Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
15/07/2024, 18:11
Static task
static1
Behavioral task
behavioral1
Sample
4ad3a7036e8ec146a235e8086be194ce_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
4ad3a7036e8ec146a235e8086be194ce_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
4ad3a7036e8ec146a235e8086be194ce_JaffaCakes118.html
-
Size
1KB
-
MD5
4ad3a7036e8ec146a235e8086be194ce
-
SHA1
9ded1c36cda43d7af1b390ced4a8521c5339d41a
-
SHA256
aa1cc9929414683ec35b6d946f32e4e9fe5284602a060706ad2c56242ff65efa
-
SHA512
4beded3ae46bc186d9d0fefe60bce05dd343db69d445b5db84958ea1d9459a9b3a78a32d358996703293569bd38b451b9ca61a0b9f55d8fed0c94ec9f2b8b29d
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A3A89381-42D5-11EF-A173-7667FF076EE4} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3022d27ce2d6da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c000000000200000000001066000000010000200000000dff575d0cc93b1ea92c13c1d81966854bb25517bad3c4c53c6fcacd2a1c8a76000000000e8000000002000020000000c7944bedee5e124ff9bb812513b0985bb423e9084d1ba3eda625451f3dd3833c20000000d22bbed732e4c0e50fcb8b64646799a76decdb5e60da9cd44605d6df31567243400000009cdcd769e966ceb25ea84a8938ed952039c2d95c9b3d22fe6dbbdd074f41822f92e40450a5ef46eb1a5a85ee4e5c125caa78f661efc245204c81c6c9b6d6a040 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c00000000020000000000106600000001000020000000afe492e07f0a2cdba75d94e65d18fa19ae78cf3af30d5b9564e3d0167b4484f9000000000e8000000002000020000000e6641200355868583375aef5b10c0c0dc01def1f020d33da4ac14a3e71a7f16290000000408bc60a421a555e95f300ec0f24f5ed5131ae707d1f13092658cfed83e4e4b69fc5c6b1814b50eeba1d52db8c44ea8bb9102db706b7a3dc03b55f68f6f8a21b3a661288866e2091033755720d298c053ff90336c0136e8e72e127c2409d6b3f091b8c5eff8f96f05c5293df2b64bedad5cd09aebb07832aba5786a4ddbbecbef4b63dbf8edd75eee5e6389bfe6494b2400000006e62f59251d51de36faea5b748603cdb747dcc122abbd0deec6bc8c1e5cc1bf88096cab54ac4aff49d1e3b594aa39acd2b1c95e55f9c8dccf4c4970c0cabd243 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427228949" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2112 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2112 iexplore.exe 2112 iexplore.exe 2508 IEXPLORE.EXE 2508 IEXPLORE.EXE 2508 IEXPLORE.EXE 2508 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2112 wrote to memory of 2508 2112 iexplore.exe 30 PID 2112 wrote to memory of 2508 2112 iexplore.exe 30 PID 2112 wrote to memory of 2508 2112 iexplore.exe 30 PID 2112 wrote to memory of 2508 2112 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4ad3a7036e8ec146a235e8086be194ce_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2112 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2508
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD528aaab2128166882caf1fa23b86f053d
SHA1843f0bdeae6fb06956af0790d90c70237be50afc
SHA25668993142f1aef03a21ea8a1dafed8d5be15f61e8513d8ceee50e3a38d530e0f7
SHA5127a05844acced23553e5959a67533e5da9f36f2e5715e6f8b5a753a5777b81e7c42ac32bd5737a630b636c0a8c645ff56689a1a9ec18958d5ee3af048ed405b2c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD53683170f61fdc85a7dee0a6bc3cca1fa
SHA13f0eacc596021f6138519dc8d24ae31cd41ba3fa
SHA2560fa7437efa325bd67b0951153fd60c644fa4245790947a5c91c89403309698ad
SHA512bb6ea4605f0eef98e6508381cc75d47ca726b1d06c130e77976e708ab83962cc6b5f62f0f72986142763941352d864018370af09f5eca5f4578526181e75040d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5efbf4ff0abcc4bd38ddd7372389d3866
SHA1a2e4771921a0e4a0bcb3cc746a86f52733e64e21
SHA256f1d64bf1e0bd539ca77cafe6b073bfd91cb247bb9afca540e4214325a67dd058
SHA512a7fb4c88f5f6e6bae6ba5ea431bf58355ad842f9033c05c832c88beaf193302f6b06bb53b349150cc240cbd1cb1d53b7ac8086f62fe97b5e7ef6b1df8394b6ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD57475b164555e99debbbe7f4cd67586a0
SHA14f5957fe9f29102d56b7be7ad9500858a336a762
SHA256e60539ccb04dfdd50b0259b1c63fed598ab2c6f8fd6e5b5d808ff817e992eb05
SHA5126c4dc9a0daa608a3bed1ea966d0f0179ee1940d757ae780a3cbb98ce6a5fb4f540676b0fd5f2e69a832b8b9fe037880c2cd03f700ef2e408d444439176400caa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5d916c2878128102387cc9a792dc54405
SHA1b73df83cb22d52f9ee9a8d4ee6dd5df3ef75df59
SHA25646cd3e0028f94920b21d9649134b4e1393e4789d8bfb46767c94f483943e4271
SHA512023d2459a58122ed7e0fd5de68b33c379fe6c032d6f2a15bdf5f946fea484834a2655e9c5d8ae5ed3a3218b0115a9ace912096efe982defae3aff3d6045a1030
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD51733f79ce27184ba09dcdb75227af8e9
SHA1a590416257ef6998b53d46bfda34021ab56aeb15
SHA2567687c7f7670ffe78ab598ac10cfbe6d2dc1957277a95111f622e6a9ffb403cf1
SHA5126a4c6a4c452b008cdb2f5a7109644c34b4274aeee1a6d2acad5334654da873366e903de2dbf718145bd03c55e83d6fc125b0b90647a3424bdb8af78c84ec6e69
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD51f5ac377f7749966e68c46e6830ca5a6
SHA12c2d8c6b7f1fb199e3930867377e26f2ea50a069
SHA256922391551e5d2aa9a64ba79ed13d39b1dac6fc26b11c1139832acabbcbdcf771
SHA5122438f8ee4b35c6639796727713a0b5bf13045e52ab563a6816de5816ab2b0c596235b1a1438397b655127dde55661297fffac7ebca6adc0e911c255d42e8717c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD51c450dce9cf8282289310887d55400f0
SHA116ed886d51008b39f228dd0d686211f01a87d88a
SHA256b751dd262cf29cc0b0496cf492d4657e70cb1439ab1a968e962a6c38beeaf1c0
SHA512cd4b85546a3381efe5344015e42fb8e5df41420458e1f6fff5a91b154624071f4dd69c5de5dc1629fc1d578ff834a3a75c62914e09645b8fcfe45c230f9bcc86
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5f01ab3a4da0ac7111d0ace60e642af32
SHA11e4e6773eaebdb03e055c4e9fe7743d6f9d42111
SHA25635ff96fbfdfd3007e23cc2012d26ab2f9df78cb489f9d711a3956763a8beafc5
SHA5122ac5a1e1da21511535a69930228b0ec6a25133d45140858f46f1e1a5210473871412f05758e948fee4898b2172c93f16f525ada9eb2776a5a48977c34aad0e46
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5eca868d6a68d0a6443adee1566011d58
SHA13ae1d96d6cec41bd871d098f35c24021f1607580
SHA256c0f179dcbc773e92c9add93870090c769eca0fc7bf96db601892ff5dfc73fcef
SHA512c740c3eccc34fb31c0238b3d27b8a031ab59847c7e12c98d1b03ab338b7ec2f2f0a998fddb79d2e2dd9fecd184ed9a872cc69b3304585c8cd491f629c5279f33
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5c26da21558aebb12e30c79cfa32b0662
SHA14d0919cb6a5d36ac60aa88675e2a9c031f157332
SHA2569178c390003d35a73e660a3092d7e8185b5d3d8d34d79cd473a211c3cf493b7f
SHA512f3fc28463ab32923ddfcde2d4831683d3a70eeefa12a2e2838d5ada0792d0af1f1b3c385d23833b7977df1841e23f6692405b71d30c151e6e1de9cccaf626f2c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD50fd174ea1a89e5fa6924329bea8f2c7d
SHA171b9f626cc15dca5d92dda959ce2e740d88386c2
SHA2565450a99d89db43a24fc0e1f9352496c93336b6b0accf278c8e449f02a45b7b2a
SHA5127e26d038c3d99a794ed1e09a346cfbc4685dbbc1591605d98dcb51307628779387f862439af46d47189f4b6bc8b9e58a6074e09a4b7632c22b7c64a85aa8990d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5c8a644f511cb3dbacb81b1980b67fc7b
SHA1a4ede03d3459f1b9d6fb5c4344c48422973c868d
SHA2569974a18407569e3c4885300841e78864df96350b7f84016df0783ee017bda8fd
SHA512561c401742818251dbd76a13a362a9e627fc5dec2fa398cceaec1bb652671724c6baf4c76b0113aafb2b8e7f5ff5ecb55c8009e451be8009b61d0fa9e1a38bc1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5f8d7a04314f913f0d808e9bb6762f324
SHA1e814d34b7814882c6141d71080763ad92d1d1a35
SHA256fec41233e1422c584a10e3b807d78f046a22d79584385d03ebe9ff02178c8319
SHA512944a3b94affde08b2ee5ff717f59e7aafc41c5e6f5c6cca86ffded3816b19c33882f624bf68740982d684191fd5e2a7981cc733edff705ea674994c2268b33d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD51b65faaedb587ad5aa85bd7e9e526bbe
SHA1223fb9bd7c12ccd50c46ce7ad0c560300e29e945
SHA25629917ceb4e7064755c9f9f78d8ccdfc0e6088f8585ab552aabd592db55d49181
SHA5129d61475685fb25ff9759952abfeb714b290c96acb3af5ef2128e0bc75f3514950574ff0c44a2facb38c9a4a97baffb80015c95aedfbccf9578f4415a7264eebc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5b9d3254f0ab5a37c721de7bbdee8ded8
SHA1c35c55f20d8c2e2f7196a268c52988812e2d24e7
SHA2561fc66f0b104bd1f5ee8cab3b7c83c2b4ffa5f767fb7589d1ad65ffbde1600f4b
SHA512d3ce86cf66ccf89540964de713b7f94b67c10ca805705f0f35125f877d037dbc705390c5c18264dab005b248ca41e1645d80d121f06a95521a48527aa061fc53
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD51b9eaa1264bb94e78b49cfb7ce93dd23
SHA1342a9acd2a2d64fee918633a8557bcb0ece65682
SHA2561989754d9e7b24140c7347eeb23d01d4665fa4d3a28f6599bec458d74103bde0
SHA5120228c3ac363c142ed724f1095432a1fb14a38b00ebd2b4eacc05c31326ce0938a78b6d85eb64ecf1d625fde584d9fb2bcd9f05c297da5550894b49a710d09873
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD54c26cdb245a0231243d78883fdbe42a1
SHA19b0a2da1a6b1e90cd8cda53360515faa05396234
SHA256510c7b49bf43d1d3a916da8c82af510707b77169db05c0cf56cf83fd275f8a00
SHA51205c227452983142060e7fb8cb9465b91242348a6ca36ae3be13d86c78ccec7108247ba78f8dc39f2f4a34d4a55d19f9389cc195a78278917d581a6ac8707987e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5688e58da0139f6b7b68e0471efaab19d
SHA129985fb171a9098fd78fa8c8d214c6ea6cc78f70
SHA25627637a06e69d069b6cdde4489dad530f825bab3fdc3b77f8c6a756dcdbabd90c
SHA512abd5e8cf308ed11917a6de672ba86fa505f9387f7bc4abf2c086c578ecad5dc1ebfebf145caeca704e0028ee25652a7a4b0adf8d2eb6cf477082fd45cffce236
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b