Analysis
-
max time kernel
120s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
15-07-2024 06:43
Static task
static1
Behavioral task
behavioral1
Sample
48a7d2f84c03714a18228a14932d8ba3_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
48a7d2f84c03714a18228a14932d8ba3_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
48a7d2f84c03714a18228a14932d8ba3_JaffaCakes118.html
-
Size
14KB
-
MD5
48a7d2f84c03714a18228a14932d8ba3
-
SHA1
c34921e5f2a1e58cd1176d43d1bf644b4caea6fd
-
SHA256
5a8184a71f25934e5caef33352c2c906dd815c0bea1b74195d94a14dfa3f5b0c
-
SHA512
8af7a104ab1fa0f78b5b5686ab1ae6b6bb535427c7ade29de87d528dc4510b2b256ef6ddf743d3e68b951a24a1397e2a6d691c21c54d94f1e85ccaeabca9159b
-
SSDEEP
192:qs3Lc3J9K2/KG6oe36JSfRYOrHaHUiYihaXuayVyI8Kh4F26HR:qIcZdOoe36QZYObaH3haXlyVyI8YoZHR
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000e4c919a8d0a4dd4bb784a6722410b0c4497f5346bbaf5011ffc0f133f8cec3fd000000000e8000000002000020000000f723e0a2a1d7287decfd42cb2b965f7f5418a8ce34939c7c985acd14fe9b4b0b90000000bb1c1f202dc2aa43aeff2c6d70eb1716980e7f2dfc3bf14b09ed3e3914c4b614cf57e923d3cf4d477f7af56b99a89152d0d9fa82acf04673c89bcdb418cce0ed172e112bcfadf6dc8d743b311031218571bf9e6ec46e82a91670d59cdb66b9b62abccd3b8828054af928b6c3d31e2429c46f79342f0eda62dfe2b0d3467f18452576bb7c5e33c55001f1ec6c663c3c30400000002997fdbdde441257e0b1d53abe85e92ede7d7c9cc04caeafde199433b33b6a2abda54655e636b015268a642f403d1a65707673bfb041d344f3b25b228fed5290 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0369f5982d6da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427187666" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb47000000000200000000001066000000010000200000003b28d3892a43b5f278253894ef9a9eb5ca12fa806fde6da6e0baafad0e02abfa000000000e8000000002000020000000980e9acff13db75fcc8e8e1cbb96723cd9fb6c0520ea7627c0e99afaef0a2b6520000000cd2d172eb55d848ef829c119b7e96341f7dfbe1857f51fb44c1056cbc302825140000000231b65191b07a3b8fee1da2d021a927a9f0e2d07062804d5deff295d91a1dae81efa2336b47ae2375410c51327823042ce48139bbe6e7354989e6e46be13ab0b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{850F7BB1-4275-11EF-85B7-D6CBE06212A9} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2568 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2568 iexplore.exe 2568 iexplore.exe 2172 IEXPLORE.EXE 2172 IEXPLORE.EXE 2172 IEXPLORE.EXE 2172 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2568 wrote to memory of 2172 2568 iexplore.exe 30 PID 2568 wrote to memory of 2172 2568 iexplore.exe 30 PID 2568 wrote to memory of 2172 2568 iexplore.exe 30 PID 2568 wrote to memory of 2172 2568 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\48a7d2f84c03714a18228a14932d8ba3_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2568 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2172
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59a4af3e48be2d0b5d828f761d0ca0140
SHA1aab1792e5a23e8224c7835963a966a13da40b799
SHA2569fc7e5ca94ebd58d885a35d6cd23915d1474e00251538a09641d377de10e3484
SHA512b9fb6599e20a29a4ccc44aa5d35de6e85bfad2f05b1e4f66bf62dad3c3433d74b128f0fef278db77313a85d3d6d48b0ac3f2b2c800403f1ebb1da2bf2444a4f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5133ecfbda2d1166aa4292286ae398a09
SHA1769b77dccca5596ed3f2e8d8a6b15378f17de983
SHA256ccf13d97cda6aded339a386983ae87d657926cb79a73d37e9955dfcb58589b24
SHA5126c09eb1e830ddeb330551124ee88cfc6335753a7e533662839c1458611f25637f206edd3b6729f5bd81927bc4e8d2a0feb7425a496e656c2e648dd6080fb46c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55f0810775fe6972330e3e482d7e28e52
SHA1a6ab75eb2bf46aec134fa6dae5dbc5e4d530a652
SHA25687f6f9c1ed2f64edf77b85117d0b7d19617c5f55163ee31be789763925540607
SHA512d871e7e263aaf5ac6567ae69b28028db9ac9e7dc5c264541fdefac5bbab011d0356f0d705de84264f35d3b1676e357235f918693630b63081401a2bdc46d04e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51c16180dca5179c856cfd30acf9b129a
SHA1984a345c1519dbd125c84babf21f63afdc2b9edb
SHA25654ecb051831822f314339472c9b7b8253b3124578a8c695097cc600d27f86316
SHA512c0ec3f3aa8016b6afbe8fce12c3904e8f59c9acb354d94a96e215f152397ec26bfbddf203c2c756df584ea969a2c323e84974a2468f31ff6897c6f156f7f0262
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b52fb39226f3add69ea380c26aac72e3
SHA1b26127e89966425f91a244436a004e070904f4b2
SHA2563c90ee822990a889e134485f71f153a4be1b48790ca52c9361e1f6f68df1fbfb
SHA5120ef4c8ec3d28055bfd6b4d8ce4084ec1c522aa3aad08b77b4f09f534c19d6e227a3432c0d34e8f6ca158b2b5431704d6c69bf8a9cbd142f9285855857b3c86be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD574c1cc3ddeccbb1cbf78b4c8a14ab739
SHA149a2e5de394fec44102e651debf47a688c687d8e
SHA2566c65b2f16add9daa36f4ed8164379bd6f884e14aa69ac0131d0aabff2c3953dc
SHA51242b5e6a6214bb841b1f3d9511962a6f068d3c51bdb83c71002477f32b970bf560f8ba07edae2ba141d5795cc53ad205dc00246fd5d7aa03069081107df867ad0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5df5dbac2f45f5c7f6ab66c6d6e2a8ac5
SHA1cdda9dd5863c7b22fea232de0631da5e4115055c
SHA2563c87ce3023bdebd7ca35ffe5706004a98b30df47b496f32bb3cb700ce7df1351
SHA51256afc40330cb85ed6d10901855939d243ee7b6a8d1e1e73006f12b8a0a9fc4a8ca110cf105d4f6551d668d8c3c4e888a83b48f35ec64716ab8ca15784c783069
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b37115bf98ee1e786509aaee0ac167b5
SHA176975fa506386cb4ac26eb3563395191738b99fe
SHA2562af94fde122479f141094974f22bf091beac9c09c66634d29da3394f153d5199
SHA512298c56271543452426a0d88be7c48725a1f41e01dc2823c3071a18ea2eea87713d1a71c87b7aa870b87f78123c251afec72a142f57d484934803ec99a0c6bfb9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5945bcfc3c45455e6913dd30ebf5d23e3
SHA165f31f11969fb7f1901ca3a0534f0891340b3f6d
SHA256d3a82ab72639719f0ade4f0e37c9219df7359a355a52d382e615189c2753de01
SHA51226c00cbd74e9c796c9d3ebf96330656bc722c210a044bc99ea1bee33cd09a848fa2bfd98096bbed609cd5fc6f7e34bea7e061512375f9e9853753a3647658c14
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fd63c9dda15f9fdc9e41144c13e62d4b
SHA19db1c0f5c7adf682568bbf3c670490c4a1ced060
SHA25603ceab1c1d545631048a07293587e06149c33efb46e9321223761865d4b28e1f
SHA51263926dcd12829407f2dcb9d5797ca7fcd580356d2ec2461fbcd2f8d55b111dfc3df8cbcf774157dd66da34fb86e0422b6207e9f34c2e51d6168aae95ead0d689
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55243a8bc476648d123948b15678b168b
SHA1bda6011797b50cd3dce7ee0af712287da1a16db3
SHA25625e750883a0d49a4ba34de05ac7eb6c732b4745a057ed740c1f465b4268a2db8
SHA512eff3bca91f82f2132eb2a0b0769403a75c11dab5099218e4b6f647e036d46e244567e1d83d12415338ccfd557cd9139f0cea2cc939fed236deb1daa9265a3d88
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d0f2379cda88347f495587bfec0f9aa5
SHA1237f4f8807a7dd125fea418816c38a58a1876384
SHA256191b9778d519580336b7e9912a912945e03d2f3b589e41151079caaa9fababba
SHA51269c9e654911d17a9718920d6c685050c20e52310721e8bca3fb488b8926c779d1416bc736644811acc58a40539d3a37f448a7ce73cafc40fdaf06b2767ad37a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52f9c22149441cf06e08bccd602d67032
SHA1dce5883490728a41c46a2533dd4cadc333b42780
SHA256f7c5131b749d677bd9b4c78db0246271fc1231d6ac124ea64db6357696afc43d
SHA51261e5eaaccf475bf69b77b3c936618b027e5941b1231bca9104bc561940b22e2a72bd7161b4df4dba4c26a2d03f6d21c64eab9e2dda3791459c703384d655263d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5af92977f6323cb49019429dbaf34f022
SHA17d74afa7ce19a337fb9e75b62fcec89255585f8e
SHA2560a8957382ab73d07399be0bef6f75ce6bee555b2191f6768e04ebd42d4961b9d
SHA512710bf965c2eaf5cac569af8757cac218cbe8030139623421fd124c0b7521860166f49e852956fc0fefa205ad1dc1f4fdf354296cabea32324800e697648a2def
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD557d0ca8f5e9d58bacd313ca7cdfcc794
SHA1fcfd3806295df3163cdbe78bb581c1accf6cc9a7
SHA25644e2ab08e65e1548ca3c4b583e784155e4defa6b240c659c429b7014005d0fb6
SHA5120f55d03e4e16942a68abefda0b6e294d1b0e45489e4680efa672bd671197289cd065451c2b07d7a90d1834363c1b17714257f7af636921e393416b37ae6879a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e91f3bf2644ff91a3146c352f9ae4736
SHA18dd635428fea651740434d6ea700422bb41a8c60
SHA25692cc37c67875ee6c65cee2d33621afbe0e98e8ede43215b69ca80f2125484f10
SHA5129bb96f3ca5560e7dfe3c527e97f82ce8efcbcb93076abf504e604484cbfb22cc18a273184872e09bbefb00f4d00d79112e099c8c2ff5d3956fdb5de78921b493
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5325f6e34cb29617fb25caee8d53c8668
SHA11d0b737c7562e2c7d1eccbd75876a90b3d6bbf23
SHA2566377e0fd6ecda7e7ee76b6b879a92df7227633480860c1c51d0d7781fe44741d
SHA51240eb19c33d9169553fa7d372151b05147232c1e90ef80b876ba611a9df2a4a875963f6c8e6e1336c0e14c1278d18bed2da170299be3d6cd78debc2fcb9ceddb1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD575247390a08c9d0b3d60f3675a71bb9f
SHA1554497f7b4ea66bcdae9ff677a27225979899d03
SHA256943313ef851a720c318846b63350e84e87af03b2281eb1ce0afa445fab9074ac
SHA5128e2e156530e84650b72336f4455b36d96d5afbb41351e80abc2cfbf81202d0cdcc7f4d4a08e13761ded27e76de3dece8df6e3214e991a30fd773eab8b320e69d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d52394ec8ba8122e21c1c5ca7721d7a0
SHA137782fee1125135ae7f2c170394f5fb91ae01864
SHA25623392bbd8ee6cc9187d53fbc4edd3e4cc9844b8e5fc68f3933ef56d698672d3b
SHA512682bb7ac77477dc9deff683bc2740a5ed8705d7fc005f80f720743341dab66fef00408dbbc83416b5cd99d0fe63b535964932ac021e30b044656ca6c96c795fd
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b