Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
15/07/2024, 11:50
Static task
static1
Behavioral task
behavioral1
Sample
49a783d918754ec20cabc2d8177c6d25_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
49a783d918754ec20cabc2d8177c6d25_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
49a783d918754ec20cabc2d8177c6d25_JaffaCakes118.html
-
Size
6KB
-
MD5
49a783d918754ec20cabc2d8177c6d25
-
SHA1
dcaabe4b9595183a56ded8e4825237018b1d829a
-
SHA256
14925a68df731b6a1f3e02200f904c1a6337f42566a691505138d9e3d0496051
-
SHA512
b7b249755a61552a079c3ad28af059cdc8f317246a0bbe8563cf52ba01337dcae3a42faca747a92123d25b5716c3c26efdba756624022211f6ee19f7559010f6
-
SSDEEP
96:uzVs+ux7RMLLY1k9o84d12ef7CSTUTZcEZ7ru7f:csz7RMAYS/ub76f
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000dbae517c92dc9013e16bfbe4d1df8c61a6ea1593d104049e72feaf09facd579b000000000e80000000020000200000004f2a97bffaf88863c0959fa3455ec10b84fe4a032281320c9f5e921345f9641090000000cdf853a7e3371c121b2cb3640173015df800a05759f931e140f4c99aad2a0eac2ab511dede567615a92f7182b819b4f48d04aa27428f4b9c9c16616e95f32a244c96c3bbdbd0f8df18294b5d89f857183a4894b2bedbfdf3eda1172896094d79560334e282ca9deaf00d0c53cac7ade136c2b883f9668f58b04c50e1108365857a82ae93d3450e78b6b30013e6bd2fff400000004347f8bfd431f970c06edcf595c58ba38350de859f5c4c12daaf487a35166884881167ab0d7d923f8e8daab7d0811bf7ea62c4f022ba77bb6e7020820928d2e9 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427206104" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000e3381258162e3b38d5dc58be012ff6b96fbac2acb3ccdeaa78ef69267176a846000000000e8000000002000020000000447cd0b7a057a260a5fa7440b970e966b527054c83c2d993c699b8aefe10b842200000009c2a5320b7dbc00d4b1efede1964bfd5b62a50a65687fa55394b0d5e2b75ba1540000000b544880ea3ae702888e0f159466f35556b3ae49c3929e1fafdfa44654e205202389ac36a2a09bfebd8c3e9e453ff438987fb8a658c0205c6120d6472b40b2051 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7393B011-42A0-11EF-83D9-4E15D54E5731} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70489e48add6da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3008 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3008 iexplore.exe 3008 iexplore.exe 2700 IEXPLORE.EXE 2700 IEXPLORE.EXE 2700 IEXPLORE.EXE 2700 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3008 wrote to memory of 2700 3008 iexplore.exe 30 PID 3008 wrote to memory of 2700 3008 iexplore.exe 30 PID 3008 wrote to memory of 2700 3008 iexplore.exe 30 PID 3008 wrote to memory of 2700 3008 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\49a783d918754ec20cabc2d8177c6d25_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3008 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2700
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5959bcfd124119bd21176b57367ad4764
SHA18fc2944ee1230844d54ef4bcfcd3e203a8461f1d
SHA25651028970e6f47b996fc1db032b7b74e22503f88318c18026f81a773ae1e0a25c
SHA51249382d4bf125416f7603b02f10c407385a18fea2f7c6e755bc926879cead95b802156d2ad855ec4ddcc6567f05c8febe98e9b3703e6e56cd6ce937051f654db4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD517925690790266d959249b1b99919a36
SHA1aed67ea8530c960103765ca9650817b32f67e4ee
SHA2562984d7420f016454bfa4c68e86ff63d595c7fbc0442300b72f87e791669bfe47
SHA5128805f4d69c9ccde96403513026fdef4cd7c657ec6705071fbd8da61bf3e0c1f5feaf689a41a6c035f3902a8fbdc1255992b1e443214aaf56055e062cd7db65ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ee3e881ad6fda8b4a513e382c2d66639
SHA181f09e09e9e7c1374020f4a4abf6aa4bc8453332
SHA256a87da67aa5b3fc6a95744194dc054b3fcc0d1c9148fc2db09a06adf07bd326f8
SHA5124dadbfc55d8cbe3cc282ebb13b54bde7415380103bbd6418ee293121b57bf389fc54541eae1adadd4a6ac10aeaea7b90b95eb4b235a49812c604d046d66064a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD505e80bd62de29bc298ee5b3ba3310766
SHA11c85cbabf47c7b5fbccd8b0a5f3d3277386d6325
SHA256017fdf007a27d783b65f98e017327ae6d11deb94ebef343522b86ac0c480edb0
SHA5123555ac1c48685078d176fbf4e8f27f1f916dea595beeb7b7158a581f8f6e13bef71814bf7110a9de6ee4eff8bcccfa8a566274609c17e17c89a330544cec093a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dae0b153579ce8aca0c67b86e8194136
SHA13d78210565bd4f3bf82516bd998248e65f30cb75
SHA256fa68b2836408300653e769dad299b538d8b50469688c97c3d82ab563084b90ad
SHA512beb7637b557b9912724b039d799fe78874f58ae3b51bab68f35ce84cc2e7e6a5c23d7f5167395e93461a995ed458262b15b9a88c3813ce2d2b53271f97626d8c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a27e3877d59eca228a3bc8fb4df2703f
SHA1541ee9fa507e0edbd287a092815a0313951e125d
SHA256464d1046fa629c3dc5a4c99ae030fc0382fa5fae989ea73b3a40ade142106b8d
SHA512e0faa16fc2a238018cc33ed941569f1f600a87af9f9b1a6f4c8978973bd7d27f599e1a7a4727384f812554c365d66a78e1327d393beeaa88a9522b276aac84d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57d3399587968329bde5ed42b74eb1218
SHA11b0a15efe0d8a1437fe73070ec2cae945b1258df
SHA256d36cfd4e94880ecfbf5bd9e6d1ff7f6250d8124132106edeb7cd9f4e2721ea0a
SHA5129e2f51a0f78b0430db420f338407547394bc19f8f3fa1f9a591ef431e3075a2105947cc2cbf65f83d23b5762ba942380d0c321d7c475ea4230b2d4468343c623
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e96eca227311e8da71984382b2134480
SHA168eca055d912c6a1263d7118c8d7befb43462cc1
SHA2568fb7a08634417e82dd7e54398e43f0b27724c4291374b964266f2c14b28d0ae6
SHA51225b6b8decc07a32931fc1486cea5b7cb66577bac5a93741d268a580b342b7e42c3eefc6a44c34056a11d4a754945275b80879fbd73fa46dcae99b99175d5be78
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cf3b748493f4610cace2282e8343151d
SHA1006338eff9ceedccb5b734f2fefbaec932d39363
SHA25679218227ed158f17282616ba792ec39520401707b7c9e11a6c4a8f583c9f4c96
SHA51209576b92ccf6488b5d22e7f51a0bad891cb019a908a43d7bfb466dee3bd6c4c2d817c83db5867edde5120cc135a3840aa831d119ea96d550aea176236f673df0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fa7654d1a90a96321c1f952f39d8f5ed
SHA17ff8c36b55855407b7a7b371690197c676abf864
SHA25607e1b99ea7cb22668792eb511661f36c1603f52276c878eea6698f2e028f717e
SHA5125ed64f4e58cdbf38d4abe07478f00054e3f247ae66bb2d70a6e7ed681139059fa8e8772d0885d0dd9d6ef932664504f2771a87d783563d249de3eb3ab6ebcbd0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5842b7a89a057d712d5dd2ec364ce75ee
SHA138ac964ba6ca2645f204cbefa5fe10ba9b0ab8f3
SHA256a291b7ce17fe33485b2fe603318fde292cfde561abda0e8aeee8b09e16fb1981
SHA512024f06eb89d4f82a61ddeac0a4d387dad73e6fd550f9e38f21d2ed61581cb82457d0d8e109cc386b6d7fdbfe973844cf98496357bc03130e4676f75fefcfb64b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c6fdc7523aaa6836b60db337397d67c5
SHA1b97f1d65db46953c29b24891674f4bc20f053ba6
SHA25630bd56a75b23130cefa9ffc64768faa7dd2238e24d340d1d997db4e7cca05dc0
SHA5124635f3822f633ac63a0a7cdf17fbf3ff613ad5d3ba1d26be1a7e346479f70eb2f76b7f73338b3d5a90e47e0956591152368f7fea9836cebf1b6b9f0201236535
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e114290698aa79baa21789a55dba1df9
SHA1364337c57afecbb5a862da8508532d9ce4708e19
SHA2560632f683632822e30a49bd58b487dcb475f1183dd188b2964f7893c23a3be1d0
SHA5129b5d60c9a5751a816d9351dca73e60cc9780bd93d31834fe0d6bf9110b9f77eb92abbe8e47b669893900e652dab51d2bb1723a49f1282909933eafebf1b2088a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD595a500a29a8b050dd25a3aeda67029b7
SHA171cd908994a57b082f7914fd06f417dd64c10f5a
SHA256a9474da76f3ecb2a2f95c0447247c4ed54a59577727795a3b713bbec118bc9ba
SHA512ae6cbda4da09b2de6ebe05384b2930f117eda3349c8af6fba46cd3359629ceb414d1d6337d2cffc429cbb27182e60f3871241153b9dbfe003708fb2add74c952
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aa8f9adade2ca6907d21656f4a8ed31b
SHA1a4425ba367f7c53dd62408c1b654bb4a9380a916
SHA256737801183c6e935e8bbf9468adba400117f131203a26c5d0cc6561c5c23297d2
SHA5123ad31fc2f908f60932686caca511d4caf7ff66433b407947d7578c71d74da474b0542e7ad67157fcb4e6d13362c5a404bd68b34a517e73fceeb4686a00cb218d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD532ea16a04724f0855cd31ed0086cb2f5
SHA1cf88ba96c9d34d92178ea44a93a4541b21106644
SHA256af27163f276747a740db30a6a0abef73c454a5aaf8c8f0ebebd179d56a98cd82
SHA5120372d96e48458bd52d025038cfc6e7187ac428db63a3a7850776869a237ab0e55de1c993be176cc996a819820396e5223827e14e32de4d12cf90af6e37412f8b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5af97b54a164e67eaf2630abb55e598e0
SHA12ca8ca07d94a4ecd72ca11265a0317b150ad8a3b
SHA256c38dec42db5f17b563828796f180f51a697e09cf2efc6f11b39d6912267bf04e
SHA512814f3bf87487a3ed11a23275ab8d765724bdf7e95656292fd71fa2c7fc1b574c652c9713d17a52d6ddd0a6a56ae578a3e17cd0a6a844cdb869fd313c9e8d53c0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5244a1d13eefcf7e6df6c94461442d046
SHA1caae4c3d28cffdde21031cad1a97c743519b2814
SHA2567e5d9c4829c15c47a5b0f600cd94ca3d3a1b7b4f6c192d29ab18af32250a88d5
SHA512a7b0e607e37d317f37f91496fd79ddf2538e303d7ab80878e416beb9a83c575f0d7f3d958e4dbbfe734cfc592c28cdd409e05023b20d15e8932ad0535a30183f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5df72f881b6fd8bb2188e008d6e7b353a
SHA11d8880c496f05ea807c45d7bca77656066330081
SHA256b238480134e78198e18537948fc73d2054aa28109d7291bb98371b581731057c
SHA512fccb2b1e0287fb554903b8c1fc334fb58947cf796b63cf16523c4864b4d21de74c88c0663453f48d02b50f45240ce8182d2c935cb9e48d7dbc9283de1f714dfa
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b