Analysis
-
max time kernel
141s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
15-07-2024 21:20
Static task
static1
Behavioral task
behavioral1
Sample
4b730c0d01ed2b7497ce79c39e012b8e_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
4b730c0d01ed2b7497ce79c39e012b8e_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
4b730c0d01ed2b7497ce79c39e012b8e_JaffaCakes118.html
-
Size
77KB
-
MD5
4b730c0d01ed2b7497ce79c39e012b8e
-
SHA1
15badd73c5988a5d1e0dedb8e9fc68712ab23778
-
SHA256
5a04ef16928391f7981f4a1c6cd0d7dab9eaecb81e645e8cd8dd5afe1f252820
-
SHA512
64b7f0b9fbb93f8275589ae08bd5c85af4a97204d84189c30446f397cbdb8ddafe439659697a3752769ca1a4f9a6475fca97307ec609cf0bdac8317eea3b8e2a
-
SSDEEP
768:Zcd9QZBC7mOdMA5pC5I9nC4kyHZqcGxSPd:gQZBCCOd50IxC8qxSPd
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f035510000000002000000000010660000000100002000000033c106121eb626b0171c0b5a084602b5af5dc5127f00814147f345e1db8fd6e7000000000e8000000002000020000000c8e899939e61e97a97fb4bbb7c51783e1460747e0eb19ecdf4c5a56a0a90643e20000000da945343c827802059bcafc7b8e1f4cf7c4f4d53ede02585a4e93a47e390f5b740000000631cb0e468290818bbb6c264532becde53cc76acf26a7820797896aef945df697cfc484235b41991c43b8a1db697ee072825c1524166df08d308304632285665 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60a232e3fcd6da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f03551000000000200000000001066000000010000200000007fdfb6633e263b236edc8edef604827c7d1414f669f0b07c526356aa50433088000000000e80000000020000200000008f19cb277a5c110d0c1267d0b845ffd759054c48bcc8eaa9822a2499c367d62a900000003a3f0b069b3b117a253529795891638243698bc44f96cefdf885b32d1acaf1e1a467d5a581a89fc0376a5ca2513a1f47ff1b58178bffa42298ec06dde835600f332a604d626e5a89c75cbdc16d35243bce530e301e4051133c2debed01928416737089b9ef01e1ed61367dda196655b16c86be7ed5a14460753bba9dfa6f9f4471ebf9527cff0fbf11cf7e19a154e95640000000f6d53d93ef1a0ab38c2eb96c239186dfe02a37d04fed6f4b39de17c5ebafac5a43fed861531d7ee35d3d0b6a3b0488919da006bd2de30b18091fba43934e873e iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0C0FC8C1-42F0-11EF-8650-76B5B9884319} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427240291" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2908 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2908 iexplore.exe 2908 iexplore.exe 1444 IEXPLORE.EXE 1444 IEXPLORE.EXE 1444 IEXPLORE.EXE 1444 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2908 wrote to memory of 1444 2908 iexplore.exe 30 PID 2908 wrote to memory of 1444 2908 iexplore.exe 30 PID 2908 wrote to memory of 1444 2908 iexplore.exe 30 PID 2908 wrote to memory of 1444 2908 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4b730c0d01ed2b7497ce79c39e012b8e_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2908 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1444
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD513aae119326991e4793b148ae4e33f06
SHA1eb1a52fc74547624fce2cef870d82fb600b6a3c1
SHA25690db68fe960dcbeb45cfd2c9cd704d06670ebb28c2861821a7c82833a9df59f8
SHA5124e5ed73149361a09d62ea9d46b5dee80ae69b72fffda81cb9cda09ec5efe35e5e797ac87ab12d7ba47344a596bf28b7e0dd8296545297950f950e040e8205539
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fcf0154888b3d458e248af45d54d2f64
SHA1d680b04b5e0b80e50300412e10820f5bb31f9cfa
SHA2560a2a7b08cba0d7ca09c7ce4356cb1b386604a4113c0bcefcb09cce8015032ba3
SHA512cd58d5f65d575c85bd5698a56689921a40199485fe743d681558e2814da7240cc7e87399dd4f23818b7ded0346451428f5bc369d6a44101abd1ce5b5e26e43fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55557ee784fd89dd6f72dab6ef79c8785
SHA10c672fcddecbc001299b2e3603b43abe8a8e9a2e
SHA2569677bbe07180ae7423a3881473f69ab351e484b1688eea8eb3def515a724be5e
SHA512fa9d932c6c79209f7c198de77d66cd7ebd2c3a3bbb3694405a4157601d1a456bd414c3c508079b5e53eb8f55f57fd5f510b5dbaa39acfd065463271536ea1d54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fb5db88af1126c3ff628556c7845d76f
SHA14018acc471289271c5d5efc1328b714d2d3fb061
SHA256532730d04e29b7a34a88b54b0d12728853fa9e148f25d895c8827667eb7f0c79
SHA512f6e353243114b864bc73a869c9ad6ffa43412c0199c8fad7b71c16f5710866cf27f81d4bc2dc7bf35205cddd95b44d2822a094f6eef1f4d16865b780d7ed0955
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c79644e100e4efa55e6cd43fac19593d
SHA1ddcd7c2346379e6d5f2cf568d845cbf28d355314
SHA25650806ad761b5b6b4589349cc13cd18f824f06c5930d9cf9eeb4578f73caadce4
SHA512640a2c1d7666f9f07dde5930b348d2ce7ed7645362445e35c29130314f0c882ebb1040751d3cf4366a534565ff18b1fdeb72804913bc83b52afc6d453b8aa297
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD528b83eabc3faefd1f9765c8127a9a414
SHA14bd063d959c41c56ce6636a291d75e56b9270616
SHA2566e95c025db58e2c2ccb2f39d14db2da745d521d0bd0ccafd35389070c331983e
SHA5123c33203ee6127e1977c74034e9aad493d66f03588b0c130199b9338f71add3a891b260632c3703cd17c3ed5e4ce91bafe6473eceeac9246549e938c89aca5ea7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD555803c09d377caa244345a69b854c5ae
SHA1df6306095749957e16a99a2aaa43c73db6772762
SHA256e9e359e00a228b761e90b753e484c878c1fe9ad3fa576926b8666f852a085974
SHA512e5a2128cd34df507d0c51757a00289679882c0dff333ea7c8b2512630422acfd26bc59abe6a3037cb7133aa6682b2ca19dd28020b44620a0fd4251b011e9b17c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57757df452234db1784a2530874602770
SHA1887169c3c75459fd44b3898e1412759d64ea75d6
SHA25686b9446abe1c2326f94fb84f4c1443080a19af4d01a6ca2e001ab2afea64ea75
SHA51292703a4994b440d1964a3393c878c8c74b4112fd1c2974d4fe6d0caca30c4147fc16d47322ada24e0ce90dab87b1655cabe258613c005d042ddbb665f5d9bd38
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50afb4da5dbae4f40802afbae13a8f724
SHA172d5873f2b25ddeeb5522d74d34317d61aee3a0a
SHA2566f7e904c295990c4ac829ed7ce793e65bd2679d19972a15df2bfaa2e9538425f
SHA512a95f250d47400eba8fb8557eea49315f5236081102b99aae09e8b8ea4f2c4eb2d008c5ebcbe698477be3ee060a0f50201a82b62916411311add815260246aeca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52154a1edec6adc040f3b91304c244ba9
SHA19a25dca64f818c53be8ccfa5779781e7a67e9ec4
SHA2567faef4f2f37f13bcb2baedf99f9bc6d82505553284fa3f18d9a554505fc5ebbc
SHA512f84de3a195d4bfbf8b7118d6f79997e8b58641d492d524e91a56401c873bf583f2147fe261e2d6941bf8dcaf71c6e31eaa3512f2704fbacc849aa551bcd12cf6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58ff7a3056d420a2bd43fde39f614750d
SHA1a4cc49505c0e1d3bb31ee82eabbcf090995e57ac
SHA2562c0e7ed43ad3978ffa92ee25176b3bf0d7d344f5a43e232a4e71bc1483e83dd1
SHA512ed4f3cfb2f5ccca033bdeedd295a2f9270f7174e9313f4719cf6c1b8fd1a46180ca1809f535c29b132ff06f99f94e4b36a7dc24e01ea9b97042b396c3feb269a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59bed4ba82465e3e74edcf2fa28e01ea8
SHA1616ee4d4c2a9e0d5177aa0f38393582a4ed599c6
SHA2562e8ad7b460a2b9c12e876c69f678decbea8cdbf265f18558516cb13e570bdfc1
SHA51274505448e5c8bc3424f83d0c3fc425410d7774981611a89a6c16e4100ecef83b753f2bdcd6e011d05a69a2798295db5afc74c06422f2086519220adaf77173ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD595d1f407b04a0819083b47cb9cf89626
SHA1672f616524b41a2d163c7eae4a1021defc5e1b24
SHA256aa0e1bca5aa045b88ab77b517e6c8af114d34986b260fcf082217e916ccfefaa
SHA512a592982da7f7cdf4b8e7c61d335e64a0af8175f8193258f4ce0b10ef6ba8d54bc1ac6c3cf1117ea1e99451a1d88844855c664da11c6d46c8952659e566a8ac3a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51f1078381473b7e448d49d641249ea3b
SHA17d9cb5bf00f41f3e9d801612839bb6130629b21f
SHA256f09f8c1e6320e23737c6fbfdc1ef1dbd77a1dd7af2f5a3d135b8a982c8bd7926
SHA51239321a795e382577b496ef547a69462f9fa1f91dbbed3d0172ebc7a4360ea0f51e73b79312b6fdbfb48f2c077775505278a513ade7a94cca0806c7ac1b62396c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD577049662bb93cf3c328fd65474b07094
SHA117f50477ac7534319c159e47fe3f69f30d0316e5
SHA2565fe602ebf47ec7d2eb638b07f7ae206e2eade5fa5f839939ca4217c6827239ca
SHA51216d9ca9c9ceb0e3d7219d3c48d2904ffe8d0c93111782824be82c224463943bf2d6c9562bd66646a961d1309fc916f6afb25760d0551f8a5e73834bf69e78e9f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b6224876ee320b197a9c761856314777
SHA161359fc88e561d8f847b1fc2e1751755d8a25d84
SHA2567c9359d682eca25b8ebf993e2740e4f89c611da78293453479131b24fe032271
SHA512e5d442e9124c53b9f0674b120bec042fb37ddabf733c9ef5f6c62d3910c459a02939e6eebba02a29cafcff66603af802b4ed732c81873b1dc1630f1de84073bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD597e172e8e520037ec0debce4fc0e54fe
SHA1ec2a405b33cdf6d35bf5efb5b44fa6c181409fa9
SHA2568c95df313d7b38f6de02c3de27892c71f1b6cf42be0ae84afe5abf8bd56e0f67
SHA51283ca246c0f2936af2a37a0d9358f1229706ce2b3c71af9ae20d36b2f2047f9f3d86c23ea5933ba5cb29f9a2fa496714836d2a0fa1e928b11d64c75d35f3106c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5069fb1f3de2dd072c9658e24f24f30f1
SHA14a76617aad4e8b5db2a70d7cf4f11231321315a6
SHA25647fee5e688e007a15d128b0deb5111e8ff694b51fab3f7b445064044084b6fde
SHA512294334a408104fabdeca2435263d3a20e190b1ecfd09f04ca08a7a788ec454520370a2422faf0b99b53ffe70acff9a0b7ff2562f467534ef182fcf5bc867211e
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b