Analysis
-
max time kernel
144s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
15-07-2024 22:50
Static task
static1
Behavioral task
behavioral1
Sample
4bc009a720ab4cd9934f05e4b14b6020_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
4bc009a720ab4cd9934f05e4b14b6020_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
4bc009a720ab4cd9934f05e4b14b6020_JaffaCakes118.html
-
Size
105B
-
MD5
4bc009a720ab4cd9934f05e4b14b6020
-
SHA1
ce085f44fb31cd1b5d9a89162c2539feb008985b
-
SHA256
7610a4cb71d42b086c1d2c2702e20ec01ea26a62eae67a9f3e83d1b86a4dd6ae
-
SHA512
b5eee5e9fd8ca6187339a4f17647e2fe830a134fc36c2f7970370767069e2bb475b7495631c6f088ac63a83a58f8ae3a95eec25a2a538d41ae63d5fa9fad9838
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6088498409d7da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000009f22bb50169a7f4e6c15f5f1e1d1e46ef7b5ed0b4ffd6bd97aa7576c0d7322b5000000000e800000000200002000000067ec318756fed9a6eeb6b986df42a8466f18c28ece7790f2c8aaae573327740920000000de51461d78ae3882641eff31f2faa637c6004b70fdd4ebcd8d7332b71efa20dd40000000b28dc5fbdf2dcea54d9b196ec1f864d257e307f0ec6b7ec7dea333634ba0ba89e6bb12217ae4a488d5b49f77c51995d9e3051cd80ed34c5feb1c0f0cd23e87b3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B68D3CE1-42FC-11EF-9514-72D30ED4C808} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427245732" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000007710a73bb64cc22cbeff839019bf4ff6c859004f9ddf2bfdb48d38d29b5ca97a000000000e8000000002000020000000a41024c2054b9f5f02de0d6a73481ba4f8c5611fe6336e7a7b297445dff54ac990000000ba80878afdf8c8d61fcd43249c3be89f038d0737d9346f2765c5ad07284183545f8ac8abaf29d6ca98e75e803dba672c182cc469f3bfdf7f2f1643ad8641f19bff1393d0c0a8bdf12f1a8726f95984791e633829cd91e759c126b8398f4fa24e30bb084ded446dacf5ca3cfac0790997f030f6c701f8e4c2772539e7ee9ed20d2680fd3adc8edc34c15498b1032aec39400000009cddf036061d4cbb3130a10bb2076fd561eced1714edad121b715db92b19d95a5ef034fd5bba3c07be3b94b7ab77cf741088e6ad418d0e34ef4b6183d38b2ed8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 832 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 832 iexplore.exe 832 iexplore.exe 924 IEXPLORE.EXE 924 IEXPLORE.EXE 924 IEXPLORE.EXE 924 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 832 wrote to memory of 924 832 iexplore.exe 30 PID 832 wrote to memory of 924 832 iexplore.exe 30 PID 832 wrote to memory of 924 832 iexplore.exe 30 PID 832 wrote to memory of 924 832 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4bc009a720ab4cd9934f05e4b14b6020_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:832 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:924
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD513ebdd6085fa4fdf2b19f9dd91af72b6
SHA138108b55b3b1b82ef9b274fe1170c0f9a7130b61
SHA2563a0382f200b624b10ae8d8ab61465f94f21d6c72bdb1ffcfa1968d2bdfb5261e
SHA51285dafb9b0589cad24dcee8d9b0bf1c937786cfb86cfb971b6a0e5173c7281ec950ab1a665cf72acdb4eb7b48d545319a4956690a4e6601e4e6508a3a13c2d5b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD521a3e75a23ddb0fe85711c6ddc13b25a
SHA1a78f445f0a5906cfa10ece4523c38e5c934dea59
SHA2568da31584f9deaf9a3b9de569b71c911e1f771108e373c625b691e1b6ae50bf15
SHA512d345d548e19f19b63fbf1d65114b93474c167265f156fd01b3963dca373b6afaad816910b7bf16dc9888938c9f64767b7dafa6ce42d57c8845147e1122a9f784
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ad4f7f3dc3cad821a7264b08a40dacbc
SHA10eb29c06ffae5ff8c1e48317d543213716ac4226
SHA2569acb0509584da6187883376bbb5b57e542d1f1d67f83b4ad905a35775cc509f7
SHA512367e839a242a6ad97a15a6370e6b00a2b1e46a154a05fe577bc1be760ffc3639d14842c80faa8e8d6c188a7124b66189bb9ede6699266346af608617cefca903
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5381b57558ce51de39bda19046b371c12
SHA123401e37c1da363db9b5b911c57a04027022c4de
SHA256f89a430b42de02a6361012d14447c3ebcaf98d20eb0d7c3897fe44682296c00f
SHA5121a99ccf19cff53fc681ae01abc05793f90e5233cc2109b4c59d0656b2d6b1de03933ad2f008b7378f0f940a695b8d64220b03e323efbfafc94f1cac78d22fe52
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5da69a563fd976517bc0534c99145a026
SHA1ac09cfe9d7e9c4059d3062c9583f8b51879c35ee
SHA2564dedd15bf60dca77f1f9e7da901c8e868c518dda9a57313d335b4b18fba8a6ca
SHA512325f3c14b146b3e93621e0e1e5c805ee7bb27f14a127836c214dd0e40778815abb2fc1f2d9f306d507657491f0c5d1541110b80449a2de16e8d68b5f9a87016a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d4b1d2944df6bb32fc8abb1e01dfdef5
SHA1c890ee6f7d73576791f17cd43d28457316ea75da
SHA256a4d7fa21e89037ac0ac7b2696ca63b873627ea11b41d76b456414d2f58b8f2c6
SHA512efa082aa179042dcfea02f7b70ca32310af7554f638478bc26ba48fd8fde6f6cdc1ced8e7364d86a1ec0af5adf257b0a9f92daa5a24f691e3b794b55f429a94c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5348fc3b58356f4f5e96cb3d121416ce8
SHA13e6a0d29e2eda7bf16680d19c395cf9894c3929b
SHA25622dcb35a5496b31d504a7d29c25c846983e8e4c14926e27ead99545fabd078fb
SHA512a9cb21a62fedb719ddbd73e820ad5d7c5fd5d80609a5cafe54eed1c6e99043ae1c153e912ea2a9b5a8a7547a7e94f1598a37c101d2d8c2a9895c0cc836149eff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5edc5a16a97916dd0b726fa325bf26ab6
SHA1d7b9c0be6bc9efac0c5e04b78131b0caca1305b4
SHA256134122be9c9c3ce2051df86bfddbf83be5f290517ca4cd15305f0dde188802d2
SHA512f26b4dab7d80a7bb4c464ce1b6b9ca51cda5b5fc7371f58b4271c0945d4114674ed274b559d4232ae64a88faeeb4acc1093803adc9cf8183f8ffab9ab800128e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d8a50603e47cce317de65caf845ddefe
SHA113161ee9c92d2955e8580677170c6ee8e4c4cac7
SHA2565a76681200b64db1f6fb79daf884933e6666f0d00d7f189d110de6d5032ee016
SHA512a6b90a6b56f2caa0a74a7975ce9c8a14dd0a30531a7b1d810fcfb2c4de9d4804abbd6d682bc42b42b1f9782f51355ae2ea83500092233ae0a3c2644716a226f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d469b2e11b3189f075e2dbb7c8442d2f
SHA1789031ef5c73ea56574e3f3e7d7423ad255fb9f1
SHA25602f46a4835b95fb7f6fca8390d6a9aca8d4ff531caaeeb6d4b81b0d7a57db778
SHA5125d7a44849c173b7cbc09f5ecd8c25486d0858ede8a8c3b8ecca8cc8e9bc821c75ed629dc5dfac8d7ff32a07dd66c5a72b6d457250832c34d706b230f0af55f14
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5601603f294068288a5633cc9d47be9df
SHA1e8a610afebf9a5d72f466b14c086e058ad98ba33
SHA256be2691be7666c2879b88084b492d50c02eb10704f3b6c0a794b05149ff5562e7
SHA512c6ab0cbcd43a4bb0099e89a1d936e2a7ed0396511ad0ceb37ae8e154fbad6baabff2abda84429f4cb2193e4279fd4dd53dd20ee6cf48a0386ef47b820e804e85
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD585a5c0481dba511ceaeb5c566a7f7a4b
SHA186cd3e40dbbd4fc7c1a6d2886e7cf5a9c95d39df
SHA25684f5b7377b858001868047c248f4bd78466a9f20378e77fe1083fcab7d70d5f6
SHA512ed2f06507668469b0627c8ed4729f5e2d68b547e89de6696077903b2c368060c7d9305ac5c9f3b5a09295d452dc7b3aaa2947034037448cda2177d97ce2dabed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b7945cf4502fc0d15bb7bf8cb3f82b5a
SHA1230d0a43b0bb7d8891749544bcf58441dc180aec
SHA2560ddac778fa7440672466f78fac84efaf3742d5a620d3279547355116720a6cce
SHA5127fc1722aac4e486046db4855f8c694cf6e03ae9fdf949f1ab957f7b5190ebcabca773bc7e8978809dbb25bad1f1d682825ecee5c9b14f548456be3245e45680b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5647c8dce1aa1273389f1dcc8d4c5fbcf
SHA1e654d6b5a5f52144dcaf83af31c3b64c3fa33996
SHA256500960d65d308a85db2ba0e034611371ca86b1c7774587c0e0465f4d5f402721
SHA512c0c4ba694c1858684d259347d08faa74f76e1d92bd2f05cd5ff940e6b0a509b84041c94c52dfcc542f21f7a7692560bfa3d642d2a82804f25289192429f9674e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a35b5d1f26a715160d99aef01fbe7452
SHA13f68850a0a5b4a502808c6561698909355b066ce
SHA256db327b3b39e86989a9590f924d22966723ea3031463f5f026d7505dbd7cf4776
SHA512a5e7a304f18ad375f95fbebd36fd68d0e9948bca717dfba7c67f23d8e12c23ad7b1bf0b6399479693511be694d89dcad13198ed0c14f0ff7c094078ac8c3e66e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5681cf38f4ce76e8cb119b72919dcf32c
SHA17da842867d441c1ec700643b2537fc6fd241a505
SHA2561870df704d34ba0dc20039245645915f7f314e53d23fb69eaedda3eae842c1dd
SHA5126c153ff704a5725b5c4f163a19e5a19b2e29449069649e6066526032933aa9859aaa3b88af06b205721f31e5233bff59c6b86ce9d5d597ae140e2a950129498b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5602999d06a6728e90e405d8f6db66b42
SHA1176bc452a2bc70ba447b7e0404c38627685a6135
SHA256f67e305bb709e66039c3a8a77bcf568cc3f0faa77b8021606a1db0e6a4ade0a8
SHA5121892423b4b90a310b9464a939eba439a59e2b840ddb133f0bcb7624de98c0e470fa75531f0acfa5256bd53cb3ea162b71fa9c375efe8b4356a1d83c47551726d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD558f54544ef847fce6ef067f1f816aebc
SHA18fc4655d95497b672dfa1b8f71c2df202208c230
SHA256591b8c5559b123890973327bb2fc39036ff50b9a6f4c4244446be026de039c81
SHA5121234adebd1c0680489e233f87c3e0d72ef1677a37342b01bd94cb41eee17881f2887725645cbb55397e0188e2bd95126d9a73189be711f1359b1782cea70ec72
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58fd963b1ec7ca1464217b2eaabeeb953
SHA185140d50eb6ddac709af5a18ae875b7d93f6bc36
SHA256e365a53432710ee583143e77a1893a67fa034b726fdf4c4c74dc0f3bd7581bf6
SHA512cf1f3742411185c44d458b449818da6bae44712d0e7c82c76e8e24e603f4a8556c43f39248dae54f1982010f7824da3d0e76de70f6418393caba809447598220
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b