Analysis
-
max time kernel
134s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
16-07-2024 01:56
Static task
static1
Behavioral task
behavioral1
Sample
4c5677a12fceb98f87d9a275d7bfc8e7_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
4c5677a12fceb98f87d9a275d7bfc8e7_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
4c5677a12fceb98f87d9a275d7bfc8e7_JaffaCakes118.html
-
Size
17KB
-
MD5
4c5677a12fceb98f87d9a275d7bfc8e7
-
SHA1
5734f883cdb06ff792f4977eef80ff5888b9a859
-
SHA256
3eff4fcb52563985917f98310029a0e8c3c8218b3508fd4d133f2385089191be
-
SHA512
b6084019954f178f706b95a288b16df4b466d983743cd7e15261113ff833c95d3d3c08803cd82958da7fac54b7b90f417029b0757c98ee941b9972862c066e7a
-
SSDEEP
384:kHqcTtHqcTv4syZYEzb8E+D5S3+6UrWZlJFm:Xl6TEz4Rdx9
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0c0976d23d7da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000b5c0738e12e2f050bc3d96303baa5c57a86432af600cf6a361b2f3a308674579000000000e8000000002000020000000f02af6738af8798f82764c3de7daffe1bac474b714f702489ee595f3209a138590000000ae7bfd330e440006ac8b93dfd013d3b5cdf80d722130f0daad2a939dcf2fc5292695a59177e2bc848c65f637a5ed7e3165934f22ba2dee8124fe2900f4134a7f1770e3958e783d2b82d53869fb633226e90619efaf5bc0efe39fca93f6a693c509566cf1e2296c4fcd05a4c1c0ec3806c3651af7cc5f1d46eb6878c4961862f1d37c65d83430edc7c38bc1813799d97e40000000fe820f1c4dddeb47c58b136d7c55b0930714e2b41f6293045f3cb46454a4e744abf0cf232fa8687581bac8722e55db3ddc7de32f3266ad7dbc9ae41f55313119 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427256839" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb78000000000200000000001066000000010000200000003958c5e9b31727c48b1e693bbc2ceb4a52964914d72a9a197054274835891e86000000000e8000000002000020000000987e766c4c779606c7c23adfba9a75288947cb61ead223f47f87032a8db332ae200000009f3a758438431e828a7fb4662aa697b2089d8c40cbe2b22244c041f37b1e59d240000000dedbc318c818c9060be214b2142987854443b052c9c9c9fde562fd84d982fec55b8f697816e392fd388fbd67055a1ad069015c65a6a7572661637289cab3f8ad iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{936B50C1-4316-11EF-A029-6AE4CEDF004B} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2624 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2624 iexplore.exe 2624 iexplore.exe 2088 IEXPLORE.EXE 2088 IEXPLORE.EXE 2088 IEXPLORE.EXE 2088 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2624 wrote to memory of 2088 2624 iexplore.exe 31 PID 2624 wrote to memory of 2088 2624 iexplore.exe 31 PID 2624 wrote to memory of 2088 2624 iexplore.exe 31 PID 2624 wrote to memory of 2088 2624 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4c5677a12fceb98f87d9a275d7bfc8e7_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2624 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2088
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f003a547ce5a57555ba2ec35bcff3167
SHA195fa445c4b6ef2d57a0e64a2634b9d9a7d262c3a
SHA2568b42cbcc784589fe30162fcb55e43de54933c04fa7f32fb300aac19bb3894451
SHA512ee6f8cedfeea29f86514dd875fedda5fffa9e7a287dfa90a409e7f1e8f373d6a9f99b0ca00a8d15a12dcb3ad1e348e7ad934c4805fb3a39a9060d0e9ec8efdc1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f097ac0fc4ab8630c95f6a059d45bf3c
SHA101928fc0b8df2c63c0539b31a6ac3ea08afc5b86
SHA25603a6c9b072395915818356c84403c61d4bb59aef64dcb646c3736dc9fc2c0628
SHA5120705a05f523bed8a5ee1ac712ff11c63748fcb212ac3648a98d4f7f950307ec611a72865e8c1c41e9c64fea1c15c3acbb8c08aae5059e9aec5d4c136d54b3e65
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD559fedb4e6a149cc200e2a75403426f53
SHA16c2a28171f78be6407d69e774b32d424daac5ba4
SHA25672defdf207c747aa5a6df42bdb5dbc1176324b9162cf4f40ecdd358bb9fe9964
SHA512aeb26488abcde631286270dcd39202a396af6ec0f6b6fea5993e323ce724217940c755a25a239a1ea2aa22c3b414f44f9fc3703502a2e0cef1baae12c637241f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56e576c167e096e9d9641b366b8e47f3c
SHA15ebe632796ecd23955617b0576b2efb1bd834665
SHA256555626f0a8ede6fa52608303008b745f38e047382d28b1bff943d2b63ca355b6
SHA5129ff2e850576e476f744113fd4f857d75f6153621712baa75a837f98c541fce6b7dabc265afd0a8b2c451765b622de5db61ad9a1d89de6421674f01b9f08c22fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD582270e42b0a20398bfe19ccb5b5e4ab6
SHA1c64943ddbe263db1558ef0abb6f7668ed54047f6
SHA256ae2618e32b73aaf9d03995745e1ee5c0732e29778215ae5d700851a53b09fbf1
SHA512b8d9089b0b0a3da1217ce3cba8f8d45363de6fe4de43e24ca5d51d6558b070dcb6a487e3193dde666a966b557060ca73edb58ddd97dcfe32b24bfce07a087553
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD551fbf7664395cc250c54edf90cd6780c
SHA16b4254d3f8e812f0b60ff55f1291ea4dc60f8e39
SHA256ef682f069c85a10d57abbf54d2a3c45795434513a2a1036f24fa9b078eb9451f
SHA512f4b8681544fc4223d3c7d1638aabca9669e7d34de7c4b491b1eedca720117e09561e04f90b9b394ac68f39880f912041df1b10957812cf0c9d46f63a0b49e64d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD530ed61dfa4e5f48cad161c65beef39fb
SHA1dbd2067ab2f2643ee7ec0507fdf1c4433dcb8e21
SHA25657f2b581cd7f7a27f9ad440d12bb710e97d86ea85a1fc34b32f87ae40e4c3da0
SHA512b5b33d5f54654af1582a28d0d8f29cb73a84cd7480d9e2baac03ff860469e5c3cbd67551f8f9602bef3fb80ca7afe39d3d9812bb6ea2f4c946f831005cdbb412
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD545b208b20c167b68e78d69a427b58ce8
SHA1fb1e52d09d0ae5a28080e8fb0006d7730e528c20
SHA2566ecc3c7ef5aac9e2834d82fa4431b1fe4310cf4c1ca9ca9766ca83e2b173f533
SHA512957bcda502cb7e4fabf36ecaec6d68e05e94c2cf2e032187cafd001397e626f305e4e66d1308e67d7614b6059be5407c6668d3861bced17b1a07b89c209cd02e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54b9138c5f762989e82292ccc3c75733d
SHA1b56bc3667c6b10c5616aca7a307694110ff017b2
SHA25631410bf1abb9771a15fbdbc5bfef4defe1dcaeca68886e084b0fd0e0f424de0f
SHA5124dadf58b7f0cb7f2199f15ae1f01e22d17712a05a19ff810a7d851362e0f5a7e60bc488646d533926947d36dad7aedb98ebb4d6c0f78ab6ea78a4c7e95592c97
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52ea761a81ba7abe85802e169a543fd7a
SHA1aa788f2a7552cc7544fb586ada72225ded08f67a
SHA256070ba24ff61cf53054791b316ba59158bdb6aa512c0cf334ca3146e1550c0d8c
SHA5127431e55840fe04af6b10564c7c98180c7a14583c3861125058413e34a7456dd58df0ec5320d6d8ea2259b7c9560cda95c4ae38f74a554cf8ca999f65d9fda2a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56806300f0a26dbc9a50f3d4dbddb2ade
SHA15ee8ec8f353e3e58aa25997215a140d61ba95a69
SHA25675dba93678aae55925cfc687e289362693f481af21ecc6640410717e3123fd6e
SHA5120986b7021918352bf592560a2df4f795330074eb0686eff468f9447e838785e581ac8102298c7d9270eff19e318c8e8d6f064d767fab737fe6fd6d3a4b239307
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d81cf79a7f054769f0c694375a6abb71
SHA1aa6e7e7b1b904a7d13938786942c806efbdfa6e1
SHA2565753fdcd78435904402a8e3ce184bfa5d28c1fe5f4e5bfdcca37fbaac8bdff46
SHA5128a5f766c71d7c7a0c6093e5d62829620473152a071461f1af36a8d81801d0978e1bef3ee47b3496e8bca44dbf4981997792e0ec72e2244d73feba753fbed0de0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53bed075353d2c665e7afc10b3aac9f7c
SHA14b06c9f5ca6dab5b5971434f8b15aa472c2e73c3
SHA2565203d794b942eee959947ce927bad677f4ceec530d611bb7b403610da6da62c7
SHA51205af7a94a3ddd55ef83c36bb521a0b153af2438303384f41469528d33004883c74a3bc3f63139ec75116f3079945ddd7a4de018522687622fd8a35dccbbd1666
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5743fcdfa97980b87870fd02369178c63
SHA102252ca9d6cb57d2ba8974fbdef7e7a43f308393
SHA256daef92520540df18e1a0f25e0761f64471c005208ff4b17be4fe0209b7125fc0
SHA512986b5eaf49b6572d4645a440549b81d7c9af379409e11141589771e5534907ad827cdd74ce5d5bee934fd53ba8b6c7eb862ed5e509b79d5d38799390067ea611
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b21f959a0020d28599ae3a1556ab8b17
SHA14130371cd2e0123e4f87a2751284cef0f1b5072b
SHA2569afb5925ab3b9f36afbd63120caef9f41f9af8b2791db77ff2fd8ac973cda631
SHA512cd4befbc970122bb8e74a0519870226abce5a8d67b6df29439b941af5d5e1aec4b6a1fdbadc1c6cb14cf1a8ba0cc7764e97052df9c04fbd6e28cdf4cad9e9a6b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5439258e8555296fc1e2167c29c307e6b
SHA175f3c9158533bcbb1aebffc5e1b8af7a86ae9b7d
SHA256cfbed9dd6727686b6b6f389abbdf8c94e06336cfd90bacc39897b52a902849c3
SHA5123bdbc49127b21628a570448b0f1b42c5c1be455999eb2d951434730a80225c28f4a6b2322457728f7e506373f92fc75296ae3bd0f1cb4ad1d8dfdc073124017b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5679eed02bd7a26e23227ee5df0259da1
SHA156528da70e2436b4ce676e582e3cdb0c96342d3c
SHA25675fd3c111e0848d5b8e7caf19675b3787b561e04e85c4dff10c3ffa4f91ef70f
SHA51269dcd7221422a261daa7dde239c4591de75ff2746ea7d278565d4f2d5fbb68c5253d206d06bc230258469882c7f46af0bb021dc96de644231ee4ea327ef821f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d8beedccc97d69790945b96288bc30e9
SHA16ec895dc014756f270ab54b270e7e79fb3a4517c
SHA2566a6c4856a3bb601c810d394020b39cd8bf64350c527bd3a45a361e26b7e7b401
SHA5124f0fb1e3d267b0ee86f1d73f5d01a694450f21cc2aa261892ff28f553d27936a80dc43a43f3c4080322c940551f6b2f0967f77d1a8a05b78c049446451d9b66e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5048a2eac0faffe9c5edd6e9498873e81
SHA18081024924e0f5ceecaf0ffb23653c54b5733dde
SHA2569a499e7b6db18964fa1a30bced8a0058faf923c0018ab9af4020ce616527be9a
SHA512c0b5bdf5ec2179881b263924090d3d978db48af998bbc4d6919864b7d44605ba7d2bff881e88fe2e60576b0ecedf3b4ff1887e664822de96e0c2d75866d3919c
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b