Analysis
-
max time kernel
122s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
14/07/2024, 02:00
Static task
static1
Behavioral task
behavioral1
Sample
43d85b571bdc6c73ee99a9511d0f84c6_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
43d85b571bdc6c73ee99a9511d0f84c6_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
43d85b571bdc6c73ee99a9511d0f84c6_JaffaCakes118.html
-
Size
70KB
-
MD5
43d85b571bdc6c73ee99a9511d0f84c6
-
SHA1
144851ae34873f439797e2cae031d8e1beb3c381
-
SHA256
1771bd66c45713e142a70daa8b881ee69a5696474bd9e9b1afceee810cf3d921
-
SHA512
65b0ca4e565e2acaf88a3cb926dc7a62d809292c5a5fb8b7de685ee9654238f3a9142ae47b5dbf62e6eaf32f7b621cfccda7f275d94fd76aac5796b111458d0a
-
SSDEEP
768:Sk0hqGbIiP//mdvsYSgLj/DVWmTMYq8Dfr7Vq3t40MSxjfLD+PHgkyMrj3DZ+/VQ:SazIk/utnwOHAc8WYQucc
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D722EEB1-4184-11EF-9BD3-424588269AE0} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427084294" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000a1373eb80d4c52c0774ae8bcbe82020e9b3475c1062bfac3cde7561e98be886a000000000e80000000020000200000001f82ec983d60ca0471f565406c3e67aa5ac8e6657bad8d57917d1ffbcad0452e90000000c2145a034e72fcaedb3315b5f5092b39da918368c1141902f992718b4449218441de951bd528915e75d1de50858bd4c71db2b197fd5422797bceb07257a7b75184a0d7827674891da86265a5cdb00a835343f0125ea9b76b03094bf969649e301a8fe4eb1efecdeca2203e306cefbf23bb9467bbaf322457f9102165131bbf816d05980a06da62ccc70d104a5cab98df40000000c6f7a07992db9fa8504f8736141652f37334dfd26b15ae00fc4c47aa18b277b2571bb8a15fc64083cda19b8c123aea68c12b3cb449ba3c55c6695bef033cdca4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000f4bd9fe31567d593bfaa2b0aa49d25af437a5dabb4dfa0379a47de6a71d990fb000000000e8000000002000020000000106e8a2bbbfa13d5928dc156922f32aa4e74511954f11648552951fd0aa381f9200000000231cf34fa2c05b5c341b2e0c14a1088fdb3cf822b849472fc9319c0632875da40000000ff187dc9a178533a8459cffa2a2c780336d7ada434d13d0e06fd308b9b49d96a1112c2b47e2dc5238570e6a72bd773252a2314c0c4edf13ccb309cd93cb99e92 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0d867df91d5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2420 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2420 iexplore.exe 2420 iexplore.exe 2312 IEXPLORE.EXE 2312 IEXPLORE.EXE 2312 IEXPLORE.EXE 2312 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2420 wrote to memory of 2312 2420 iexplore.exe 30 PID 2420 wrote to memory of 2312 2420 iexplore.exe 30 PID 2420 wrote to memory of 2312 2420 iexplore.exe 30 PID 2420 wrote to memory of 2312 2420 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\43d85b571bdc6c73ee99a9511d0f84c6_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2420 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2312
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f52106d4d0ac67b5d04867f189d19ee4
SHA1dba092f3045c6711371f43e5b6e15b3132f79cc5
SHA256e46dc6fdeaab23b3c0599ce1b6785d0b5c95d1fdaedc28791d6da668bb9a19bf
SHA5123ff8ea0f68dcd132ac90a6823e7c1f3456203625f5d8cbddffa89b0c1737010db21e15a81b29eb028b3837ef7cf19459a2ceebf5456ef7b278622150d5d3131d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51eba42747901818b29f1b6f354b9bb4e
SHA1bd6883d511bfb9609255c51ef017aa898d8fe95d
SHA256e9af9a2a73ac3bc8f513550f13e9c3d2b3fa1387288393eaf256515d690d1692
SHA51295ef05d0ad464eadd8679da1e4e35ab293467d0572df385790f056123db6a1d56774332af4a46ee7076fe3067c2b68f5c538a8c8f0fbcd1400a7e1564a365b3a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54115240542a0cdb008c38eeb0c90a7a9
SHA16ebc78cf5cd0d8769bdd4679de28cf2d5bc582b0
SHA25688ed3e89da72ea77a0b9716ac3b4ee0fe386db7aa2d60694a43a702389bb6593
SHA512fdd704c23e67446a191f0b5f4f142c337fa8a7a78f00ae3c96506c6d684a3e56efbbab9327e9b43b69fc18299e0bb32646caaa22ccbd124a5871a41a5ca6c35e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD543ae0527c61f40d5149e761a6d9db3ca
SHA111d52c5e92965004848d14902d826150f6064971
SHA256c8857ff9c5af02e963c245e445fec360325f79584ddc25c4a96b10e4a9d81592
SHA512df37c693910285e886cc34980715a06fe1c3d875c46da2cc517ef0960a75a8e7d7d751d7b26cff84c157157b20470c3caa21f85b2710dadffbc6b648f57ad052
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fd614d37753183dd209079331eb3d4f9
SHA1af9556ab24d023bc5a4e7b1f7c0313512f202bb4
SHA25692f0bc271c21cca8a5b77d07f8f66f441a3b457a305f858af8dc592eacb67dc3
SHA512865f6f980a23f6c935faf1fc076335bbd84ebf7e2ef0c2cb7a44f9bf685b806561edd912649afc801d9328de35c69bca60aad19121c9babaf19416eb0d881875
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55bcdbd9e6f9cddc4729c0e6a67a02d70
SHA186f0ed0bbbf7ed2213fbbe893816a2ff94538c16
SHA256b0e583bb1025869256133ccd358bc2207c6d45f1482371f8cf5caf082e5220de
SHA5128bf88aab4691637523602259b8dc02581474d3c31e69648ff43da077638a522b0a9fa47cc1425611a8aef4902481f0c3bad949412b351b3e41011b94f91875c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f5b7f57bf96702a5a8a7871aeeca83b7
SHA122160e0a4965e9b9a29b8e341f8b646e74560310
SHA25639c65e1a801a0b21996f5c7235c3b99960a9f42926bbc6526eef6245461b9340
SHA5121f6ae09d0668c45d477923a1e6a10620d77a70d4b2fb76a69265e5ebb0b60809863dafd2bb2e0718f48ac0fdfb057de8cd17ba14b1e0303516ed407f3242debd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52dc7944e05cfba1eb1362a08eb4cbd0b
SHA181d3b7e0f8a6988838f08aac28b65cc0c5274b7b
SHA25692db8154e83829f94161e81b7d6c435585a8e1bb195031651bb18aa0e37ee5c4
SHA51276dce8c17e79435e6fc28151594bed4a9b9737fad4c96d09a8b2dc659bc3d89c12c36e7d0246162d394dfa94fbd80d1ba61f8efe488d1e577d3b52c72b9d2efc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD574f0b71be809918e718493e31f48b158
SHA1c29a9e1ad1e080c9bd4bdbf133e8bccc964a1d89
SHA25643de49f130a02084aa8198ae0a21d407961262aebb368fda3c685a48b5720d3e
SHA512bec2cee928df949cd96ee9b90d5fe45f0f3ab73b496ab975bc685ef2d1086cd5ca8a4a328ac0bc29fdfc5e2205f26e7422c5af9aa455fcdc3eb05bc2ae5e9f96
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f441ae835477ad10bb5f8219a4902f9b
SHA107dc4528eb65b842be2298c2f892d01a09d43cdd
SHA25699b52a0d9066cd9cdc3fe48647a8ec893001e34c797397e645e5fae4c901e1b9
SHA512afc54f03c3b08134203da8d329fe06c9bf187ae92da95286b474b5b44fb85b6988a94eef9f00878477bf83db15c74f6f88f634f28647c047c7dd0faabe648233
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58fc05ae28e513123737b4fd75e40e49c
SHA1c1cf85659e5f179ef326ce99d1e397c5f67ab3d6
SHA256cd2a41010599ebc4626bc60c5cbdd3ba73524277bb02b41a73c33be446f10f56
SHA51206109d6a2986636e52900e3d6dd60a0b995613b4f322ea406e8fbf8987508ff297e8bc51b6f12de3ac3d0284bbf80fead690c9fd3af1c44e38388e9da46e1872
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52267ded5d48f1c2e4cf37c3fb31ca988
SHA1cb99ab597765ee36436eec3a34b66ae8d4ba5e09
SHA25652a5ab87d051f8c910c044237262189bda5061193aba314cf2462bd3a58a36cc
SHA512fbf90fcb392af06c48009b25bf8d821983c52f4578bc3b4be86c0a2fdd088ecd13ca4ff145bd6d2d19634a24de3a01c778b29ddbb8641b9f213378458b09eb93
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52936d855c300a7e8e8c453c6d0f13e02
SHA1ea9dc6b9923393b6cdd06655766723a2dc08d901
SHA256685a8bcb27643dd16515711a82ce81ff49d124412ade1107a51f0f3a816c9c6e
SHA5123c0ef517ac5607f53732af34b959b1b67ed32a30d2e31b87d5c3875e48baee4c16bae71e372cd258d3a8c8a72e2ebe645504f4d292f5193766816c471c679cc1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e6ec539c27cf14471c3f7f8d063749cf
SHA13f1e6d97670cefb37d9aad32e7e9cf97dd333fcc
SHA25665360b6f3f4a403f6d8905b04d586d8171894b6d5c01e0fe41bcdb7db0380068
SHA5127b30edb17e789a48ac1bc040c519b3aea2f2cba79eb3abf5ed607fa156757047a930becb9778a3007a2e7e00af0d4db33e4eae496b92b72c72924200b0b9b2b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5129e0869f4486bf0c0d856c0d831eece
SHA10b08af486321464ad039e7b0d39076ff64f5a919
SHA256a0233e860982663ac1e9d6d815484aaa93122fbefce9bd5d3c1596f7f3daf5ee
SHA51225d43f3336042981ecfd8fb8ec59b40f98e10335128c7886c54309218c42ee1a01f388a4f17ff03320e6f7e7cf69ab7d83418bece1244f4bc91d02a3fb3ddc52
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5352f57cd22e249f2476de95db4f1ceb8
SHA10ce7b307071eecf35caade5dc791eb9ee56b825c
SHA2568537f18aa8321b5f24ff7c396067b5ddb9a0e5ae053cd18c6f6a8f145ce7b0a9
SHA51241027c44df042a4ac25b9cc8e3f97d5f7e2730be2e6bf606124887f18714a6776e2f688f43873ea5b195c836d7c1621a992046c1c2a5367ad46e1d4de64fd4c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d607fea5d2b1877c69f72f5706da71e7
SHA11c4fce73a0fe47475d6f9e4c4b8f85a386ddf76a
SHA25637c752c11ed4af2927e8f891fc28f3564d95be8ab715de7b230360792f37f680
SHA5124fc285325283089546ba8b39b1be792d2bb869e56cdf55101907bd1fba79fabd721ffd8730f0fc8248a49e17c7c231d932a1c9bd87913ac67141549fae55f358
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YUF3ZB4A\ga[1].js
Filesize45KB
MD5e9372f0ebbcf71f851e3d321ef2a8e5a
SHA12c7d19d1af7d97085c977d1b69dcb8b84483d87c
SHA2561259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
SHA512c3a1c74ac968fc2fa366d9c25442162773db9af1289adfb165fc71e7750a7e62bd22f424f241730f3c2427afff8a540c214b3b97219a360a231d4875e6ddee6f
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b