Analysis
-
max time kernel
122s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
15/07/2024, 22:15
Static task
static1
Behavioral task
behavioral1
Sample
4ba263461b834851ae27bdec61093756_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
4ba263461b834851ae27bdec61093756_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
4ba263461b834851ae27bdec61093756_JaffaCakes118.html
-
Size
7KB
-
MD5
4ba263461b834851ae27bdec61093756
-
SHA1
64657af69003082cf2eba377bd315f2629bc5763
-
SHA256
589b4206d7204a24bd0f6219cc20a2df1760e46b54ff3f9a2a43d6c66effb8e7
-
SHA512
5aa6ae59b2262cb90d5e6bf972d924703ef19e2616d872b68bdd76bf4284f7648c1017634d9ec698282da5cccfbcb34bef26b632ed203b743a4f5a8e6a2b12e6
-
SSDEEP
96:uzVs+ux7JYLLY1k9o84d12ef7CSTUxzf7CcEZ7ru7f:csz7JYAYS/9b76f
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C1949431-42F7-11EF-8D34-5A77BF4D32F0} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000624f37e11147271ffb25316b2f3f24cc78224e57ffd939faec88614877505d31000000000e80000000020000200000002d2a3cd5cedbc7078b4e2b5bd10c12d5dc3a46bd9c21fc123ccfc31bc88e0bed2000000051b55964fb79e485b0eab36971d258b3333adb307f384aec4a11fdf777d1142040000000dbd2204ed974e510b3e21a60e0f3b41cc9ad04f71d24666dbe3714e115665479304235b2e57660b3fc7bbf75f39a1df40af23eb49c4620afb2ec4db1f9e7f20f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000fbe03a7d69964061a1ba1c1149f96a9f419651f91856a58b19b08886726b5545000000000e8000000002000020000000e312fdf811951fe48ca0d0678d2aef79e10ed6d3028b566708687b7d0b41a5c4900000007cf7da2ca3ae0d838c8d2800c1f283d75000377d2558595dde6f5d5abead4537171807f65d721bd56143f61b5bf5143ddb2d780454fe30ddc86fa5ecab5811977d02c7410001868dec2933408e1153404e29e761e9e320fdabeb5baefd46478c8497e657dcb8ff6ad5a2498cc48923224b227d1ee73b070edf4a82d52293134eea5492a3ae9606b011be55ee7efbad97400000004fe35ba18d16b93fd03e3ebcfef77320de089705815a2ce1c1ac5c4eb4b8473f993e950b9202bf9bd45e7fd19a472320b5b16d355b3bf3fd174cf7d6a5d6c1d0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50524f9704d7da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427243603" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2732 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2732 iexplore.exe 2732 iexplore.exe 2956 IEXPLORE.EXE 2956 IEXPLORE.EXE 2956 IEXPLORE.EXE 2956 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2732 wrote to memory of 2956 2732 iexplore.exe 30 PID 2732 wrote to memory of 2956 2732 iexplore.exe 30 PID 2732 wrote to memory of 2956 2732 iexplore.exe 30 PID 2732 wrote to memory of 2956 2732 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4ba263461b834851ae27bdec61093756_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2732 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2956
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50434a9ef6080dcd001cf9712733f8791
SHA1d6c44abcd5e3523085a730fe767d2ac4c4b34733
SHA25637fbc43bd003541859ae09da8c4c0c42dd3c9b1491ce22ecfda20dd9da333237
SHA5122b7cd4266cd7f08395de81827a42ba42ee39f6d5e71c8ee55ea8aef63c90bc3dda078887ffef061fa95003bdbd3578538228468c1aac1db1e6c9dd96907721b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD506b5d7dd384604466aae2827afbe5ed1
SHA1f72d0dc8e5ad8c0288a11fb0276d6ff7d0a53d3d
SHA25620061ac4201bcaace5666d3670640e08f4fe8d2973d282f7848afccee82ac1b4
SHA5122ebea443ac05fba1f58f213b7e06d5a9019f161526617ed12a43598e9da3e3d4cb7b25a6fb22c17574479292682460affe478dd7163493fcfe4ae219ef41dbc1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD503859f543aa6d2c06f3eb3f0acd5b4b6
SHA1109b00a4912ca2166ad57d321cdc4239496c7492
SHA256e575eb44a507d8fe5b43ea44fa667083b336f2b2edf69f70e40602fa65d5b341
SHA5122d56181f9b18d4faa37a9b16e15251ab97ddeb6dac248da84df7cfc93c8d7c4eed502b217fd60b2440dbcccf34d9c648ae6e1e38f6eeb3a79dcd02416834483c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51dc85ef5e8bf60ff17a5fe30c85bebbc
SHA18fe29dd03a710f7ae83efbd231320c8161414f61
SHA2564898c785889c9ffd1fb7e5173db4b403272b9d12268dbd333cd0678f3fbaf822
SHA5126a389c0e50fa09beff9b9690d3017dc8d56684b6d50dc72f00a4870210bcee4d298437bc5e746837b8d826d3933cd9025ec5ffc3224c452e49488f59dcd255bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56e9e76d28f6454322a1a786f4c988c1e
SHA1a294439516848c8c536758f9c814b33c5977ce55
SHA25618c3f3d2934057f6de416137132dc96022f328e7ebf7606130b37cd1b4910bc1
SHA51226549ad61d89671bab4a4c3948413a9db6458ca290407b102c1de3f4dfc06ab15374529669c50596cef0ec0d74d6f663b930c44f7935dd2d4f3fea7ab55665b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b34496a8bde4df65597c178154c8a955
SHA1161e87e6fad5d3c033df943761e9a0ced99c4bdb
SHA2560da45afa5e8b8bb795b2309ff8063e25ab332a4d8ee28d5485753a1b3d61ed78
SHA512e649249553399ddaf8036b8291b48d7078fbc429f60c34434b8cd1bda6b22abc7d837ea488bd516e5ea0d9d662d275ab59c143564d02807dda65843071c5a55b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57e896265e635d0dd13c93d1ed6c359fc
SHA16ca6e675cb0662a8f58382ab514d5e4c2c0c8b55
SHA256ddc63d1f0f554338b2870838fc0df9132a2ebe2d690b897332ad4c54ae141f24
SHA51266b6253a3524a7b99544ffbccb9947568b462fe621e8f67b9ae739778d029e8b1dbe5d19330b47d1bd6941bfc4ed763f438b22292a7a87d6108e304c1bf98577
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bc2c96ddab35231dcdc2360585935543
SHA17bce439a63e8db92a030b30af775e2ab33ee9b18
SHA256e4032ff29b87cedc469ac83cd819f013a2d4645fc109d26f8ea0080e5650197a
SHA51206bbc330d7ae50ee7ab7579564886f6f19cde6254b8206e90d03138cee448b64634f062dc8faad74ed8995e6e1b8c341f919e8d750f74895d3f77808c4610c72
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fa68a2d073dd25af41b638111d9dae2f
SHA1b24db9d7ffaedce82b801a9a765020cb047efd01
SHA2565f0b4dbd415b7251eefa46e9e27c90534e67c89538a58d91c9e411fb2652b77d
SHA512e02a539f68247b78f24ff493bda60a840d72ce1b976b11da821a8196c4245dcd5d20f4cdd23c71ceda02aac9ed39ca1c79e06d3277ae1574752477c037f7ea03
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bc5efd5640a115da72d36075ff1192ea
SHA1783faa59c1adf5d454f9c6c65295b0211bdea472
SHA256e3d5754983087ce0922e00ae5ba4f9506e81d66034ce27e2c5e7cd248bfb7b3e
SHA51241ad71a432c61bce2585f0e78355bc8b79fde85f1a2b266f83c8b24de3e81f6943ceb6c42b2d6474e214c7882f24c7e429a7bd5c200763a193a21e9ff23278f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD526b6a04ad72bfce5ca853cc94376fc1b
SHA1c6e4153059cbb58984a8226f482a02369dc6c8f1
SHA2562b26e929884cecfc39f46ed5682a464524b7af970f85f211b1ba902b5f6848c7
SHA5122a181d5bf75b16eeefa7a5e5a3da3a3dcee05170252cb773e0d68b93b5a4334a6057a2b1d76cb07fb90ae4b6cfe84171c9553ed1f4d2facd52a4ed365da5734d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ed9a27f4f091348f410ccc69a2ff5d4d
SHA1dd62b58460b4658f4249b1f88a66f0d1853d86aa
SHA256b10e26c4906ce9704f8af7fc7e5910cb1b06911de6e565159f0ca695e8c719f9
SHA5127cd16268c37ce754828214f268a34e2b1457b89e20e0aa2d68706d1e20e796ebc7ad8c87f1a712f03f542f0d5a344acf66e9430514e3ed7af2a138a8e358a057
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ad349faf0846182de3221ca3ad8da744
SHA1f04e4a530951b7ce9beb7c311618fe125ba3cb0e
SHA256ffebb26544a86ac4fa87168aa81d6890f5216b0c99cafc0f9b9cc02b6a05ca66
SHA51211408cbf6a8a0a3878bfe4db4a9d4a5f87431cc99337cc6aaee52af3bd245ef5caedb91070721039ff5b9a70f623b5d8f7ea7afb5ad7b3401681769f245852d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5794057f49575e39871898ee9241f632e
SHA15f911a91ab16b511a109b8955e56fa5a5a97888c
SHA2569cd843a17c5ac0b4dd016543ba4f61d18ea1c9ab0ed28c9d86f0b387e96789df
SHA5122da8d2c604f5a29ab5860e6cb14e93c3fcd34cd10990d719de2940b289457428144e2b86c4c006da64adec577a9191f692ca209e77ed9fd7604b2bc1224fb0d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a2a39cc9e810ee936c1c34f0ade0a197
SHA1d08acaf68f3d3156c0a38652a0a0766da40f0f82
SHA256625f8e79142b9efefc4a87038867af7d9e4625968b8c0e980e371d9594675363
SHA512ce1990d1391e2fa91747805afc084eaece9299345086cdfb5f174e26845eccd2fa88b0223fe686833643d5738bff5039ff64adf10a247bb393e58defd39606b1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51f46edcb6dc56e675f9071d9cf9f5415
SHA19f11e0be04522e70617731b1deb5cd56543a73cc
SHA256a37d0d3e54fe8358637f5de6b6d93661e36136e5d46c553ca2550a8dd525aaf1
SHA51282b9050e90c7747f8b97eb3b7df69958646a930402e51d3720114cf05d40bea5f7cc17ad89955a5f156649fdfc558cd0f39d2a701b9b3a2c8566246eb0f94d73
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52e6255a4055debe6e33e8fd94964ea0d
SHA1c09140dcb64b517ef5a2b165f0f85679bb7f3151
SHA25612357e07c840def975745ef29748a1cd9f3fb1af6f3af3003368c15a785448b8
SHA512a17b708c73d937a2a575acecddeef9f06d8bbe17af4ffc2c0ac9cb7894d1dfbee42d0bcf705764123107b1dbc386216e98e17bd1426456b516d96ea039d68e97
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d62a673c688ee6942fb30d30e60c86d1
SHA15ee2ec6089ac0c9f6953301f28cc6ef91e673f13
SHA2567c0581154a1b98ec1e4c2c4e07f37a09710a98f21e615f4326728e26fae7cc90
SHA5120000d9a6ad1a0bc9b63de15163d1e996054c5b1eb3072282824bde85933be1247988f18e257ce830fb7e21fabf9922b726244506401984b6c4c14314498f9a61
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51de734410f8210b11f01149daecae2d2
SHA130eae849908d8edbaa9fd837d202c8638f934b53
SHA256ed693174bb28af69fd53f4c3987d888ba929d11e18059e403a91475856ae5c4b
SHA512cc0c90feff1c4f524b2d1fb7017afad3caf200d4474fedc9402a0fbc425547537927b4aefdaa5b79d685904fff9b578778c70bf5bc3ad7253065619fdfa633ad
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b