87c9762b4435df1ea379353b8556d5ffd3ffb345c9db2fabc96f955565428566a11e91315b639e14532b1cddccfcdfeed17953bdba3192ffc39ba70
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d9ef571ed97b9ce812f708b0773f329f
SHA14c1d25147eeabe8c23b4132749ac434273d419bb
SHA256cbf47147791ed76c4ec8f0de085d24dfa396f8efc54e9602837cfb1695a62bc6
SHA512248496d6dfe3b3706b45e9cb381937133726a34f909e4052b86a833fd07a59d62bdbac3e81cd8cd2bd344c73dff8bb2548e78f36ff213223b14f0983453894c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52eb634850f962bce1701dc243d3ee0cf
SHA156a05209a7235856ffc71df2d911e514f5c87926
SHA2561775eb9ca43899a51a99ac7d204fae2d02abc143b155688ed0aed1c8b8c14d30
SHA5124ed1d0ad984b30924e1817b42526c965bedefd1beaafcc64872f5d7420e7fb9b8987a019e24ee765935f677d97630c3a681c9b7449570116341eeba5c1fe9ba2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5204d7fe52c82f8a534c83fec04dafbc4
SHA10ca54b6e893173bcbadbc8de3f49ae4ed76c9636
SHA2560ad0b90827ba86d24504dec31b2544667aeecfc1313061b49027f0f3ccf785bc
SHA512934d8318d04f3c4d4b1e98e704dead0e867ae61fe1f4fa1e44ad2691f37f9364ea8867be789e553d7c96a3906a48a0a451059103bf284992f1e1906be5792f2b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55a9d16eee8bb7be7529b1841b2ba0e39
SHA1d044ddf3c9530c2e440c7db7a0134a0b0de0e15d
SHA256383a72515774f9eafde5976adb7bab036073bfa0634a6da05b2c77f8847bd522
SHA512ad0d177f3fb6a50391049c1f4d6587e4b0190bbf6a69a4e297f22a3789e9ab2cacaf60ff6cf90e4df5738e81960ba28ca384831e827d909d46b3801bb4cd6ed6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD571dfc59555b24d43daf6e09f5c6511b0
SHA19ea305a0e718ec5405d632f8eb7cca441c574407
SHA256a21c27778c9c223a5f850a54956ec395773b47c895490dca626142b839ea715c
SHA512fb191235e3b8946b5c8ef33f8951f5cb0c89b85777fd7ef57f1a3490509e0e8f7d946b63d682cb5893ccfaec6ac8d83997ffe84769a157c04182ddd924005fdd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53168a23402ec79175237f7512b6bcbb1
SHA103c318462264c3e6de2cd658f2f5fc897d81dd90
SHA2560388c79d14d7e0b46e53349d63e93159e6d74ba2bd6b1e14f67039dfecf94a9d
SHA51274da0523d4e43fb926b8d869aa8ec534d1b34eeb0dce54da15eb1430b9aae6cc02e74c62e53a757b65c4c375a6f90eb562216906fce72382db3bc66e0d9edb0b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a4753b1cefc42b20fddd025750ce85a1
SHA1a1bdc5d10050c0385eab6305cb140b0159187fa7
SHA2569f75b83589dcb965777453aedff1a0ad34cff7d10110107801a46efe3e878452
SHA5127d57d785b12caba725b0eb91b67bd74fac76f6727ed4e54dc5bebef1804ad9577df0f7922e54fa320cb2b2d2e388d427077cf4608adab654c99683b918ea2275
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56b93550ca8f2a95048762f31ca05a96f
SHA1abe848a03ceb4385c1ffd54c97076dec1837d95f
SHA25651ef6f6b2025da8c7eeb3ca3c9c54622e1e4081b664f4a43fc689b855642554f
SHA512059c3406acc9dcf56f0ddd57b598f058695211455da89a9cc97598dd663a492e0a0d9adc5ae56ec31c3b14a2a731fa7be678c9e8317f709162a3172797c537d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ab24898531c162e25a0606df6901573d
SHA12dc421136dcb8dccc44c77427f32918b4d405185
SHA256cac41a4d15c5203a30a9fdd2d34cf8c58e372d98828cdaed08a4d75cd589c55a
SHA5123ca224b9f74286eeff529b37657cb805a810b5415267251a134387d62dbe73c1e3ea06dc6bc687bc0d049556c3a3cc1c977dcf9be00371ed10d5d784fa513682
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b