Analysis
-
max time kernel
143s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
14-07-2024 15:53
Static task
static1
Behavioral task
behavioral1
Sample
468066df6fbc85c6aa78bde96b4d23b5_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
468066df6fbc85c6aa78bde96b4d23b5_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
468066df6fbc85c6aa78bde96b4d23b5_JaffaCakes118.html
-
Size
109KB
-
MD5
468066df6fbc85c6aa78bde96b4d23b5
-
SHA1
c4cdbe1ae2c85ba93f5becdae2be0609f5747193
-
SHA256
58a849805bb3871ec4478c1913b06b6988f75bf4d3ef01aed1ffdf1d59689d31
-
SHA512
dfd6be55c9db03cff7095f3254f280cf967e3089143b62a9d37ad23b46763e6b344bd2a2b622071bf819aa28e169f2996cf4139c707bd7132216bf685dbfbc0f
-
SSDEEP
1536:pbMjw2fMk1D3O9Pj2fcp95HAznzLkUKCcZvmSkCp:sWCzLj+
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0f0213706d6da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{48168BD1-41F9-11EF-B961-D22B03723C32} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427134306" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb470000000002000000000010660000000100002000000094458c2c69b9f4572e6fed1b5fdeec884862ab00b4fc2315c92494ddaa7d74e3000000000e8000000002000020000000067dd1601acacaaf122d53f95b425cc1cdf5bd4fd84f1981e733eabd6e5b5dbd90000000ee4fd66abdccc3bd44f657f7622c59e3234dfd2a2a16869bcefe6140756d079c50c154d0865242bc4ff59d677afffdaaada8f6cb0c952d28427d43e9058f3e756ec15a8820c2780722315bcc6d4f5567382b316d70547df4754df1af8368fd175238b448ac9e292bc8436293539cdffb79333241b1d370648c18094d5d9a6e87a54b8c32dbd960e00c43a4a24026976940000000a9b86c1fb4193b34f5e7a339bd9a17979fe3416c286db0b48ddef2251460510361ec50f836098a76ebdbdab0893ab88409e82e17fb65589e1795a817844d14bd iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb470000000002000000000010660000000100002000000021565485adb94586a1fc5c97f7b151121608bd02bc2b482096ed94adc9d3132a000000000e800000000200002000000018c650fdd52e8075676d0ff9195cbe6242945e26edbd039170e7727cb4bd2b2320000000113d7bd285aedb11503e13436ec3952ec32e83c5d4e6621fb7fe79e19d21bd4d400000001a1b5b230ec04499ffe02b02b75d9872a113367fa7313dde8f16aeedfbee3ff180b06d6777bd14451118c51210c8ae48a348d87f613e5afba6a6840d407df4d2 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 388 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 388 iexplore.exe 388 iexplore.exe 2516 IEXPLORE.EXE 2516 IEXPLORE.EXE 2516 IEXPLORE.EXE 2516 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 388 wrote to memory of 2516 388 iexplore.exe 31 PID 388 wrote to memory of 2516 388 iexplore.exe 31 PID 388 wrote to memory of 2516 388 iexplore.exe 31 PID 388 wrote to memory of 2516 388 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\468066df6fbc85c6aa78bde96b4d23b5_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:388 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:388 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2516
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58f284e1e6e8f43c9155699a2dde041df
SHA1b3d2414d6e2ffef9b6c5f2d838b583854bcaa2f5
SHA2560ca5a6b2fa762e0afa7897e33235a211654e4584e9425cd7ef12942f969e1963
SHA5127751d0e70bb98339ab53f45ad771555cc5675a06b25905eced1d4a1e535011aba1dcec9fa3fa6229a63ad2a34e555579f084cf9c8f7bba91b7bbfc198a4d1cc6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD523d9a0f5efc99f6270446b7fe0a41bc1
SHA16fa7ce6e0565b60f1e4d4b354cb26e7ed311a256
SHA25603cf90a92957c323fef697032e4d60aed2a8bba2f9192930672904ec6c098000
SHA512a39c7a26c4ba092bb21a582385af6159c5e2788021561ad3b3af64751d24f73cee2685a3f8931432bff2e8e27fd1bc8d63760432d7f51f8f3ff732f63fd2c32f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e08a69280ad4e87d07d4269aa67f6eec
SHA1d714a1d3bf3433984fe6d5e74bda243d08db322c
SHA2562af715857e68e46105446025ef9cc3c019f519047bae735ca4fde296c955548f
SHA5123ee8f614b0e68c44b6527ddec700bc3497d484291bd8f7184f0e375ecd432bb123650ccec3270640b753dda7243edac3c666ac3cc83ba445289681521c394de3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52a37f41b2be70ae96937a0b99a9d3394
SHA1f9f40305f819cce1ad6d59739c903d21df7f5489
SHA25676dae7680e78e3b6e94e57a51cc0830ca1cf0532db6f6afd5e6ddf80af12a9ac
SHA5124a431de2b3b462c04aee2651ae7e1bb041a8453526692061ed6518df8439377ad1788e24320025a76b2a1e9ef0bd30c840f3ced3dcbc2824307d1dff971ff70a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD592218a8ad58df2780d3736bb6e31c54d
SHA186f93d1b9906515cabf08832bbf20c508d50cc61
SHA25673b1263ff104df92227d5516acfea41d05a96aac7957024fe1a590f417fa73dc
SHA512f4fe147ed21b4ff9db6e7786d99848d5c92649e9c7ea34833ab262b738737fdf2f008e9b4238f652c0d85876814153dcb2d389745e162086ea2e71954e79cf14
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59a46ec5583d1a598a3b81df1dab3bd16
SHA1822c93ec810866cb85dbd7615777ae6fc980f95b
SHA2562c0c80185e18c2c846b2e5da3caf93e498845a083e4d223165ca2eb9a33b7055
SHA51281175763f341a44f4221e7d85f51e4f875b605cd9494e166cb3dea4626608768158de02c4b04890566a0397a70192eecf68fa6948ed46a02425fd8f44e78bf1c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59b13baf6847ffeff77590dd645607e3c
SHA1252c115fd03d263f9184e96d43d54ef8cf9c764e
SHA25679594b2c79ea7decdbf0da7ceee4b402e3780db7f036de3a68a66f079b2d2e2e
SHA5122d08876fe56448191f17d2d93faa1b52b08e280ce5c26d018955fe02c607972dab959d5024e079aa8322fecdc58e29a47080d47dd26f3910886530eefd37cab1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD520abf334d94ab90206721c8528097bed
SHA1ddd4dbcb531800965a16fe44b8180f568a724d33
SHA2563f560c87ad21045cf222570f9030ae99b82008d03728cb934985dc50ea7c46b7
SHA51217bd3713cbb27092bc8a249963938aa18760200cd7253b2727f13512ef89da88f78d481aad78877fa1c5cdf44333613a71f6b26b0a0f01dd2600cdae971bd131
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55fcc72d3b9d5083edc8ccbaf901fd5c8
SHA1eb0eedca453dd95d3274d58f4aeec291f4171fb7
SHA2562254103c5b8a44f66fe673ed477af277dc3fad80d2efa132b6ccb12247943619
SHA5128ffe64a630c155200554e513a744e48793f850c436318922d5e099883a2b74ce774cc81e29c88e86636b6f9e4067f5c26ed2c4d561b499ec1095ab0d68ebd9e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f3676cf9b1ec5bfe7e690870e724f269
SHA11037730ec5d2b10f2a19fed8e0d63edd36545086
SHA256f0f584f2428f05bcc0df35a47026fa1b60d00a7b5aff03b3334d22fab89eff8f
SHA5121129d4a79cf88463a871a1898e8d3a5538d88e074e86b7679cf2adad6afc7ff521ef570cc3a8b301155e8d9e7499bafc5f00db21ce92728b283c4975a203e208
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a584f4a484542c0c432f83eb0ee36e71
SHA1ebfcdc3c45117b64163721ea5e496c7d43e287d3
SHA2564efaa63af294c0c17547a2d968d688ce9c59243df8c76eee19252dd22fd35cff
SHA5121ca37cc3a0025a39c20c318d20374285fff3a1a581f31891080b0594c812a558354c39a1f671d0fee656ced8ea6007992879b15ba566ae0527d5d4d7cefc0159
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53e269a6690b014a0585eb26876291b44
SHA1bc577453062c73b2daa65a24f02cb84be857b96e
SHA2567082e6213884e7b1ab040c47c70ca7decb511d7b179af63ef41809e905ea7a42
SHA5121cfc162a4b1da2a47bf32194e567b586e96a4e7b30942ca25cd0e5e4d36c905995a5672297de345a3d937678d01145dfe01564ed64e344e499775de1fa5d8550
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5231bcff13027a22208221443b5586d7d
SHA16715cfe91126402694862fd356944c744a128406
SHA256919ec4fd998b2fd32fe2c90566a3a139389383c0a7740a79b5a451dd97352a64
SHA5129bbe392c6421a2120272e0e4196fdc67931ca95da898720ed2da7079afe60099c502164d3e7061ee8163a86265e70b64c5939fed2454497747a0273babd2b7db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50c133b1bc4697fcd1f138ccbe81384be
SHA1581a2f477d0bc0bbe3ba30af8c1a3eb6de8e9fb2
SHA256cf192f98984599fddc10cc7ac0943187c502b9ef5191a7c5002323e44c5e5d2b
SHA51246af101c5d6558865a5aaf37920eb2f7021ef16094d9a871a855c486ea9e8aa9b438de06d1ce62c2a3f4565f1e64ca3132dbb9ede043654cf19131a5e8e81f64
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c37ba4f6f9ff2323bd90ee60c2580859
SHA1d83abfc7595b72761c7cc32fdc4a8bff6464ca62
SHA256031afc39a6445c4d9d5f2479996f9dc8ee28f9548b5115fe0fab64f12122f5e1
SHA512f94c8deac9f59c0c030f499760cc5c4fa148ce0f330373878a6d846581e8a86fbbaa52219e1a51a3c15f9fa1f3530a8925027c1c6acca4450ed16b889bd17d16
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bc1ed110cc876be67f84fe74a85ab9c4
SHA1f3eca8750612834250eb29f30f726e03a6cd2e5d
SHA25680622c4d3c0ebcaac094f97f46202eed84c9c499f00ce26fcd1ed5ccca42ae58
SHA512107a46da77ffe2ae7652339a12521dc26dbb965443428242754122b4ed73438f09bcbe962a797354a6b3656d6c47db3191c3fca4bdb8c5c54697b7c885e7d067
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD549a6bd92a44cb2be649d77abe22fe7eb
SHA1b239ac57d176a2c634504791f3e32cf0d5592135
SHA25671ba1fc8ca0ef3e7cd6cdb331ebd2a3c02c38eeb863a4042cd9dc5554b7056f9
SHA512e7abb9fd5d0f7bed5da903804bba309cde773f7fc0476ec4fda666b0799682f124805a6a9f36930b054f86de0bba108c079635d8c06fbcbad3ea2d085e53b31f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52d69e775e942cbfe5b5f1650791cb678
SHA17fb6d4ff82d6e4517ed7308b6756f7b8013b994e
SHA2562927b74b04f66484e795612b83d7e14e0f266bb0b07e68512af8eac2238bc0a0
SHA512ee0d44950fb033f1be3a0583747c108db85c9dc50fdd67705c9ee6cfb74cd8d5ae4853e9b5ec43cb5a57c676049febb6211617d749339a4409b8a99670369bfe
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b