Analysis
-
max time kernel
118s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
14/07/2024, 17:52
Static task
static1
Behavioral task
behavioral1
Sample
46e189340b2031c15499726c092963c5_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
46e189340b2031c15499726c092963c5_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
46e189340b2031c15499726c092963c5_JaffaCakes118.html
-
Size
7KB
-
MD5
46e189340b2031c15499726c092963c5
-
SHA1
cf3de7c9716cc2ba917c46f3c5f7933845a7d572
-
SHA256
43f7f95bebd0fff06e72aa4837fa88136ff1a5dd7c50e519e9063991f032c5ac
-
SHA512
fcfb1d33537918471a566ab2b776fa95aa2e091d36d8951e022ea9672fab17272785b1fc44c667adbae52ef6a93c3373e4789143d7a0b6db399a61746c2cdb34
-
SSDEEP
192:a8TxUIbK1fha14W45Sld9Nt7t+x5M3lGQRwNrzb:a8TaIbK1fO4iLYMwuM
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0001d99d16d6da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C67FE4C1-4209-11EF-BD1D-D238DC34531D} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb00000000000200000000001066000000010000200000009487cd8d77aea7be8c24ec22dc1c26f8185d0191d2c0df3215f631389cd6ec29000000000e80000000020000200000005872711a551cc77652e580e0385fc047340b5f3c384a646a1e96e4d6546e783b900000006a0b093562166935ec14fabac350052fa7e5ff2f83de916831be7deaeb1afddcb5d82de3dc41c0a279ef15f04c8e6af6d5112259b753a5d4c5c5e5ebbebb25e0a10799cd0b83858c211b23df1fcc926cb45185668f2afdb69d361e58bd223f7c78adec35d996c68601faaf5c152434bdd4554085dd0a66df1655afbe1ae79936a58e2f0ad279362dce78166c15d1adef400000008c035b4c31d340311a9a8c65ad1207a417a85a1847d52ebfa2e191b08271bbe3ba7f728e85493e79ef989be6acf650c38ba4fb4affa594877cec839403ef1d3c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb000000000002000000000010660000000100002000000081dae9ce5d41f345077e543a820da510f39a50b332cbf5d25964090f0a90a22e000000000e8000000002000020000000761581fd2eb0267929443a0cb36cff0ea98a3ca60a2b71bbc653997a1e76b8ca20000000e29096c77b032778dd2e7af3ce1088c2222276075bd32160d9a03381cb42be50400000009dad28404bc2eec8bddf4bede5669a1be0756eafcadb16ee20ff7f42695b31196fce854a94693bbc95867e3f7f340ecef90276a2892d970a44e24e917f229557 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427141390" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2876 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2876 iexplore.exe 2876 iexplore.exe 3016 IEXPLORE.EXE 3016 IEXPLORE.EXE 3016 IEXPLORE.EXE 3016 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2876 wrote to memory of 3016 2876 iexplore.exe 30 PID 2876 wrote to memory of 3016 2876 iexplore.exe 30 PID 2876 wrote to memory of 3016 2876 iexplore.exe 30 PID 2876 wrote to memory of 3016 2876 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\46e189340b2031c15499726c092963c5_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2876 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3016
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58e27448f15c42c6fe586b9741c938fde
SHA11ea1c9b057240ef752bf280526a6beebef28068c
SHA256fde3359594fed00ab8198acbbab1306ccefcdff921e0118b850fb43043d3ae34
SHA512ca98aae996ed8ce3951c9859f3aa55b324381d2ef0e7d3912adcaf9bba8d94b60372227b1c2c8f768f889697ab3471b309b329599bb72253d5e985c48fabdaa3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c44a47224c3efc7c2089b496e81e96fa
SHA1f67f4657787553ead2fd2f2771e6494b63b228d6
SHA256b4f4fffc60346066253b1c0116efb1e3657bb883c7e099a9c09cc9d4e877f072
SHA5124433299fbb8b8e3d013f94dc8f36ebebe9e0adb16105b4165276636e867e1b9debcd43ea68e52ed4f935cfa63f60b991e8e1445b66dd59bc26c2b14f45c468f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5275f7e2d54d4faa0f337163a1230a51a
SHA15e11f0f815f11ff3d30646f60e2f5061ae0da66b
SHA256b8ffbccaf408733a8365c7756ce1d15ad0d40fe837005d21329109be74b0647f
SHA512c5ddc39c3a1e52334d6c9de29e8b8cd4335bd0491a2c130c15c6215f0c6177660d1a8ad708dfbdff40dfa653b7e0bb45655ea03ab905f153202480a3b73e9c5f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54925ab6c935fb697564fb8fbedb5ef86
SHA1fcfa6af4614cb65577a707c798b0633838116a0a
SHA256213ef04047a2764bc4f957b67a28ba53200a718ac330d82dadae7b93321d3c05
SHA512ccd00fa351789bd191cf01e77e6dab9945c9f74d1888556e684235447c04784a63c81d8ffd15b48788eff286ee29c0a507c2621046853ab0e2e9a4623e409904
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD567cfa80fdb587c295b289a7a220ff2df
SHA1aa80dc1dab51a0d80236768546f14355bedf49c0
SHA2564fc70f9e22a9f1ecef65ab1cfea450215da04777e6517da771c2965076390cca
SHA512a98e5b378c39cda17a4b38feda2bf93120a83c70efa5173be897f712d1d450f3ec55828273a67c9099f8412477acd24d281e41a9776c89d0243374343d9ae163
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD587891d64ed613e5c81a5e8d27d88ab41
SHA12f97cfcafafe3f93f9fb90f385a16c372586f3a9
SHA2564539e4ffea9c689898b9f08ad42406c2cdecca4823e919d763b7dd56220a796a
SHA512f74f832cdff15844deb0a2fe790c644a01099f57223b08e688cbaeb4e44f4951662a34a50d28981a5575822d2e753e2e12f52df328853c9722827f1466a5dfbe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cefc7fbcb619c7e232086650d4082f04
SHA12d3f5eb67384dd9a055dd1e4d621ce3a7583a759
SHA256eec762f009ec6cd107954e3dd5179894a74cdc76deea43f2854b266b7831e955
SHA512e00173c8ceb2cd75149520bb55a2b4de097be45cd040a8b5c8ef0cdc34195695b033f2b5069d549ce0d71d17dc2808c3a0345ff7c00d8f0c40f91e74b26fb5bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b3ae6b7d60f30f282460aa8890f3f36e
SHA1b650be433510608924095784e01a4575cba3cdc1
SHA256a4bfa89a2d8393e837becea62ae3cceee4056ebaeeca4281757e207923d0ccdb
SHA51203cbc42b08e7ab529fbf4b2cbd39f9f82eca246353a9e85aea2cf1ff72e46181da42998614b2dffe5d63d08abf17173cdcc64584286a93353a4f6cf00b17a9cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5070e2262b9b97033bb6290728ece9013
SHA1686fb98d91b143e528dd507e62af674248be869e
SHA256eba33aac681f002e3d62b6be41f55c9306bd2da437f46e7f0a39a6edbd4dba63
SHA5121a5fa0e56b4a3d31106b0162e02fae98f4c17dcb997a2de25d10fa923747c6bb008e7038cbc9dca3127e6190f5cb605ef14537e93ff799ab65e83fe0ca73b1db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5077861f8831d304a291af15a706fea01
SHA179e01d657c65ada3ec851d1af1c8e3f0d655c961
SHA256326dd165bd8ea697bea62130ffd783560e6751f16580721ced7ef682cd339712
SHA512da5fa4d2fba7cc6b4882cfc468157fb34c81b35d43fb78b28973fec40a541cd34c9c6dd46ddbd68da0514da92056d7fe7824734f48c2c9c786033694ec54dd97
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c0c21a26e84aeeb5492e3c1bcf9b0ae7
SHA173365c4aac146e8bae379aa3186d79040c8c086b
SHA2560c3e8c2ff3b7d965614361b96454d5b5282047b9f14b71adaff5ad3cf5ded884
SHA512f44bd6dc8588488b0f8c7b868e06cb4d1191b57b4407cd1e446679e96c05fd5019bf49ae080508aef4753fa91268c70dd4a5dc02b9754d26c6a77735e2fec5d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5984f8a4ca3d5f1ce5a748fd9a552135d
SHA1149030227c2a88eeb59ab00c538e06e6cf36f131
SHA2563bfb3272eca1f5c24416dd0be3ddfc4170b9bf12caf3f1747e38104d7807fc24
SHA512efb262dca08dbf4417144993b8431a7abcb09f086d43cfd33635a7c40a0e754842bf73f4032214b88b86fda030588c80c1bde85a8d996566cd63ff00a5127e17
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD557f665d7509fd362e688b2ab05565ac3
SHA19cb2400895e33fe33be47b3ebb83e6bdf763b7e4
SHA2565cbe3e417d4e44a7d01e6947b1cfb738832aeed1e2871601a9daf58ad5be0327
SHA512c8adeaa9c852323147d29ba057db3d2b068b1d414da2204a7efd82238a1c3c400cf6db460b9004885fc9d08009c7b3bb066e5329b9f46558864e5341fa41a68e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d607029a178dc4f39c08e3212efb60cf
SHA1795df81608215708dd626877f012d84a5bb3b766
SHA256aacbf90034b9bf0ebc54c58259b23549b6af9e2ea80cf70bea3518ce2455666d
SHA512b273daea16166645172f66cf89cb8e93044249d7704783c8914fc8123d8e2f3482b6de14542774242c9451eb3d8c5f3a12dcd13e311901ecb004c5d2bb587696
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD546ed639fcff7e9c75a30a3e2b9731bc4
SHA1a78310c31e69c631e6458b7d8151ab9635d3dd52
SHA2569719bb337065f68b11ffd866c69f9c10bcc9fa59944524e4f8d980540f27c0b1
SHA5120b4022920a520a251aa2e9d69e410cad2c6169ef81059de2b9d4c592ecbcad505dd3f18abcd05deec5bc6f8f46408e8020041ee813731f63f52609603125d921
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50cd397384c124f1b58b7597db1d98a5c
SHA142380133242d5561d7a26835518ebddf31d0f64d
SHA25621dd2f65bbed5c759a3abd73839076f12bac058a6a227f336d1dc24854ad4736
SHA512029706ae49f911bd5ede51bdf55a538288b2d16887f93112dfd238d1bde2cfe4b3623304e1d27adc8893d8a64304ec50437db9de498b862f9a94cd8b378fed24
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD558eac6293b453d8d1ed43f3c851f8776
SHA1cedc8bcb222d59edcb6ed899270aef95a92cdb78
SHA25647d50116d8259816a35a4449e52d86ccd5ed17456c67f806c673ac81cf0bb3b3
SHA51202fad88b42e68b0bfc71c3c5700140157e9aa3cc4ae1d912054ab64fcd2a3501a0205a4cf8a4b56d08c71d113767be3b888997f7f4a7fe151c6472405a742b14
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b5ebfe003be1a5ef4a205af33c42adc3
SHA1629a5cdb53cc065a227cbd8541487e15982f80dc
SHA2561e628f3b958db281b41928c332fdb60d50e475b0c5523fd9e802872e101e15d4
SHA51233d48787b792bc7a47dfce2dac24ea8260d0b31381804580ce689a040e613a2249be03c0fd2da9eb9e8ac3db2ed3daadae092a4bdce2772e46a5dd269ea43956
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b