Analysis
-
max time kernel
140s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
15/07/2024, 06:21
Static task
static1
Behavioral task
behavioral1
Sample
4895e6156f39634496fed4d8651d308e_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
4895e6156f39634496fed4d8651d308e_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
4895e6156f39634496fed4d8651d308e_JaffaCakes118.html
-
Size
33KB
-
MD5
4895e6156f39634496fed4d8651d308e
-
SHA1
3ea1ed0e1e0ea3d846d13b339c4324850838e6e9
-
SHA256
4db515f849d590c13b8b8db68fd9e7fd22dfed1694f30146c9d2728bbeb6f1b8
-
SHA512
eb01c4bdc7fe68e110a3f0744bc4004a0485a4a3b380081ea071ef64fd50073b94dee83375581ca15225b584c81c6d6ed8f715e7ab0bb08c9a0da440a7e6f3eb
-
SSDEEP
768:PRe9ydLqpnt1L1lX7Nlw9JFjQENILh1P2SrixK1:PZqpnPptpENCh1/1
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 803a15627fd6da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427186382" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{88599561-4272-11EF-91EE-7699BFC84B14} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c7000000000200000000001066000000010000200000005b1bec2abeb6e1f0b35fd48f6271c6bd8dfd66302b19fdaca2d2252a5af7992a000000000e80000000020000200000005840f59c6fba8bc03ef98f18212e00c904d5cbc8e69ac75e3fa0e4c981e42649900000003d7f16f92386b0e3315e31862ccfcd022663e728456747034bd9a2134bf1d3adfaa8efe7f7710330ee3c408e23bb6785bb7ad87d9061a133cdf4736b51a832ebb0bcafcd4afec206f283937881f42164fc30ebfabaef4c9fd1c521dd3bb85618072a2a6b120bc7ab4f030edd1760dc7a23820c198b72cc8c25a8247a3f11602b9a0822a5c280c7c5972746684a5cf88940000000687d20c070f34edf271afcc619bafd5f4b9fce15050764e577cd40238dc13aa8507946442d2e91c84b0a88a93254f1a26a8067a7f3444510cad878cafb51ba44 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c70000000002000000000010660000000100002000000021ddfbc509142afac846304893e7b9f5f45bd069af6243911b920cd73a7336a9000000000e8000000002000020000000f91f67c65fa131e9a05d281e6423e2552e8ed4098e73babee14a264e07e2f729200000005bad4e4a16e2696742c24e37523c88fd1bf1e367c35a04e6aa353495830c69c6400000006cd447e00b1ca81fc2bdf5a6198710049c816a89c198a045239a171675baffd9a3330e23a6f7014da169a63a66196ef4e376d3c8d575ea2d478b553c153326a2 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2552 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2552 iexplore.exe 2552 iexplore.exe 2528 IEXPLORE.EXE 2528 IEXPLORE.EXE 2528 IEXPLORE.EXE 2528 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2552 wrote to memory of 2528 2552 iexplore.exe 30 PID 2552 wrote to memory of 2528 2552 iexplore.exe 30 PID 2552 wrote to memory of 2528 2552 iexplore.exe 30 PID 2552 wrote to memory of 2528 2552 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4895e6156f39634496fed4d8651d308e_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2552 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2528
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e0d69ef7ea45de4e09c155f6740aae20
SHA127500005d06f675519285fc0f7d795e0f7adf392
SHA256453b410c48c82236ed5533cb62bfebe156e7dc1d1a78dfe23ba72a5570c7f4e8
SHA5125345b6e480e99028b1b4eba5cc88d91778c955138b4020556e4fcdb1cdb73c1027c1458a3c143254e9e92bf7dde45f4f6ecec47332220fe61b9f8a9a34680982
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD576c70c9f781fc2c8952bc61bc232fd00
SHA1fbdac3078fbb7cd666fd079ca35f009e12330c1b
SHA256d356662994c6b67cb8700ad7dc81adad0c3b495685b5a2d5c93456506cdbe483
SHA512eacb221973a94fe6b7a47741e317f684a2fcb9c20d1b73ffa942e9c97bc66355569b6be35be09c4a3e46926ba84d0e8897cd47ce5b96f4f1bcc7751408d3fe50
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52bc92cff8cf5eab1e2c2355b612ec826
SHA17143cb8b7a2b27d2d95b6d83408ca99310ee02a5
SHA256c93408214ac6d4035186591349552232f8ba6bcb573b32e8aff9a938966c97bb
SHA512200e3909c11fe92e33c2d9ec63b9f3afa5dad2fd13b55ed26fb4c3e782435efaf8cef06473f27d5c278af6435fb715e307a2ecb2bdbd10c8e59aebbad6512b07
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD509f0533e70ded71e44cddac786f9bf4e
SHA1aecabc57ad8c329e43b0e10cd23e777f318e0c85
SHA256c5ab21c2573c8c56c5172383f5b25a44dd8523750afbc14777077d7521fedc8c
SHA51295bd71b2db1b1704b1e671a67c27368fe6b79fb92520544ccfed5f3ea5f67db714c69b78768b3076e1d9f331c916fef87443a1a08fe402bdfb3308b7566e8f73
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD587f07e4dca88244d2f9bcc0bd48490fa
SHA1d34f8aacba35f77bbfe26391a76ea0bb9e03eb39
SHA256fafa2d0bfbe2a2a1c6ffd48c0ce8a893af88aa4a2481699a1abd363b5b2a06ea
SHA512c11ddf591ebdb23b7e0b3f91792bfe52b6b1381eb4bef8fead744d5e12e0fde2fee97293340e07e8d006d7ba60898c2ed7763ab8f5e676a8f183fe45cb8f4a75
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5961ec4e482992c1afbcec6284e3722fb
SHA11a6a228f90976ac0a2a427ec97b63f2697856769
SHA256566f994d5ac0c48433e292f90274465ebaae8d7af600f521ace2a0b4f6ef296e
SHA512a781b536660599e746e0253964a7fc104fcbc72bc00f01475b0f89f794cc26bac737a52d1004905cd85be86f5ebf078646573b0b05cb0a68d11a21a3ca4826bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59bc2f3bae0750347b3897e6a2004e7f5
SHA174f08080176f2d7b45d3c85a8e91d41109b7bb00
SHA2564909d081d5cfb59f39e621fa36bacd7fe95788df46365e735f0749d3c5303387
SHA512bfd271b3714f3bffadffda10c43bc22b530bba5d6a62c8e2ce1bc73f1457b9e8e111f662dbe22cf3d640931b579dcb601602dc6c0a9019f623efe202a023eb3d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD547563ef0c123bbc340fe71b62ea742e6
SHA18dbf41e960082514fb1df0ace8b2a56474ac76dd
SHA256da84b5f29ed23ba8256f15b8f1b6040d2d861b28a8cc958a9b31aa13c2a6236f
SHA512936cf410fce2554a28a4de4f2bfc14e6641f01603c6fc9dff69f2eca3fd962cf5a54fd37ebee930834cdb766507ec1c131b627ab70d02310fe9348447e0b23f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e3759bc4859a792e446972caa64b0f19
SHA1a83dd2df220f646b962a96d33fb3246846c1acac
SHA256096123c0477b962ac5f2d112dc69362684b50e7db1a2ac0bd11dc3a4947cb551
SHA512d651eb2c4ea190ff96d04d804736fd999f0d4ed80c1738d8e1da5630b73516d5668449ea123cb158840183063e08ec79316822fb8761296e8490dea7b531759a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD516cf1f7c8ed1feb9b12e05e4764bb9c8
SHA18d3ccc7d42ace4e77025d0a77f627067f71fb3ee
SHA256e7e1151896bd72ec8d99e70a0584af30f2b8ad59f30b3e5e52162aa48f8371eb
SHA512277fd075fc828b9a41e6ccf83520744a7369bca16e479ec5171763c483a1fd6b023184539fad4fa318a4c8e472d11760c8d4dbba48d576252fcbfaab861feec7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51c8e98df77cf0d682188430e8fe09dfd
SHA1815148fc64698c918e550f48dce092b44c7af93c
SHA256a43951ba59a7ef7696ed511bf09bfffeb135a5da058a7f79be546a65324bb2fa
SHA512fa9ca74b85a0bf2b0067f3395f4f0d6ef6b53a056060b66641d3e8678fc8d3775c23ead82160a76ac49fef1a8a00f29cda0fc0e59a33385e55344417a5697b08
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e520cbe0e7ea0393344955c04e0ff372
SHA172c8953228510126ee303a17fc073d7a57289865
SHA256623b9a5faa3e4044ef97d76d5266d626a8cbf2e99e978c184856f9ae04e269b7
SHA512148106c4511ac376f9876d187c770a337808b67cb4cd7ad29c9bd4c8f0b4ec7b6b4154c02398f26b0dd2ad278110fbfb31c9bafa9e4cad9178fed272a7e2439a
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b