Analysis
-
max time kernel
120s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
14-07-2024 04:12
Static task
static1
Behavioral task
behavioral1
Sample
4442f1f1e3604f6b71741c1fa7f2b200_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
4442f1f1e3604f6b71741c1fa7f2b200_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
4442f1f1e3604f6b71741c1fa7f2b200_JaffaCakes118.html
-
Size
6KB
-
MD5
4442f1f1e3604f6b71741c1fa7f2b200
-
SHA1
1b83c853c6fab460c4cd75d42610a5e024c0ca99
-
SHA256
91fd75b0b64d52b81ade9739a2cb5c42d51104bd34142acb9e66dd7c32ac7033
-
SHA512
a35c7c59c20c882de5456b7eccd26b8348c7f9f15e1da2579a63571afc102c83595822331e8f202306ff55b3c597f5f7f4cdcd92a5332284c8d7926551971b8b
-
SSDEEP
96:uzVs+ux7yFLLY1k9o84d12ef7CSTUrZcEZ7ru7f:csz7yFAYS/+b76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{57F1C401-4197-11EF-9988-DE81EF03C4D2} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f0000000002000000000010660000000100002000000057b5503ec78a0a88ae3eadb4e42f80e7cf2e5252ced7b7e4520b389d16236073000000000e8000000002000020000000751b95ef49ee256c3cda5fd5f662447a2b8367822612147b297436b5e69e1618200000005ef1d52b875b31d87cf5f37a4773033a6c3b9a84629333fb63679237f532376c400000008e4e2c8b836eef51a05d15ab20b5c3e51a0f38c91f86f840c5c2289d6079a7e8ee9f35d43bed46301507b11722d6156406e9f5abc9606d0fdcb630e246543fce iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427092242" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 101b872ea4d5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000d9fc74ce93606b59d7479324beee4a0c76aed04fe8a9529e154b7099f4a9b972000000000e8000000002000020000000b3dd8fbdcab37b77d50f4589b8d0556a75577de327eb803b10e30f92b23bf8b89000000001ba2577e396dbcb8722a7ed8939a1ab3317188787737dca4a9599d8a2ee9dff3857bfb81ac593a1ecea3eb8bcfaa481111d26d7944c839cd163393a75447f3d11ea5a45d86589f27be38cd4f610df6beb6911e89a235de94218b93775afaae2940042fccd608c97f249a5f3f85bcafbe9690c1e7a5d9fcd51ba26450968a3ed273000a562ce0d646d8ca6c238aa93574000000004134a6df1265216efae80de5988d07e8dcd93af2fe42754e0b0da39430175ed635a63f8ee33ee762be22b155ae3d8778974f59402eeab3006287ae6e6d0e54c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2548 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2548 iexplore.exe 2548 iexplore.exe 2336 IEXPLORE.EXE 2336 IEXPLORE.EXE 2336 IEXPLORE.EXE 2336 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2548 wrote to memory of 2336 2548 iexplore.exe 30 PID 2548 wrote to memory of 2336 2548 iexplore.exe 30 PID 2548 wrote to memory of 2336 2548 iexplore.exe 30 PID 2548 wrote to memory of 2336 2548 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4442f1f1e3604f6b71741c1fa7f2b200_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2548 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2336
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5412b8980456a4aaabf8e54fe1fdf0ee6
SHA168514d4241f9930ea4afe4709751a6e69a270cb9
SHA256f57eb89bcd944ff8232aef8e472a4ca158cb5361238fa89f6610e10036535a9c
SHA51211268ddf0e2163110e76c2577d9ec83052bd3f5dae30b2c94b58873a37b68701e975c7617ff98958676e5fdc9bb0f89858abc69f22a6f91c899f33a1fe6f7d41
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54a97a21f93369c188ddb9e2b9bf3da7d
SHA1eed4a8f466c51e4df9c3db4cfa106d99292601c8
SHA256e6b1e7d88d44e2bd1cb530fff1cfa3236037fb4df57e47824ef15b56d9e98d9b
SHA5125fda8a074c2f431dc671eae8302f59a0bf9fd6ae0cba7c9fb588dfe336c793892e35632965556aeff446efbaff56c8affedd19cf6839a69b4ba8bf8cbada4b1a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52f48eb80f24b0b591c1f50558c4249a4
SHA13002d443374badc9270e74e72b40934eef2a394e
SHA256b337fa488758404196fd0a266ab2c6f55cde0f487ac4020d47c3526b0f009fd4
SHA512d0cdfd6a9a8feedcfec70f3f83664542187279f205470eaea401751b740c5a19afa14166c9617c308292bfb686fb2d5c7f23e20db6226b80931faf5276ccc238
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD510cddeb3d7e652f22f4126b91dbc97de
SHA1e40eddfac600fb43185e550e84765c7658f95cb1
SHA256f2c0a3d1ea5d8e1c101f175567ff19e16f010a1b7697d8034351b1930c9b2d2c
SHA5128ecfae67b16a81d5bcc8f4ce40d29bf40f78419ccd5077d9731bbd5668be091c33869e6dcd210fb7ec5f846887963360e292931cbf2fd71560127c05d39c3589
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fa9381534a4b66ab4c0011df6d40e08f
SHA1cf14f8963d423a9627375cacc6afb50996d42c58
SHA2568a9090c34da231eff42b5f6a795e15ee8bf56afff19c51d6c0ff5af95741e0f2
SHA512895e7c30a4329419a4320a64baee9d36191a2c4b21b2bf7124c5990e5a44d8478dd901ebdfabe6de10583c82a30e3c78c71207517c4985f1473d351069ad670b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5167dc743e36411ed50c2445266e1daaa
SHA1f0ce8f87fa3c4f4fb78b6c3e9b6bc0f14e372568
SHA256a47cf4a303bd96273cca7b640b2942a663932b6716d0f9ccf2518e0d21e15e5e
SHA512c0f89b5825d37933714c2d7a95bf4e9c616f2558c4cb483ce6941b2ceb0e0a83f491e40ae791faab79ad57e7f9ed7dc0f736eb0aa4f241f9c041f737aca43514
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD573b7c178906811c376210645673a7764
SHA1aa86fa7697599b8001ec6366b1c822954f446747
SHA256e7ceb23b86b6489420cd0304b2b6b0d1b9b8f8e32a29a25bcf2c5bfa05b7d12b
SHA512401fe0201dd95b199997733d50ecbaca438c5a3b951aa25159ac8a310dd74e1c2e0058aa57d2cb1dcac2f0c73c21217c42a02841b3c23ee08e67daf1b5e08f5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD502ba9d17de7d7534db0225e304d7c55b
SHA122d10b92683ff7a9664d76f2f13404000c4630c2
SHA2560285664767322bc287cdcd7eb366fe0aa85dc6e6bd37a42e2aaff046b3e56476
SHA51269332cc7fc62ff138536935bdde612dd6da78d3aa9abaf2237277188863d32ba27b1f0c1837475b19fdc0c69950965a6e9711688a84715298cbe0ba92e3af11e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5906c347a85111041875598493f1656c5
SHA130c641c8b0194417cc1fc9268d8d9bedcd1341cb
SHA256b95cc8178656ab19f5ce1b29bc4bdfc8e67aefae345c92eefe2d06c9d3bbdbf4
SHA5128c4cf67a351f93a2db312233e8790f365888e213b73ef6ed6a62644b8523f01719fcf5cea3736e2fe4f4d88fcef7853b1c5f81ebf198ea1cb756ac39ceef5aa2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fcd93285cf6e606ebfd1eb89126bbd7e
SHA1010cfd7a85876a5be7085438cb420e60fe0c3606
SHA25649612137bb263f3d8566dadaa5b774b7b94b3fd4c4427311d68435e57c73f13a
SHA51236eaa49114d4ee83e3ff6be8198cab2adf66961a4dd9e1c054d7bafbb380d004c47c66b8755bf88c77220f0c38741ec82e24a607983dbd652bd03b784cea067d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b766553a6f6b40ecf6f56ba80cc204f8
SHA1c5af94f39111431d4a1fa095e5ecada7b9e62dde
SHA2564b738bd7cd566c8d7d3de25077da17757fd7b87b0bc3fb7124ef36f3d26862fb
SHA512d942d9b2b310f5e8ad5dbceb18e195010f18e561fe35411a8ad33b2f796ed50d8629c61d072ebf43b9744cb53cb7c4d04f90cb629f61343a4353ff4f5f45abb2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a2603c631d863044641843e15c3301d6
SHA1ae6a2717f8ea871b121d89726da6e43b7dd31f95
SHA2569e1678e1e42f80996df3d98ff151ac0d493a7bceffb4ff4744a3bb39ee26a9ce
SHA512dc3ec47dd96f62870b46569d61044e7134150d0bdf29ec6590e3ab3603633460be70925c3267accbaa357b3f8ad994e42047f400a5883743576fb3591b1898fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51cbfb00981bd80a7b04c4ae3b22244ae
SHA10a24f06cd28571584df8b01ad06c976c2dc5e5aa
SHA256bab4439d99e2cb87fb4c4c3b2b49b141faeb4323b8b1c391a5ec5c8735e0458f
SHA5125d28e3472231ca5e0432dc94a37e096d3367ec8a40604852a10dcbf3a6f5b8489e8bf5131c8a0760a55cea6e2c072da63e22a04f7828372f3754b35e6f929b9d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54e5f92736fa6641bc2153b7b725281e0
SHA1b3f4e932de053646f269fe959515a96c4fe753d6
SHA2565f39166154d6f8a57d7f134f8d33a69099c7e69c4ca25c564dc55e400b0d8745
SHA512953690005d24bc13e3bca3772fa66b5ed6ad157c128b2d78197856b5c3c1e8ce45276cb4c03cdea1dfe25f3dbe2e35b534bf43ae1bce75d7fc352eaa17368234
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b240ad616202b7692f349b8cc6fa3a76
SHA14817ac50db1ce73c603c90e15676c8027faa6b60
SHA256efaf123a3f4774a0de217be5c0bb725f82460d8e3fd1cf1725e8d68189d64c07
SHA512182bb8dd721862104e4201299cf3c99bcfddf1d812f8aad142484c7e804e89aeb569c31e1558f1bc3b118682a6f8bc3471e21b9062e79192d9308a2fef4f512c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ec4306ab976d3b91b5d6665b3fe4f43a
SHA190443c171e5e13a7d0ec5605e4e2f6e562e19e82
SHA256d8cefc3e117dbb1181988dea3cca3c82d8c07511fb65248cc97b64137a7a10db
SHA512bc0cbb9c9bb66af174b315b017daaf8cea9a69cf19ff77f689042c5d559bffd9ada95cd2d64fdcc55cff1dcd327d0bd568f7984321d895abba73935d54d41d28
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5adc39ceb84850ad7eb6b78f57b300973
SHA11794790dc239e94318840cfd9651290c39c9deb3
SHA25633577e3653b584c2a51a19a47f412149ff3c47e92eb559f15256591c6627d576
SHA512f0f01fd29112d667a073ed63ffd19710140f6af44da5a121248103fbe69e596df95f0d363d2fc8875837028e97cc2635175603a3aae8d95230b11f210cf86036
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c95e874b8b8a64aaea91b75de6d077bb
SHA1ca0c9e9aeb28c473f5c8b07e6fe68e78c2c7c69a
SHA256a92763a057c0950e71e583f0fde65b3cb64f34c54b6b936a01449d297cadf1a1
SHA51282241d5028c3de73c27446bd6941f59e6cb5998f55b179f280269256141db2f275c7a42b5ee90f1e3252d325a003decb3c0afab0993a33e5114f75cb1ae975e8
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b