Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
15/07/2024, 09:02
Static task
static1
Behavioral task
behavioral1
Sample
491c6bd9742c6898f6a0053d7a1524b3_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
491c6bd9742c6898f6a0053d7a1524b3_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
491c6bd9742c6898f6a0053d7a1524b3_JaffaCakes118.html
-
Size
2KB
-
MD5
491c6bd9742c6898f6a0053d7a1524b3
-
SHA1
f7ae9eb3bdfc75dea85e460dc7348ea0f618801f
-
SHA256
23b826d043d5e4fedd0026ec4fa6bc4ed1dc5311649e5a1ea87da8eac8b001fa
-
SHA512
cbda9adb45abcc3d71eaf1a14554e135adfff28fb2f50c5b5d072884bef5e559d3cff41b135d554d2dfe0b43fcd0ed24f04904af8c67009c2045b2b74905519f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 401cd7c995d6da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F1D02431-4288-11EF-A76F-5AE8573B0ABD} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000008ee268d22bcf678fcab55afda0b1ef15f5031ce3d3c5f9c5b139d32f3f4ed539000000000e8000000002000020000000a3423c9a1f8d9dc1b43c05c5f3c09445f4b2bd5febc553ab867ed128d70a2a4e90000000b84aa16ae1e3dbc1c7522d519b8e3ce707aa47f9171dfd9359b180666d494a96f4e5bdea63e38b9658c47ea7fc52233bbe0ee9d068e14ccfa0cd6e1303561eeee6bce17aeea80b1a56cbf9656c0f90fddba33f2478f7e72fcd00662e94f3afceadf0ede2845f910c8522f284df5d985783790995ebe3e0fb7464e011fa04ce7412081e1fefb4810c109d9140f0c7ac9e40000000db1cd3e36f6d9ee5e3521cb6cabe1b01ed56381921aeb9e6f8d7112d5af227de67b7661bcf8024914a6032529369350d93d8e2b6e91bfd66fb8d637538ab7e16 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427196012" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000008bb73848b8725bf7d25c78cd2b38d4d6686cd24895cc8b23e85006324010a138000000000e8000000002000020000000cf399e16424cd7c218982f6c85fc605f557dcefe6a345270bcde21e7857bc84520000000e8420755e8cfac895c0be4c420f79bcb7991b2156203360c1fcfad461dcd93164000000047bf3fac19f0965605139bfc58bc5b32b64c319fc39c701ecb7063336d6df86deba81e2884629383e6b3249877b6853bfa10f99e812412524de9e3b9f5a571c0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2468 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2468 iexplore.exe 2468 iexplore.exe 2440 IEXPLORE.EXE 2440 IEXPLORE.EXE 2440 IEXPLORE.EXE 2440 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2468 wrote to memory of 2440 2468 iexplore.exe 29 PID 2468 wrote to memory of 2440 2468 iexplore.exe 29 PID 2468 wrote to memory of 2440 2468 iexplore.exe 29 PID 2468 wrote to memory of 2440 2468 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\491c6bd9742c6898f6a0053d7a1524b3_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2468 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2440
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54e126763b8a8df763bca82dcef730c63
SHA1af19fc83b6f625103c011cc02b0ba933790d6aa7
SHA25654fa918258d59151b01abf5a8ae572d41ed99ce0b2ba17969d294ee6a490d954
SHA5125b5f3e30cdf8daf72ad1e0a99e6df761c6e07788984ccf9b64e175b3303977e5bb035bfdf966efccb924469b72471879c1ecf30bc81348788ac5f16155ca588f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5581da7d227e1c875fd5a3af8c7fc6964
SHA10c269f3897b7f7fb411586bac4a819c10b2161ec
SHA2561d3c9cac40e62a568c41781dc2c0d0165bf0b8bde69eb6d389228854fbbea965
SHA512d1056566dab763eee2b91d88a3d5bd1f58553c0b9d39cd391a09eab3a144cc85430b7795712dc6abf467a2fe3edc525c139254c5a6f30b2476f2767d10a9eaf2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD559b0b37d113f6d0fa914166d9e88c328
SHA19e9339c1074fd905c0ddaf8fe56bebbe7f21f324
SHA25606bf409de3745ee8dac66e6b9ee86fe2f982517df13756ce0164cd0154c6d2e9
SHA512b0c3754c302965b845ba1e0d348e6aa708a0378e5e1787ae853a172ed80963c6d42204380c64078edf37a0ee36939f5a6ba25291315f62324f523ef15d41d5f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD550f21203d42bfac0f34e29e734ece455
SHA13dd11345e75de27433bdd4f3d5624fae09f4d6c4
SHA25621a76157171edbbce178f973abe74d3af3bfa5ed1a1195a6a391f4bc831b9f58
SHA512daa413fc034dc1e530204aa0a8653ffff49ceec344a1bc6a0aba028264b3eecfada1f1a8ffdeb1063b45aeaa028951b996e5fa46256cf17c630a4a5cfad6e89e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD576cd6eadd7755525d81c917908c9ac5f
SHA1ba68421a0b99cc9d235169818b7d15f3a32feb9d
SHA2566398e9ac05ac5050501891dc6ba17099de555996c30f072df2fc1ec58ca29884
SHA5123d46216711bef4aa0546ec500415c721ea912812fe0ea51ac8089b7953c6dd7231b555ab3ab35ae68ca5d47bb6477bb37dee8cbae08c08cb4055e4e12d61ae11
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD592985e994d4d83136de0d68b8d5bc9a8
SHA19f66649d9eadeeeb6d2076b894756b2861e20984
SHA256b2c3a8fd24f745489306cd090b36493983189171dfd49c55a0b10d94b337098c
SHA51285699c5af3452055eaecd647767c78495ae5ef64a5e4311309af42066cbe9245a82c671c43a30d0a794ab6146a0737e0f46629247c7c935dc8867b39b9352e77
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53a7d6f6e176acdfe2a07109fc3256a54
SHA11b38467c357d6ffbe7234ac7a785eb50d0d39a8a
SHA256ce6b6429ac5133b30431a95a778f7b4e8d437ed874faab8bfe9deb3420d7d878
SHA51206e0633062687e2d7ecca9d6bea737c26f8d5423bb66cab298cc1dc1c9b5f5b94090c912532e9875945d440819a0d8f6431182380b9700cbf3437f4ca9e37365
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50b0aa6830faace3eb02c5d71b846dda8
SHA10c9dd8f2770726f4a7f4171ffcc4b45899fa107c
SHA256bebad3979986a9bbd1b0a38221ec7b448cc6f6052e9de60d4880c3cf94ce87db
SHA512dfc93be54995f4861dc9fc6777f12ced1709de5bd1b2815d7f1a1b1495e18ca6bddd1864519953363293819d75ec8f929b9ddc9b3e423a74dc6419a2354fd925
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b08783350874b57ddac3bf838a5ede26
SHA14ca03cfaf715e725957267a59eff51f057690a98
SHA256594a2d66d06d65e008122d1d9beba6f8efe2c435622124685abaa894f6fe4ac0
SHA51234ac80addcad84819d3e3c9ef74b57c9ac7d5eb80beebbe514d109954c1adbbefa3a993605126ab59d05241bbdc9d80ec6a10b6b5a6c2f9f942df7551d0c00d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5361b34ee1c476340facb5d06747c0ce9
SHA11a8275b832a11344ecacaca451555e5aa4042ac0
SHA25624b36161bb7a8eb18b5df4af724eaae02c62251c92d0d9d3e7ef383f52834c95
SHA512f0f5912ab9d223f7c557741d83bc0f7c2baf04f6658f0608c6d34211e0933bd2c2d51aee06016a1c1281f4c9651900edc21784e8bb8951ef54d24cf3aa2b536f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a48dda7b556ef5c0d2db458a105e3b2d
SHA1011e35095b2bf3b5f957510c804e7930670aba28
SHA25633b4ac4ccf10df34f2aeead9ff2b6844a4c6699460644e507702a5295c11a9b3
SHA51244a208b3b5858f16fec5e69cbcc1f73b178749b0e2984535b3f846165bfe964adc40d8c12df4d7a70fbedd538487cccd34286ad86b580fe0d4f54a76fef2fc7d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50a91fc37e8eb10b73d4ad039bc9291e7
SHA13279321fbee4b941deca0357913583e2410ef377
SHA25649e1e634bf0592210151dfecd9d12b2d459bad16142275e607f030ba6ff6e8aa
SHA51223bc78882767630c3469cf5d1cdb30f592754107f65117bfb60564a19c9dc142e5adee7b0671402e8738186d53bde7d2da69d90b34de192ad95947d9fa2fb25f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ea3d1010aa6d83d9f5000f35b91fc124
SHA14912551ec385e437e3e16f89364fa8aafc4ebb5e
SHA2562122c2bdb07c888c91e1bc7b90adeefbb23a878b250f3afe4c2e107b5e93cb8c
SHA512b93cf62c6000f3cbb5d9fe5deb75bc69f1ace31c4962c73ce26da65df0fbd4f13e66c74c1bf58bfbd04b35a1519553f71be870f67aa96223222f6c7fad839675
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58e67fa4f13c956b1eb430c1320da6b12
SHA14a04b7c68f49b5b778719c43da9673f8c41af445
SHA256780eee146aaae5f3e725038e2559ff8897f8203f060bd8cfb2a71e39f08c847b
SHA512f9fd0fca6007f3cf3f72183354339ee274041231c12ef80d56bdffc314b9930a1b2ac82d458246e0a450c6ff55a9a81c51d09f0a021a3643aa99761b9dd7084a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c8b340684156001b53dbe47686410a83
SHA10e29654cfdc02fd525bbe0731929fb18e45fcadc
SHA256e786d76369e1e77b4e5edbc46949d3c1f234934d83a30d708ff0545bf7013520
SHA51294991a7b3242a3a38a05d728adf5cb05d9668e7e8d23d1162ee43a647a89701cb870a04af25c85c0f9ebe76d3f80e14fca2a6f17422c9ed8b265b13f5dc4ee56
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD584bfcb5deaaae5a55488367cc3cf7c1a
SHA18ab22a0e92a8b09cc5f17c47f6c23ab1db125181
SHA256f7cb0f4b80848a29dc4a530de90692dc9fd0e4faeafbe85eb2b817b90f066672
SHA5122a4b949c1f7ad3529169569b0bff0e784a58af9d9fb98b9d22dc5736fa5a48f0dc988557d5a7f9b78d7085a858fe7bc8d144a358211e6bdd4852702a969e7e78
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b2e44b6c9e48dc30ee0a964f1942d6db
SHA165aab31b1a17a31e1efec673226846d38abefb7b
SHA256ecd08a67289126f7eb090122ce43ebee86f4e80b578c303cbb01b6a33ee2daa1
SHA512e810f09cfae02b3297698fb1c699631fd1a6d1a3bc90e3a66e36b87cc4957dc60c2b939ca8118a38a9373efabfec3fbe5f96f0714c8a60e3806d072fc51e8ed4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d890298a278834dd1039ecf7f9581b56
SHA161044babae870629f8a0ad477f654e23274cddb6
SHA256ab14f9b80bbaddc35e8b58b57c9cfd9713f1e354c05d8ffcc88457f87bdb34a2
SHA512e5847578436f8408a2db85440fc17483676a527f889ddda7bc53631acf325079d476337e19801a72fc7efe73e1da447b4ed67f6e83502a35f3a91331b84662b6
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b