Analysis
-
max time kernel
122s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
15-07-2024 17:10
Static task
static1
Behavioral task
behavioral1
Sample
4a9dbce9e6d4e4fa1afe2bb6fc31342d_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
4a9dbce9e6d4e4fa1afe2bb6fc31342d_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
4a9dbce9e6d4e4fa1afe2bb6fc31342d_JaffaCakes118.html
-
Size
9KB
-
MD5
4a9dbce9e6d4e4fa1afe2bb6fc31342d
-
SHA1
78f6637223956b0f4f4bc05a9485dc14e1726232
-
SHA256
5c18041099fc42172d95948315bb79f9f05095af6474f743f5cfaf1bb7510395
-
SHA512
c6693eacac4ec422f5e3179ecf9941af4180b358e7fe8cef0dbaa15a118949277b9a877e1157ae0e7508bf3748f411802d9409496ccb2fb5b5216ae8960e78ce
-
SSDEEP
96:uzVs+ux7Q7dLLY1k9o84d12ef7CSTUFjGT/kkZzps2k9ZslVHcEZ7ru7f:csz7Q7dAYS/EknAWPHb76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf71000000000200000000001066000000010000200000008549886566f9a1feeded858048b4dea30e7c6d6eced24d6831c00e3ec4988499000000000e8000000002000020000000e90a126f893b343a19fa1ef46a7a5b8bbdbbc1106656da6e8589eb4a55f3906c90000000fb007779f35c1a7f56668e24dc56a088c537f4a0398a4123180393b8e85cde77d5cea5f8bbf790815bce124458570f4cddabc926df799c72240f3bde124f44fa3d456c9c80262403906f8c860dbad0c0fca4bc7884a1210ddf903497c45fed41a6da9fd3d14d066b417db52f833839266a3f0802aed0af4b73959508f49f7675d4b95539fcdafa4910debf530fb38cad40000000ba31caa08530b312eba3246532757c4e7ef4b484e5038a672dd55dfaee73676430103b67ceb17e542f1e886a791b403cd8f47260c3362e41c745922f86715941 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427225288" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90abe8f3d9d6da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf71000000000200000000001066000000010000200000008a4caefb87a93a8c78bf472c07351f5a0145917bc67696071c09199b57d52ce4000000000e8000000002000020000000b9acd45f2c490344e5b2497f66d46985803804b38cc1565496f12123bec96d94200000000a5edda2993b3a5d5a74ce6a0067e7745cef7d2c168f525195badffcb3b7dbac4000000061d6240d5995355b45a60d633a70665a678c549e805bd7b8f1794b28e3e6974a51d965b026032fc76ac128515dc2b188d3601ad213ca82904673500f33711cf6 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1D163411-42CD-11EF-8A2B-F235D470040A} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3032 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3032 iexplore.exe 3032 iexplore.exe 2472 IEXPLORE.EXE 2472 IEXPLORE.EXE 2472 IEXPLORE.EXE 2472 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3032 wrote to memory of 2472 3032 iexplore.exe 30 PID 3032 wrote to memory of 2472 3032 iexplore.exe 30 PID 3032 wrote to memory of 2472 3032 iexplore.exe 30 PID 3032 wrote to memory of 2472 3032 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4a9dbce9e6d4e4fa1afe2bb6fc31342d_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3032 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2472
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b8d40fcc2aed131e191dfb46ea7cf003
SHA10e7a1f6fdb567fb42388da4e115f17bb8e44c38c
SHA25605ccea607834a30f4feb2f978da6d906198ac209ec9148f32fb4ae170721c1d4
SHA512870de5e7b8cc7f786e1c871d2b43a11bf7b7750cb7d5da7cda2b7ec26e6645131d4194a6d0a31bd42cb721368921938c2a3dd21126d0df3ce45b2892e54ab4fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52b4b9803ccbe541d12570701842fae03
SHA1eff7a5310e27b0d1742b791d7713c3e2f428cea6
SHA25650f2a3ec58d61db39a306cb74728d213412ed46660c5e4f0006074ada8e44bc3
SHA5129c7fc1f0257e8503a4a9e610f119fe6d84ab91ae3b742a92d8390d18e800a3c1b88b4e407444b0a9746b64b68b18371139b09c46bc1294a33eac8ead92b76287
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59047b229a558566d55f7b785c287c8be
SHA1c9c2c33d29111921097d3d236603fa31f0059f89
SHA25658d2340d8c522073bee2a99ca38f1accf0ae1de0766509d3215e09147b265272
SHA512fd1379199a72977996ef94e007b937b85edd331560239e0b35a04afaab1ebbdbd540d8c20e8cbe82b6939f8b92ed46caec6ff9c5c51af1206d86be45d2360533
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5054c6b79b509e9e810f9c0cc61e26272
SHA15c36e1c4e1ffa3d65c13e97c5ef9bc4983de3e18
SHA2566e8587b17477906b89f78d62c4142bb3d5d138ab16b18323b5651c509cb53e94
SHA5124fcd0e6082c9af8bf07a258f383fb4ee4fd546d045642d20647a80e59e02c006b271fa7d30362197f555b913f04316d77d4e5d087c20fa1298aee2a94a2e9c65
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5837ff105fab7e27244ea9d2d5644508d
SHA1022eb215032a73a282c948fbe4939bab6d118673
SHA2569c0c6727e97d1edfc70a58292c1475c28673ba45e1f9398b3ffbe69af7ae3726
SHA512a33793489d1e8843b3fdcd493443f965c6d28822bbb7d3342da70bcecacfac820324682828bf622fafaa56519d4fec3da1d2f7aa5f2eb004a2c1c248293a78db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d0c9fd085daaf665a38d42321e3ed726
SHA1e2b1a10af43cdc3388dc603e4f7eb3e168904cca
SHA2560a849fd469af308b17291c2077d279099455b6864a7ed9f4945d226b61a3ce53
SHA5120bdc0669c5661c73d2079243b416ef899e52cb9ae329aa75dc7c185a05c692c0da9c6d128ae3b03f2af1529d86c2349baf8190f5cf62c92b067d505f561a35d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56edef980b4e9a39ceff80c757afb2bcd
SHA11be47fffcdb5f7675109063e284fed5b81cc4593
SHA256e288b876de8150658a6e93e67435fe3ee1b14bf4953df18b472c65e2974fba98
SHA5120b16cef80a4228abc14500dc185aec24304c1057149a62f4365fde35ed836ed3c40e29c283301403447516ce9c4a52a092a4f5e05073608e615181fb4eee7206
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c9542b445cda1abb17af2d36d1149c97
SHA174ad436b3fafbb2d58002f47e46526206eebd0e5
SHA2568b01acbf3e03387eb92cae07253f3fbea91e6ad292257da93681479a3142ef64
SHA51227ef87beafb80c7db42ec3e48000f1ff1f273b4b6386878612d61fa609a82656f908a93fe8b76131533136a0c1274ce098be442e07f1b07c54a59b4c3314b398
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54dda728e6c576db49cc70573cccc8f16
SHA1dd60dd948b7c8ced75a3900bde272585e0bee3d9
SHA2567762d7ce54a79e49f0714647b721167f342518881d9eaa1a632b129ae04b2184
SHA512a0cafb0297e59abbdaf2314f2d9a904c0f7b5adaa16492e7fe2d9f0e840b1ddce5cb32bc5510d509bc586b1a1b22c1fb1f8a85dd192550d9c2c757672dbccd51
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f54bb66d9f1bcaa13cf23e422a5e8dc3
SHA15428b2f616d4db26d32882e24e907df47a7f0e38
SHA256aef3b80bcf0f8b49b14b9d765694db2cd77425dcfaeef49191391115637cc56a
SHA5121d59c4b942fa2840b56dd878998e1118d6bc050042cb66b9df4fd5e60ed12b2a2aa5b414772b80f76cdec17e33b1e949538626f7f07c31f740b0d966da5d3aa0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d3d923aaf2895eb953d2667763354379
SHA16a24f931e58773ee675c8856ea87d784ac38f9cd
SHA256b453acf2b8cbabfbb8dc6fa13f2d9225ebac6ee52a638601332f025997e22b65
SHA5124c19d24dfc2c7802efe4688cde5fe73b122cc765fffaa17cd299f3aaa4aea1b584c7c70cfd430d06c10bb388cfbf4f51931cc921a96ef91b2c2e9bf1e0ca0675
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b2e10dfa7ac7641078cd5e99dfab7db6
SHA116738d655e9da9b3cf3d36e390c65590784d8930
SHA2569db889870780598f5d94e99b72187e52ec6485d004abee3612ae8192d7261e5a
SHA5121798cf0a8e2587f474caee70fd956b82f0a7e4e6bab23e6803997f6e798855c37cc465c416a67a83e3feb3789377015ad4758afeeb0c65accb5d75a1abe46299
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51f20d0cccf023f7b7028c66d777c00b6
SHA1a99c49c7c47a840b5a15b4e8fad5f30e8712c284
SHA2565224ded752c6f52398231cd2c25efee83b9627436fdd317410b914d836cce7ac
SHA512cd4bef857b2976b2cf468ee9ddc79eaf96cdd79f77284684bee84d9bb6b422c7c02b05438187cf30391d8efba591899cbb01a3bc01cb7369db706d991151d5bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD550abf11ee0d8e909970084b15cc65d4b
SHA1781e79b015dff8567bea4c3d48abcfc26cf79b1b
SHA25649c45e8a6b4f14c8483e88d0864cf28083128d8c616971eaf2a2040ba103906c
SHA512cc73cabb5767f31eb477df27ad3b1720bea0522364dc0f42acd19bdfad7a78c4a50b174e481e3ba04d6c3da8582719c9f889ae86449c1ca5ccfece9c13b9c98b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD516a8d9c9056903203e8bac07a94e8aed
SHA1748621e2f1bc825baf28314bab06e23a61867c1e
SHA256b11b9fa20e462dd24e6e506ab64a0dd53a197c7d06644b8ddbad69a8153379c4
SHA51271079cb21f608bc51ee819e9cecd22f5d073d69a6d91330ab09f15629089fa07eacb1455b142ebc8d1d2509d7e633a2b18919314d1e9d30fffe769d751fddf28
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD531c16a64e99d903384deb97cf6639890
SHA196a0102b530a0cebdd3b17f7a2299d726b9db90c
SHA256ef9d44913e9d3540faa2282ec3526cf4de269516d09cf8fa552c78f0f14db06a
SHA5120a1df058e02f4b051b5d1871b124a694a244c0c0730f4c05f986143b1c6f2bff3a44a99b8d25e5ca0c971ef89c14ecd1245792209735efecf7dd3a5495c54b4a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56c64cf5c324d86927e8664ec6e903941
SHA1f9f462f82c8c15b54cb93f8fa3c20d50bafb62d0
SHA2565d306342d22e3c93660be7cad42f70f19d01ab48c0cf49b56040f04c537abcd3
SHA51244eea485351ddc4dafb70984431de39e65e768bf9ddf1a613ec912c1fcf6afbed98c87ff9aa2856a9993197cb4feadcd78d5f43605ccb96cda2e85465a91c13c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c7f328a157b3799c5de1c5b6b241cdec
SHA12135cec2da0d7dd57f4fe528c9abf67a973675da
SHA2567d57041daf391f80371210d421b96b4206d359bab4e23d8a1c2aeb774c834667
SHA5125c9f2eb93825a5a5fe4280f8084e934f4df5baa22891dc1bb39bd003346ceb5c2dbe05ce4b43773a314bb673565166ca9d12fc12dd8697cd9a7c79afabf73e30
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD598344840356c63bff151d9c10889e7b5
SHA19b85e6546ffed29b75336b80582850e43f7c0bd1
SHA256c31a3bd9799918923446152ec239eeeaa9b966476014f6c052cf636a93902503
SHA512591993671ec6d8e0e8ebf1f8c16260b6f23fdca0a304c981e55a266b3680c306435bfa035f8550088bdc1254760cdd8ee870c3702c1e4a793dc2050086854204
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b