Analysis
-
max time kernel
133s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
15/07/2024, 06:33
Static task
static1
Behavioral task
behavioral1
Sample
489f7feca662bf6fd4f38ce69f0383a3_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
489f7feca662bf6fd4f38ce69f0383a3_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
489f7feca662bf6fd4f38ce69f0383a3_JaffaCakes118.html
-
Size
1KB
-
MD5
489f7feca662bf6fd4f38ce69f0383a3
-
SHA1
5d9ea3b983f14ffbb1c4fce39f3d4045bba97cf8
-
SHA256
7727b5e0efb02a488172c099f29e1832cfff851cea1996d6da078ef57f5315c9
-
SHA512
e31fbc7d4d437a967d5fef81f3d6f080b4781838b9e629e6801f7f1cfb685701c0d6f7c274def49890bdc9e28519d84be91f72fda9ac2fe6d68c9ef6ad246f94
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427187079" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2736FF51-4274-11EF-B0EB-7699BFC84B14} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0d9bafd80d6da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f03551000000000200000000001066000000010000200000001bf6f43387dfeb81f8eebbad93b54ce2ae697d93506cde812391c5eeb4484b6d000000000e800000000200002000000083bf54d3e699373ac4c0e0e8681e6c56df78f4292bac16414929895fc35d6ef2200000004a42ec6dc8c55416be9d07abd2b6fe9f945d05ee7544b37013abc6f73d227071400000001b9c4421c9666bf6ba498e592f08b730d49ac9b10fe4f8a758c15ef8a1d7d073cb271283d1e5c797e7550ac525057d972c73d55892c7966beed843a2ef9e59da iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000dfa0c5e8cf41cc28689699eb5d260d9f6e68e468adb707d780da3d817cf4adef000000000e8000000002000020000000c24ce7a00b8d7ecb8e90f426834bea87b25ae0ebf8a33a2ce38ee366c0edd4ad9000000030727f4765dcb7504df2c8f4096520874ca6d337dbe5af9109035d8a8383d58f45c3b43f3517927eb18007629f4d1efc3e4a5e464e7627f45459129e8d148bdbece1d177c9c96545361c7a6e79aeefd05d739bee02a4bd9e284aac7127d412144db45b4a47c3a43901d5a04556582424281cec9ff2baf59e3947959c20fdb67f66a75c3f6637f09971a445a556f4dd04400000002d32c3d84d8e6aaa4256479b75ddce137c2b774d09e0e450636951ccceaa6cc0b009cf1e17dcdc3b4870b052de6ea86be685abc22d52387f78cbadc1edc69de2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2248 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2248 iexplore.exe 2248 iexplore.exe 1580 IEXPLORE.EXE 1580 IEXPLORE.EXE 1580 IEXPLORE.EXE 1580 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2248 wrote to memory of 1580 2248 iexplore.exe 28 PID 2248 wrote to memory of 1580 2248 iexplore.exe 28 PID 2248 wrote to memory of 1580 2248 iexplore.exe 28 PID 2248 wrote to memory of 1580 2248 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\489f7feca662bf6fd4f38ce69f0383a3_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2248 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1580
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a4c9a8a35e7b8017e05264efb4eb2098
SHA18f95844fdbc965a35dbf481867f59392810b3f7f
SHA256c1dadedd7ba8a44f8678a98447d77ef08b7ca3b730e665e0326c100d13f8e434
SHA512198ae92bcd8a7dbf4e806f08eeb0419aeee701517adb918782d4b5e2150bec0a61b1d8d206bdb3db448e73be726a5234c47569047b5fea764cbcc92a777bac9f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59ecfc207f74e429732f8aff50edd237c
SHA1885659529f004a2622b41aa9a357a5165526c846
SHA256d387201a20847db6df8591e3602d056f389dd7f59c496bd655e6ebe0da6c5673
SHA51242b0a05ba118f5fb0f2eca7133fc7bc3ca7b8725c599de9bb11983ff44a0ec03ccb7e3add5dc6d7a93bf8109891050f71916e2978998605cac0fad29027260f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5180f21fee9824a071b4140ddf73f2975
SHA122131cb0162c51ccf490593fe8e83c5420fe52ab
SHA256c32f467566b572604d22151161013b4149972350450948fc01b9ab90753dfd27
SHA51265e06d6948c11f7af0167dbf8fab2a36eaa2d63812272b760d80b2836a70366dbfd29cc5edcf60bdae865f9aaf21ce5e95be7061f8adc5437e8a5c17f06ee87f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f06fa80680d0a51bec7cae3aa7dab1b4
SHA19bdecb47925b45695cb9790244e9fe4b7633335b
SHA25687c650c5ea3554b072062a37f7cfbea8b237859fbe038cbe9afdc0212171d2aa
SHA5127d4a22a3c5d9cdb890c54dc63467f6acf65f39079b1175bd86fabd2f4d3935a4b67524965adb69f696abd77a6fe440ce7d8be521c134090a5965eea7d4e494fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5006d72bfc1713d614a94061f70214ad3
SHA16fb92cb2b10ac7355f19245ee83d0f9a94808e68
SHA25636025343aafbd06411c725d51031b091b13e3a2e7cdb3e2037c4a7aa163c4b35
SHA512413eb906895e9dd12fec371015a5a409a2ddf53c29b60c0c27dcc53a9f005b483c295fbba92ed3eb0f272e9886120782d7570f225f853cc3a9412d70e7109ffe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD576679bebe63e844f1f84ba4fd97b24d3
SHA1619cf6d2b832ba71fbe8e0919a468046e7c05096
SHA2565ac3ad6a2dae295c958d20fa57f451559ca5c9a56c3f27f314cf3edaf797ffdd
SHA51215d91f34428ffd1766a4598ca46759cc6d62b4951f39107bad5e4702712b74c779d1257c893e7a505226f5940ab4625e03a9c290e8a674c487394a1d611a0852
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD562b42d8eda24dd35f4e60b47fd0a310b
SHA1d5981a9ba6a4fa9520c29909d4f0612332386e6c
SHA2566eca57fa1f440c0dc8691c8d1c52bceb021d96f6c1603c8bdd8b28f8344a5ffd
SHA512af539f512dba377264f7840631161ce2fe97ca6da271af4ea5cb91d15a48e3a6d48caeab1bb0df06a791223f002cd7312e395226f9db540b7d4a4707223c0b6c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57899c578db50f104084cabb0574a0416
SHA17c2fa3b2de35fc44f0abc38045ce519deb34d240
SHA2564502f7c6b289745720473a9ee36f8181e1a734160aefc7d555ce3767ae801ade
SHA512fbe99a895478343bdcd82be5b4333fa38c5f3b2dfec0466cc3623da7bac5066085789ead4c97e3570e27d95a0cce06cfdc277c957e3a7a954c8f85f8efcfd71b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a50b42f8279c5dff3a87db5e358492fc
SHA19930bc0042f63dd049e87a40615037523a13476e
SHA2565d7e90c241e90f371e245a2b320610a3b2febac664c4432d888d8ca807087bd6
SHA5121a585863b7acb7897503e6d9ea8a69d95e7413e019553a38a57880aa1f394027225a0eb7b989aea060fc411f8477a02374d7b319d45b091a2734ed5c256238a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56f0d5c95484412f13f2173da71b29406
SHA13daaea0123991908e175c8f1552e73e2ce004007
SHA256e1ed00deb858f164581e3769a4ddee1a0f9ebecaffbfabf891959359cf865bbb
SHA512d0f465667383995e742901f404265141c0eded7145229c8d262a46f8de43b0556cd8c762150336c0e848e56f3a54a198fbcf6da6aa4161e62344cfbd5b23c939
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD588cbac4b3985227b87279dd7762f61d0
SHA17fca763731d2920b77ab16aeb99da4ef8abbb429
SHA25621a03b45b96738905d3d7e1369038f90bef8b7cfaba8dc7779d4b8af09c79c68
SHA512fad050a0bd1c3bc8b827c2706a9c306daa1b5fcc9df514673aef101a3cefb829199673104e999bb1cfb0a3cd9bf9a13536dd110327b12c3cb6cb3c9c5bc8f4f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e0fa1ddd06004a57084c4d89cbfc96f7
SHA1c5d55832d0f32ba4d9b1c32f4eb33a9d128f7b30
SHA256057acba3a1cc46008ce2f883de67fb297818f2fb62dfda6fd1c98e23a3dc2559
SHA512959a3f0fd147334f3da82a218a5e4945414b755bef42f07effe71e693b7aec2fea5cb2b9d74fbf0409c560031ce7d944860123db7a98bed62ca6210de7076967
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f7eb582cddeb4560fa9e9d87de53b8aa
SHA124c2773737bdc4a368de3951efee7f581e18f55b
SHA2562d884b2a561d8271af997fcef7343badbea3dc0b200094faa5e3351b20671244
SHA512eeff1a916e7052f86004f07b8db1ccde9931c075bdad3bb7b0ce1a0571ab1ade399bdee3816f1beedce165e255ec8f8929797bbdda50ff87d776d96787e842e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55704bf7509e5e68d10b9e4bb9f059286
SHA1533fbb9b02209387ae27594272831702fbd63f02
SHA256b054a368d22edcd18cce0cc55a43c5e22c565a02e74172b9332a08545a06197a
SHA512b659db9a7e991b1333586c6de67762485c82adda45eca1ed9e5295890882dce87c0eaff66cbf6ee16f723cc3bffeefc24022be2b67701ae8c581c7d6a66a32d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD561426f49510ed11512be26605ff14ce4
SHA10876c9342c13624e8fcf289e0590511d47c4b10f
SHA256e3933fe41ca68e0c75cedf36271ec23da945aa6c3cd89d1cbfa9f0d213622573
SHA512412b8ec572c54e00fceb254ce809dfa44d20c4093efd43c9c05ba6c053728cd4b6a6a64b5297388cc8d3fad524ef8d1a2b14fcf6b3def1a7e9961e9b90b0af83
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53677ac0aac0ce74d70ab5fc694fe6522
SHA1951fc91c1bf6add7dd502cfd575b7c209037fa4a
SHA2569deb8171e13f681ef2bb62dec0b9f477229e30fa20e92593139560466f6d416c
SHA5124579adac709a985cb56d072efa7b068c4acabe1a6a1e3deecfdffee893de11949f5de083dd21ab5482609f8daaf8d16a324a1bdc14d1e4642fd886c1397b7f44
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5714702d84db191e2ca847ce2dae13bce
SHA12418386853b0c92a75df29a67e17f24b24717f12
SHA2565bb23c57617410016d05f9b90a6c90ef2d8f63fa7a993c2171f60a65551c019d
SHA5129612017a2ad304344c8789192d0a3221ef4c1fa94464c642ad42b89016d2dfc033d1069e7d6adb2efe8dc84efb19fad20400f459955a02fe183d5e1d85f1caca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ff700c397d3084a585a212ac55c08b9b
SHA136c2a481c3f5c2699e33dae68ab069045f7b66b4
SHA256c66a8c1bcaeb51cb5df888ad00956bf691f56132b55ef0ba0770ca00a478b41a
SHA512f76479958b96b157c1345dd61b5b4a8b5753487f0f6368afd059667e1e21df361974e288f4b6dee0fe4c60b26d38b4dabea641dfdc7506bae0f1b293b1fd7e78
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55e9e77f4d8874e517aebc986a737847b
SHA16b2e5c0cd721ae829dd4c3883f73a19a513f453a
SHA256c79066e21383b9441f65207e97cbcd97277745dfe5bea693952b1998aa32e736
SHA5127f999e893cb62779fc597da929ea820e1d901f8863d209c2143d77e941613442edbdcfafb9566895141ade063c4197b068ccb42133a9930a8fb9a2c39090bdb7
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b