Analysis
-
max time kernel
133s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
15/07/2024, 03:06
Static task
static1
Behavioral task
behavioral1
Sample
47f315bd9be2b7b0b9173fff300b27df_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
47f315bd9be2b7b0b9173fff300b27df_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
47f315bd9be2b7b0b9173fff300b27df_JaffaCakes118.html
-
Size
3KB
-
MD5
47f315bd9be2b7b0b9173fff300b27df
-
SHA1
009abc1c1f044cf51e3bad0c0c978e0810fef914
-
SHA256
6f27f9dd5a3a80a5a41e0afd8a1a79fa9a4f6b207ebc7ed92c518ffeb56a1978
-
SHA512
dacd45a29a5f3bc83d21b2dacc09b640539a3e66187353cd2e00e8563a33f54f3ccb2ef4ef3fbad06461ad2c1cfe0a52d3395636d631be29c877b25b62f6adb3
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{47084901-4257-11EF-8031-C644C3EA32BD} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf71000000000200000000001066000000010000200000006e069442b0cf1238fdc6c9764eae65f2d21204375558e0cdaf6ec65f67398916000000000e80000000020000200000008fb52493120519f670fdb75ec96cf7a35c82f8b0824f2f657002b4af0590e5c4200000008a2c3070f4c552205ad91220ccd51d468b8a640a0da31053884492479b66dc8640000000ddd4d37e33dd70690a8100314991430348192bc55039ae3d6fe235e3a94a169805a5b751f84d8955549541f9bbc02e9cb4ad5a7a598751a36a1a9009ec4e7eb8 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50cc921b64d6da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427174677" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf7100000000020000000000106600000001000020000000aa1477e36377e54bc2155869dd7f8f0672ecb68e0d5983dc388027fc599b9fa3000000000e8000000002000020000000623db8197b8460ae2616e9ea0f7a22b095add0fc864adb6a73a903f39b6e30c190000000c34917991b22625b702047864b5a51dc4567b788427db1efeec530d8842e951960433adee1d0af626448285eb95100ce23997538e0d8ba1fb3f92b7b505fc4e1cac02d659a7ac5da35699f24e5efcc6a7978c61325e71f8a47aeb8952a1bfd3026649e387a8001cd0e79ad8f81d448ef4e9fe0fe6ea86a62377be3fd82f5bfef296c7bce172a0a93ee978f2c78d9daef40000000606f9c2d09f803c8d09d9e295d7ea5866aa9af51e396d098fe7eb5d2915825e6a0eb2270f4dc5cc105dbc635c8056e944da3eda7532e7b757f19d955e30b09ec iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2508 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2508 iexplore.exe 2508 iexplore.exe 1180 IEXPLORE.EXE 1180 IEXPLORE.EXE 1180 IEXPLORE.EXE 1180 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2508 wrote to memory of 1180 2508 iexplore.exe 29 PID 2508 wrote to memory of 1180 2508 iexplore.exe 29 PID 2508 wrote to memory of 1180 2508 iexplore.exe 29 PID 2508 wrote to memory of 1180 2508 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\47f315bd9be2b7b0b9173fff300b27df_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2508 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1180
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d57a51f1c187e4142b0b740183494ee9
SHA189a491e276a51dd933beb4ff2acf69d3fcdaf5ca
SHA25651518190bfd6472c5094770161ed265cb1e7f488f2207a53fb54fd59375bf070
SHA5122756972706edd2c08732769e039864388fa7ea374ebd6fd3c524c7e4d4b4a2ef97b7fa3e338e7e5eb13d3bc4d70b7b87d491e0646ccdd60fef6a39d065b81c4e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5834bfdd1e11601f48704c5ebce3d8abf
SHA1113f9f4c1b9593278645b510e582e5d53674539a
SHA2569c97714e59c0c644f48451a641068a6f376dc8808cf6c0a999396dcf530f1c05
SHA51229080ddf920f9cd95d1aca8f17a11893fc87783d2b5e409c75102d16028bec53aa5026a1cbaeb47bb78613476b1622b1f5d42ef63cf6a1cb10d60301ffae1af6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD566b6f33f515260366c5973c60d4daa7e
SHA133a57d0a80970ad70ea7d6548c69a01e03b7df91
SHA256fc5cf72a1764b3fffbb0cf296f6e2896527296b9ff4f3f927a66459671979126
SHA5120479495015beb60c5b819fa9433d2c8befcb3c8d88f429ede640129c7cde9924d84f28e7a56d38710e514c5670b67bff673455e195176d99a514f40ba38d0118
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d91aecee8b4036d86e18f72de187d21f
SHA13f9f18a5658ae6333bfbdeb9a77f79b74d15e6d7
SHA2566ec9169ca61e00643a135efeaf6182c4ee1e92c86aae4f2084df10fb3ce462f2
SHA512561d92a45a8558299c62fabb15e166e5fc7ac14cf44733b69072c090a55b2c558463ba0bae1ddbbee2501bafe3bc95088412e2a2456d0ea5f80519e3223375fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD547050b54315f83aca876e9260701bf8d
SHA104d2322def038044325d7cc6637a6c284adfefc7
SHA25677025469c218929b9c0b7d0c201d766933827001dac3333c109c1e81cc7767c7
SHA51231fbbab5647783e1621454a9fa4208349c14bb3adaea5710af5d749b8f826a96743ae0acb9e9a3584683251d5e039756312588555d75528a8d1e7968f9787b35
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b1eb3beb5821c06d79db10e703df76a3
SHA1bd4dc6017b513072f3521efa4b3e70f7c4dcc5e9
SHA256576b38ab539c5f4af842341b9e0be1610df276260ada1127ee7d11f1afc66e3d
SHA512588de66ac41942563c78b4b41339bb7d10d7d16c746f912afb154a939acfb8489a6d18e7ed985ab81be33780fdb9424258961fab80dc8417e8ac1329d826eec9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51addd965d72f87500e3a33b6c79cca20
SHA136e95c5d0638d7201779207f7469a7929dac2351
SHA256dd920e229547b4bd3082abcaaf843d5542811d2f42c763faeb649cdb389d6b59
SHA512b7283fa12ca062d34390bcae75ef19cc5926ede014bf8951602b392affc68af4ef8f330f0c8bcaacb3b6bd7cac469d346bb5b86a9079bc2606ed4fdf1ba03e33
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5177b07db06d40b0c5a1a803d1e4f31ba
SHA1b0d14b6c4517886af7a1ba436096c978c9e4d2d1
SHA25640b6b43407f939cda56c595005a08b65db2da57025184684e2d54f406b66c279
SHA5128147397840212833a587e7ff302c60b06f1bb3490695a9716a27c2066209295122dd3c6a7cca2af2bcc3da9ef371c815ba58f940fd5d0ac0748ef7fdbae1c12c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dd260014865e96defc703b698cad11e1
SHA1bc6b19316ac4f8b0ad7e803064d702f39b666010
SHA25671a1885358acb624664d35e542d4330c154dbc669dabb2d4cfd65dedc4ffbe19
SHA5126c02e5030ad6a8023924d32a60aaeab5b46714ce273ca3a880fa616790b4287cbc6dc85824fae18840d316684ed3b19e2f9b4794ed0fa862d547f7b370f3a9fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aa7ba49106cfc3bb06eda0a864046940
SHA1c141cd86a352c658c158c46e63adffd0a5791b44
SHA256b993a6d537557fe08f6559c7f6c5313e0a1d8da55ed30f18f9d8be48491672f2
SHA512fe6247db5c3d8ee043ee11c80ac646b0ae014df03da4ce237241511a2e1fc52adf5d9088b4e0799aa6065d3a3a672a5eed8eba4770503e63a819b0b1b1fb6359
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54f96ae47be78d68de59c43fea481eecc
SHA1bcb3ba9c6d1dd541b7e462f74135753a6e9c3989
SHA256f93bcaa94063f60e116149cc1bf9fe322e2cc31dae1d38b5966097b786ac70ee
SHA5122a719bcb00c5774b5089ee2f0b3ea84f0fa9415432166e56492b68c11e869ded881202d13deba8493faf250a628e622536d1959a85f69b61904db9328c67278b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52e5f1e313edfd9505c7f04abf4e896a9
SHA1449b4c63d65e6632d802c68d9ee3b6acf1e48bf0
SHA25655ea10e183ab83794818d616bf72d128a2db4962a47aa2a5fa9b815c245c997a
SHA512b0b7e025bb9eb9b85f9e3ac29d7a5e584fad57c04ffd4a0e5ee145be3f963e0d976e57418b5d81ca60124485740814b9733fbdb802d35d8ed212fe0dd7c8d8fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57446d012103784666c18a330fd5334a0
SHA1065bedf63b86051181cabd6d88de992de88595eb
SHA256ab0b0f0f8448c62fe56329fc7c038c198a45202faa418daf7fc29f7e8b222abb
SHA512e08d7e21a122ad42c54afe9cab34a57e138c5a87fdb8a91778ab3a009475997c2ea934962a471e7b3ed7c60f93e1c742ed1240fe360543ae02cd19141187b236
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59fe59a59cdac7e15c412eb9ed6ac30a3
SHA1f65ef50664c8b48c0de5115b2a80749fc8915663
SHA256b965c6af45f612e69783ceff26f75c412e3c841fae746bc7784c9ab31001574f
SHA512dac51efdcd1fc84ff70bbadec0ced6b4b5b2d9e6bae221859d01360919beea9e60b06a06a6970d73c41760b7d2ffab9b055f370e7097f6d2268de7e5a89a45d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58b7a85c3f7e7184d3656323c35774426
SHA1b19dbf130186d72f0d2c596a43a4caa4f77d161c
SHA25610cbeb28ed1dad6bcf6dcf8e8dff3cd907cf5111369bf627950512c8b7bf2a0e
SHA512ae29be17640793628b978a79fc5567f4397dd816c1ca69ad94fb54f5dde16c28b97d50c49d0ec8f8df485df6d9a5fcc30ab12dcdc0a4f863f5bbd85ad75f466c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56b83c1a95af85fef72f2abd30f2687ae
SHA1de0a4460bf99cf469e765245a8bb4ff3716022f0
SHA25608fdfa301e2c5f3fffb5a60f00b301e33609956a716b92e684d13d7dc4b834cd
SHA5128702a6609c8c1e014e6c178d03e95987314c8dbd8cee4f168d387228c9d1aec6f341f2a0c92fada3079e235ab615291d28344c40cbb671b4757206c529e621fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55d3f987f13af84b00713380831ee6387
SHA157631e897c2378aee3df14c4c2517af4d6424aed
SHA256b279349267ab103ba1b515b07076c535a4eeca19fd5f58dbb73901fdcbbc6b0f
SHA512eb84e124106c916176c232f8dbc55553be587b2acb3203cb9168a9774840cbe8e05e0a216f86eb134cf0e46ba8b18b82da77cb6379f59f51c335f2bde6be7f8b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d287e2d56834f3a6e588bcf2f121c0ce
SHA1ec3492fa28083055aa4093293c026b401951872c
SHA2563fb57eb67ed5382ad9c9a3fc1358455c3e8393d07173d960d8d1d3af0b2421bc
SHA5124303f6c1994f22d50ad6ec067527fe7a1e70b608ac9b16e2dcc50359d3473f860fecd41bf775a040baf56a57ae6141779727a9311fd480b2b8e836fd15f27446
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52c12fcdadccccc26bcbfd7c859d63dfa
SHA16a10c4bc212ee81ae68104b6318dcf80c6338153
SHA2568315beabbd40ba53a198ffb7deae4103b6682a59b188a880453506858258a6ba
SHA51200f3a84a4d04f53bd131d86fb3d05938bebf12d0c2fbee832b4c7d167df81bafec4c3140520ba67585e1fa80714d6f3fb1b01c16b1ef173e54b62832b1b0d758
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b