Analysis
-
max time kernel
145s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
16-07-2024 00:38
Static task
static1
Behavioral task
behavioral1
Sample
4c18a4381355c3fe8bedb3bf3b10e702_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
4c18a4381355c3fe8bedb3bf3b10e702_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
4c18a4381355c3fe8bedb3bf3b10e702_JaffaCakes118.html
-
Size
57KB
-
MD5
4c18a4381355c3fe8bedb3bf3b10e702
-
SHA1
0251f236de05173680684f477cfb53d8a3587286
-
SHA256
1a1b052d28ab08a031305fb3638a286aa10d9566570764006309e4096c4e07ec
-
SHA512
074e0001ad07f77b7604b402f7842e4f73329badf6ee2809e45d2a6fbb4ab411932950b97fe334b1e55a5b37820308f9677b539121c43b31c54671c006963263
-
SSDEEP
1536:gQZBCCOdu0IxCqbUMRqQ6esNUxAU+4Wa/uJLgGeu4U+tc74odv+lvYqMWObUDWTv:gk2c0IxWMRqQ6esNUxAU+4Wa/uJLgGeA
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427252203" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c70000000002000000000010660000000100002000000021cc355a7afa70f839dc6e3587646086beb48a8d20214256117ba664ab13d7a1000000000e8000000002000020000000176e1522de6abd777c83efba1a93e1cace56c54dd534acc02033296676b1479320000000fe481e942ee2da8a026100512a5b0e6f883aef496d9542fcc1627d22516fa89f400000002ef48db229c009bf960231bbb65eb0ff868e766d118a1a3abb5cb6d99ddbb92bb998321c21a7039b62728506cc1c7f2c1b0269911425b2f8f054f3e33ecf5240 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60cf8e9d18d7da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000ffc692bd443bb28990e5716ad35a84e4983e2433322afb7bf5e39c89c7e2e9ff000000000e8000000002000020000000a6580b960ff7970a6b443f12b80779901f72221f0f339ac02d8478f95596e03f900000002552d8afdacd44c9dbcf7a7d9c86257e25dd8918346a7603759da6661292999e40becec27d3047b141df320a94a2a1ba496eb52bfce9e094de2252f24fc7e401abf94f468bcdccd186bfb1ddcd40ef2473648ebccb4c1904f620ae7a28938c837c0a30ed85ba51ea3e720e63882bf55d822b1f59e052d9732ec4a585754a0dac71089e7a9df50733d2dc6c06aa63ced54000000027753bcc39f1385b8014ba6a8adba7602f340be48d02306c4b904566112b59f972bee6ddfd72eee6e532b863f08b4cbbe08602e255eb04ce54132b364097119f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C8264FF1-430B-11EF-90E4-FA57F1690589} = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2436 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2436 iexplore.exe 2436 iexplore.exe 2828 IEXPLORE.EXE 2828 IEXPLORE.EXE 2828 IEXPLORE.EXE 2828 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2436 wrote to memory of 2828 2436 iexplore.exe 31 PID 2436 wrote to memory of 2828 2436 iexplore.exe 31 PID 2436 wrote to memory of 2828 2436 iexplore.exe 31 PID 2436 wrote to memory of 2828 2436 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4c18a4381355c3fe8bedb3bf3b10e702_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2436 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2828
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD589b6e5936129f3dad6877a16c228aca4
SHA1cfa2b854652a2a494401faf3e7a0faceba6505c4
SHA2561a7350acf55296053dce764aa16d04593d9358c88a4e6b5745fb5f48948af47b
SHA512a29935edebe85eb3ac0cb29b0912ccb42beba85e684bcfcc48245cb935a76bdb2d3c58483e92213888ff45fd147e9fc79d82b00c7d768d5d3a89789f50818587
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5898f6e70aa1de069f30da2d911408116
SHA11bd93061c128a953ce569beb85a367d1a2241110
SHA25665319b4901e8fd898512702bcfb64edb2e39891306bd973b386ef57b1c7f72a3
SHA512847e2ca3a42ae0dc724ae8a580ef9c57383693afa8e22a537e5ba29c4b8b8880ac61d1fc81dd719a0272897528489a33e0b82043a013a35ac011910a542eb3ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59f66f25abd3ca89e79dd57c4a348d1b5
SHA1219a16351e4a907868892ec56186571d979f1f16
SHA256ec95135f77c7c6c795dec2934a439d2e3e6ace596c29b2b5fddf1933158ed966
SHA512d9b866fd570f81ceb8c6574f08a9404233f24ad444a979d8bd1b7f6d5fb732967fbd40ec7c127781d09eb7a9382ea3e5074f8d8c44e99e524e8bb20ae69ebbf1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ec3ca795410f32e17bf34ff3c08f48bb
SHA1d8c84ada6b4ee8b908c8ebe7123d71eca6bb34e8
SHA256a96248b728ce047e4c61a3fb6636810b385fd3d2b5b39f3ca4b054c22ebb97c6
SHA5126abd897a43353b4715f1a5b1baa6cfd35fc31011442d4d938b995a7512a4851ea2d7110350494b903537a8edace07acfe1a4bef80468d480b4b18b14f8945bc7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d38d1d00c834b2fa06b5814b532074b8
SHA13fc9839e49a2d4d6c7aa49f4157e6572815a6f8f
SHA256d98a9039a8bad0593b3489f50824a6068331fc813dfeec22230f75ac37bfdcc7
SHA512df2da295558c3d63eaf319a5d727b58e90ca6def1aae8e4fee8231b7d690a357b3e651afc836bd869552a0e09725b7e70882f059c7bc193737d097e902f46da8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55003a6af237f5ef060419aa7c7abc4d9
SHA1af563565275276046d73db66536c9b32a8e1eee6
SHA256076f9c4a76db0d14c63c70e6347b26249f30d6404f2f23cba5fde7df707b5384
SHA512558ea3703233a70b35a0be32b8a3920645591bacfaf4b1120663557ee38b2264ddd65283ebf71494317647f4f3dec4ae362a490da6fdd21c7c3e27460765b5b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f68625afe23aab9172bd782039f03553
SHA1314833a0f0dd7137ebc3a161c1d1d63874d09b4a
SHA25671d447b46ec0dd511a914ca73b75899e9652dded2b43a41f7abebcb53772fa13
SHA5129e82c1bb8dade56dca0a345df8bcf3d6e8d26cffe61d1925810fa35dd32a64ff8ac82e6884298f5c268ddd6daf99db9e434b0712854d7c18c77493ede0e9ab8a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD509fb230a2d2618d548085894064d9501
SHA13df9ce4e45c0c9563f31dfcd19e8c3758ccdaa53
SHA2560276c39dd21ef1842b18b18fb1a79e590fc3b6ea843f64149d057e09d09b35b7
SHA512a2906894539491db904a4c4015d972c756dfc80f798170670348de95d7f6e39ade3c02c115d2ae0e2f2b5b6d9143bdbe9c6220339e15c44c2eeca274bead4ae0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD588e892b1a6f5447cf62e179bfa59dac4
SHA11809c2ff44f3e560d60cd6ffa532ca1b3995a60e
SHA256770be99713a5ffcae4ab555540c9eb6b340042575d6a8b228326f837af512f9b
SHA5127b76955707d302261d831c6512b29279deaf0d88db1a4dc491f631e7dc0ff59622e0712042a19c5c5636b63b49878c55a63aba9002ada1dad83b8a989d8f6748
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5496287865d1a40ee3bdb7d1a2f56c836
SHA178d94e5a11756508533c204968e85fe780a9c0c7
SHA25678e6ce79f62179878795cc44a384db5cb63ad9546dba34eba9843bf71cb5de0e
SHA5120bf2ff43c61d59cc09948b0b5d5b66a3d2712798c80acfacf286bab773a35a9d7e6ff9f3bf9251e3fd0235f770ce547c622cdd39daa5c1f89a8d69f2e0582528
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c04a53b5cea116aa162e88711d9cd897
SHA175b9e9fb4403336388b5513ebc82bdbb66563604
SHA256c7606732eefe20558da7418d30d37f68cea94486585d5aff65cc4945af5fac41
SHA512e70a01cac5fc3ed169c67f4e880d951a88976440f675019bfdaa270638cda03e3090a05f947a44f1334e8fd8f8431c037b5c0878ecbf049229e5617250a5779e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53a16519fdb40f3f3fa2bfb4c274cacc5
SHA147290de3d020bd98c89f17e8bbf0e92b9807aa46
SHA2566e86cbd5f9a29a2e45c1b1855ef82f5ec8fdf12743c5948909a33b0246b76fa8
SHA51241945f4fbb58d2544fd0f3b8008096633192a874e4662fa838089c60683a559a08da6ea2137a792d25a130c44d71fdb3c28865a06fc497ad51020e4528d643d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58b174f130c6b47c7cff9799d24602b0f
SHA1b85f56e02a18e88439699ed3103c192ed0bd5731
SHA256260bb6761022624cd877b93f63e2fd20e45ba8050a232a58833338f8860e98ef
SHA5126f327e1218e84639e19f576377ecea876abc1b8749f7938788fa3f9aa8c886bd835434c7bea803a378815fb763d39b3aabadd6ea990624ebb3c7734874ea2aa8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD588b2f262ebf69c1a853836e37a249457
SHA1003b3af80e7e3a88f77a78c1493173c949a54432
SHA256bb984742406412dfc7a830fb13e00c82f8663cd36bc8982273c953eaea62fe51
SHA5127d456365829810f5a9fcfe1d8f81398cd819d060828862bc8fc74253a991169cec572d02f2bb8760e7c4419d13d4aabf6b77756b49fc6da030e7164c3c34da7a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b71e9ac7d6d000ceab548215db3c8f9a
SHA1cbbefbb4f4814cbb46a3387f60594edd0f198b2a
SHA2561f760638949c931cab892ddee278727192334a15bbd86add0cd927a9116bcc7e
SHA51272cce3bc6268508c8922fcc5d46c9bed49a582ae38cad73e2759aec60e1d25eb59eb0d268fd5145be27ae4c872377a87e6ec2e93e30bdb1f4ad9fb195071139a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58b8d74b710f5150f7c767d9e27aac335
SHA1b2ddafc1660d2253f1fa432cc461cbd183f075a0
SHA256ed9cc85d873dafc1b9fac450154bda86b66a4d6a9759284949a34d6cd5e3110b
SHA5128ed2fc87a9cad770574800e13a0ef98c307c26d5e7c9a04fba3418b983e34e20a87a819a58e0d3cb5fa5f482dec0f2f21a8d05fc71bf0b40e48f3e3cafaf3334
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5abc737a9d444288318b7af1881b816c7
SHA17dc9fc88f749031e13255b21cfcdf85bb6aefb0b
SHA2566b848021f29709f0fd10757fc860dd0e90ddd50c9659c1a6ac389167ee2f3522
SHA512d8589ed586c0fc6b9fe43250ab02be9c6953a3bc8d9325f9835b024652df7358753e1fa0a5c63331a1663ca6e46619fb9cced76325000e70ded045c412788b65
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55954d1e9973917288bc519e883f9949c
SHA1b963173ada47610d9f03a3bcc919f34d16474eb6
SHA2563804e78097378ade7ab2a375b60f78d8a9a4bcd05bdc17b2514861bca0631615
SHA5121066198e45b254cef16207b2b85843934c6c3996fd6f54d4d529f2a94bc08144d06edecedb6517ff0fbef66314c3f6ef0ca15d6ad60aafcd13480bbe44a3cc34
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5172a30d32453c343175cb5462e8fcd2c
SHA12987d2d5905a2062b5ab73835b4dbbc8e0ab5202
SHA25620e401f3c04de84e62b381184321fdde53b7ea6f763f0b16f67f5debb2555e3b
SHA512bade95f57417e6ee667a71af432fe5cd447db860c45d22d23a5e9cb6fea3943d1d29757ee79f952d8e6d27b772eed35ddcb5fab33a4375cc20f3f0bdc4494dfd
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b