Analysis
-
max time kernel
134s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
16/07/2024, 02:59
Static task
static1
Behavioral task
behavioral1
Sample
4c86f11aa4dc75da58a5c6aa6568c044_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
4c86f11aa4dc75da58a5c6aa6568c044_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
4c86f11aa4dc75da58a5c6aa6568c044_JaffaCakes118.html
-
Size
6KB
-
MD5
4c86f11aa4dc75da58a5c6aa6568c044
-
SHA1
2dc49423358bc8cd788b227bf2d3b074cec74f43
-
SHA256
42ccd7d8d522c0bff15c42228a0cc7b170580794b343537238b038f517ba5a27
-
SHA512
215c416c465c33b76d57308f5be1739192069b8f1a3b8ced57913e91de2b3c9eec37b665b061f58b6524c0c27f30b740f4a4226d29f03854ebacdc3ea19f3b50
-
SSDEEP
96:uzVs+ux7NlLLY1k9o84d12ef7CSTUNZcEZ7ru7f:csz7NlAYS/gb76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6645BBE1-431F-11EF-81BB-526249468C57} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000db6f4f5f1f7f6146d7eed223c68666b9314c8dba6e49fb5e37abb141f371f227000000000e8000000002000020000000a7e9eeee9d86e2b543ca8932d7afb6056b551b405da958e9e85862a9e9da038b900000001768f74bd3c24aa13b03aba1d793700c5b7fcb65acf27dd4b66a4010cf5aa68a964f39bad155dc751fb56fdaa65373d970df2e7ec184fac74a28bb3784edfa98d3472565fe70648dc53f49c2031780e359d0f5f39210aafec3e1fd5c76d10f1812c431a585649ab312f408e888afe50b9c9754eb6914152572bd5ec66e276fd5c09314769664d3499558408d1e676cdf40000000323a03f00a4946a3c92ebba919886597f988d13f27059d4660bfd334c279aabe24e1c75c725a4839a3e4deae163f80b476f915c8294a60c99248e920727327dc iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0ceb63b2cd7da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427260629" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000d290b0f7fc7bc79d2a16b6a99cd9c291b5c16f03d1d79edf048249e9e6823551000000000e80000000020000200000007fa9bd3ba3a7a0dd5aaaf168dab641d2f4bc997a0a6b713652d168292d0d41b22000000088ee481239028caa5ef64fb63ffe30e82ced4ec298284f4bf813b6e28a87418340000000309bb62baf79776dbe8230f9b8882e888abf08d9a2d729d9e1fe5ad65d40cc3c4f9ae9ea265f7aca74f743cff0ce7f7e83ac05f90ac53ed5f1858f1e35abcf3c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2388 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2388 iexplore.exe 2388 iexplore.exe 2356 IEXPLORE.EXE 2356 IEXPLORE.EXE 2356 IEXPLORE.EXE 2356 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2388 wrote to memory of 2356 2388 iexplore.exe 29 PID 2388 wrote to memory of 2356 2388 iexplore.exe 29 PID 2388 wrote to memory of 2356 2388 iexplore.exe 29 PID 2388 wrote to memory of 2356 2388 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4c86f11aa4dc75da58a5c6aa6568c044_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2388 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2356
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a6234e320d557546183d0234c14e6c76
SHA169484a851d1777bbca3fc2acb7a9c35ab9d99038
SHA256610ff390b2d40231d77ded56650831c101e89897dd29b2898819e0a51a76e78a
SHA5128cdd1c1f4af41f750fe59586af78f03804ad2870f67182588267a68a059062fa10efdfdb4901f672ed4ad74991abc67f6200ac2665b4692fa6c2b2ee9455b674
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f326a402b4f0f58531f6a2dd73ee0eb5
SHA1c6a0c1bb1b6d030ca47865a5592446d5745f0d59
SHA256f619312dfa6db84a02d118a835d2bc769fe45e9fdc794c0b80689b17ce1cf458
SHA5122677597554170d83fce69733342678d3a1bb4771470607673c310b9a3e51f8fe2af75baee387336c8d5ef6f2fa254ab5046c4845f7d473857b1a208b3e240c4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ec3a1dbfbf029c8a105338e25f37b197
SHA1b2375e433e20e79821e4c8371ba481ef70cc1db0
SHA25663257535178ed82583daa238311531e3dfaec8fdfa139f43cb8759b746ba7d82
SHA512da9ead54c6be21571bcb139f1f197009b317bb8d7598ff56e7a174e8deb5d84deb766050e512a3c37ac708d4c63c8aaf738752da85ba88dcd01d3389d83e578f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dde73c2c8e51cc97af2616722b61ccbb
SHA1f4f1b9c6d64a549b271f5619f45ec35f79867efa
SHA256e97a10098054871c7db2cca6cd7877c24dee95317cf12a2e9f6cd2a93f22eced
SHA512146d94c2d24d4b2cfa8713e17e3fa2443acf3e2ade90920f67eba40601debd85ad261a2def9e70a425eaeb03d05f98d02478a3f4d9476536a40fcc12839898ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5851f98cf7e7b58fbbce84fa9b00fe551
SHA1139262149a40de253df43b9ee563a73785e80404
SHA256d48eced3b7a9daafb12a4ed0c81e1c0f854ba6e3a6768ef5b746e576ae993c76
SHA512ed6fefd320b8db81fc404a858e74d0caabf799aa4e95d0a75109ffddb73fb3516a13eb89ef24a01a63a0e3559eb514b2324a27b8711c234a778a5843b688ec3f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56f050fae5f8171684aa1f2c4f8cddba0
SHA10dc18b5250bb451be6b6cba543fac6863e2f5e46
SHA256f091bbf8fcd458ebb2f2f466a872557085f772e4cb0f6b2201951402e2b18039
SHA512b39206fe394fa8c0b97518cc26c31e5d3d75932477a123ee550cce3f0933876461f5e3fba7a10e76d312db51ea2216092c86018a0f40518a4d66934760f0c571
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52581e3053ad9d89491365ca629eb5d62
SHA116a25738e15e58e586136c0f7ced1aa063243657
SHA256a6b9cf3a69875c473e977088f24c0f5045e3f52de0bc558e4ec7a48e1a302e5e
SHA5125eccc4879779dbaf52d6883eb1f63cd079b72ea0f6bb5cd038854113bd08a880809b8efcfb8de4e0727d443ca330d3fd51c3cb5e84ccb73f7df95f30a52b336f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5486e3532af8f20f2a798d84ce5d098e5
SHA1480e6436d2d9ebd3d67f49fc78f47a9179920d73
SHA25643f148ae48826440031565f7ff5942b4495f0af2d7198b2cd3ae24b860bf9aaf
SHA51223d1ed4ad9e64b02a009efe7f8db417027ab4aa5a1d259bb2f9ea83f9205ae34b6ad029a25aeea8872120cc4a8f2eb0abeb4e59bdd5ba8bdb3fe37b261ee55cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e0decd26c7320d132780aec0950299c3
SHA124cbb1e99db414bcffe44fe09b724874316999bf
SHA256daeab7a2bd6203165f162f9c1a2635000f8c8e3c34909c660e7fdf4339e54eb1
SHA512bf8ed065656404c1aad48bba860763f261f592cbcaa663fb20bd621e6e406b3f5656bca5400f5b15be9b06edbc4b58d235f036aee9c07d55cef4f81bdd73be21
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d6d3dbc78c52e4eba7575b3942b1156f
SHA17ae81f28438bae2aa378bc414f0dbdc6b9790ea9
SHA256715a480e5bb602562a6d3852e68030089a96324e0f360e1ca08eeb66e35d76cc
SHA51225f087ab28481a3897bd8dd169c6553b2a7b76d12feafe2c822e2d03b4b78b17e46fb999664869d86d72c0da31728f223a67ef6bda68bf92b3d7ec0203623cf1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cc3ccdaf168142e405e5f45f849f3425
SHA1722e17cc1907e8298177cca628e881fd0a48092d
SHA25654f5039bec91bcf6b7cda4890e085f73b827cc23e2b4768d7703f9759d72c558
SHA5122243b8913b371898d09e2f08f5db47559f41353b1da0596238f7ea0ae9aba47583a373a7a9792bf38985e5725235529a1b49a95ff623f887811e4e78b7b49fb7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b31a828c0f72856da87636beb0bedb87
SHA1ef89e4902064e2512460e0a30121277bbce80a76
SHA2564561d61e1b91c9ad73a7630348203b885b94dcd319a74f2a407359528efd1d01
SHA5125eeec45582f8bdcacfee299c4e3273b7318160b4da61731f70112277f65b3607543060b4ec8537faa2173b88a45cfb02b886ac2a66003ecde5578bd275020a4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bff56997029e6022b78d3ffaede22645
SHA111b15f0e0bdafed179a6b568b78f55c929ccbd49
SHA256974731ce2b05d323ab69fb8f82dfb301e1b625a6f16e0ccaf01f2fe8dca9da62
SHA5126dde018090a294e6b3eb3224b7425fb90fc7c7fe9a035d0b702c5ba129b39fd0df513dc1bc7ce0824b1c3678a2624195fd27662b36410192f50dc13d43e98f71
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD558199424b69a99959253133afa7ca6bd
SHA1cdaf7571cecdc4b0731dcedadf07489bb54213e2
SHA25627b6595fc66069226bb1b336f1e3bf25b4593d23a652ae465a2b2d1277812104
SHA51210be4abf9e6f74340f0992d307529c0cc44c0e085b71e1c871b837fe383515bfbce56756c9fd21e6017e197187ce3850dd75ac0b7efa2ee67109aa44074ecc71
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b942074d6f7b7f4c6c5326f834704991
SHA155b7d333ae6f4cc32c18dca2c5fbaf31c65babe1
SHA256cdfe820ef80835340841635568d998d47b15241a83d2bec53eecd3c403bc1340
SHA51272f473edeb8b090c5d9fba124824f9d31749dae744fb7cee25a5041d9bb1dab4c83980744017930620e8cd6ac3a5d40d818797c1e1cebd53720dee070ca2a466
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5626914e1e6d74e544b2e8c9ebc836bc3
SHA14cd234894a093dbe701c1004fbae27bd1f8e6bf1
SHA2569fae3e8bd1d8b47b945bfe4dd75aac59bde2b2ae9cafd56896c5914eec9a9208
SHA5121a34ec8d57c6886f9f1bce801828905a44fec2b876da272d70aa37ac532a14a09fb6dd84b1c130b88a790a08220719c7e44ab3907db6b530954ddc56b96e930d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52be2dde5dedf77a89485c715ff1db68f
SHA1ca8829fe940342b8ffd7a48c2bd338d0b26ec76a
SHA2568d406ab6b1d2d095516a87b3b682fe6edc66f1441ebacb116dde74eb9aab4eb5
SHA5128dbf98ed29f07f02cdb16997788556cedcf000c73808129e1c9bdb38c7b7625e3ccfca79a45e227e570f3b61f97c380a6a64182c8fe61ed083e0db71359df357
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c097031ce244f047dc4eb3d32e9b62a5
SHA14e23fec00838b878d92dcf0d6397a9c2bee5dfdd
SHA2565c9f60d4853cc762f77e7c7fe9eedba5c1851acf69024fc9df7bba83073b7533
SHA5123f0b02d358000e5bae890f4e52d29e523b43ed3bbd020065adc407322829f0d93a25bb931047fa1b8e75bc0ec199cca4d6a60eafd86f15614bd192e3627108b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5772cf8711241094e24a83fd56c3b5aae
SHA1f166b87d7667467355772b6c29d6ae3cfad08613
SHA256519731294bf623e505311e109f489e0a7da841219c6d37e94a88ae037fca5e57
SHA512b45c17f13aad65ad6e405000ad4de53178036cd3e4a4121d78d13925e3cba3b9129cff8749b9df61746b688a84552c4dbfba592235216aaeaf6dcb0dc0550f61
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b