Analysis
-
max time kernel
117s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
16/07/2024, 07:09
Static task
static1
Behavioral task
behavioral1
Sample
4d473d206244a4a1f34d713a949d077d_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
4d473d206244a4a1f34d713a949d077d_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
4d473d206244a4a1f34d713a949d077d_JaffaCakes118.html
-
Size
16KB
-
MD5
4d473d206244a4a1f34d713a949d077d
-
SHA1
0b18657c7b90bc4d625275da0e56499e004b6b7f
-
SHA256
fba7667c9629d2a7966fad269cfe4954994f98f4831383360675f7fdbd001132
-
SHA512
5f080bfde8bf5d030f0dbd5a0ea8fe096aa1b8a2fb3699d877bb9f9c5969f5a1b333a339e97b69b29f08e69a23eb5db41ff0c779ccc5aa29c37f3c6a857729e8
-
SSDEEP
384:So2TGd8h1iveTLF9jSSzSeP/aKDhHmTdPVBG+m/:Sa8hhf1SePi1T1+
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0dc66364fd7da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000b33b9ce7ee5a7a15ea4ce18480d6ff4db04cb9a9c2d0feb1a624654e5e964157000000000e80000000020000200000005d586b0808f0edb27c707896171fa23e81ce4535a8db5e3eaf13261561abefa42000000060181497cb60e4763aa2cb5b48598117f6cb457898a5cfb3e4055546216255434000000048f57a7862a149d0fa38f37952d19099c28b7bce976808665b14691483cd9339baebf3be4c6bf1dd3c2c336e5f82bc168707411e6830f371b5694dee1b6e831a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb47000000000200000000001066000000010000200000002fe0633aa5ef33bbecac41406e4747087895dc9f75f47e51fedd15c178d24646000000000e800000000200002000000036fa9c6e92d97a5b14038e6e55f329b8e3f6c833b98e876f7c20f796f333767f90000000dad3ed9b53d9bf0f9c04b78ea2cb8c47960e7e3b6ad2e883e1ad368c37531fb0cd1ab6fc4d6e61b053018a64b71b27b468693697fc0a1fedbf28e5ac06e10bae4c434404af6067cdcf2401ac2c2bc6e43dac4f6613ebb1fe2c0e227f598256dcee1383ce607cba0898388762ab766e2621594c3ed5b46ddacc0bd86961def78a3af5a1355085dc27aadaf7d82aea63b240000000c2b52117ee6d8a885a3792b0ed9803d7694f973e38450e845abb10042d053837f5f8374d46dea226bc9d60a8de07600882eb7ebd893544bd5f7f6edf31d1efc5 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427275650" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5FAFCCD1-4342-11EF-AB2E-FEF21B3B37D6} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2640 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2640 iexplore.exe 2640 iexplore.exe 1716 IEXPLORE.EXE 1716 IEXPLORE.EXE 1716 IEXPLORE.EXE 1716 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2640 wrote to memory of 1716 2640 iexplore.exe 30 PID 2640 wrote to memory of 1716 2640 iexplore.exe 30 PID 2640 wrote to memory of 1716 2640 iexplore.exe 30 PID 2640 wrote to memory of 1716 2640 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4d473d206244a4a1f34d713a949d077d_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2640 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1716
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5951b6df2f56342c08141f56ccf97f350
SHA1a10c09cbea663d83a7b60287622195c5dac5b696
SHA256f0a7408dfa9eba70daf67b822b0631724abb73e6e94c671d32e2916f1cd5b72b
SHA512586887a385293930aba464e1048275f5113a4ad63cdc691697c61666d49d54032343409cac9263b07835534b00c211a0b860e7275471aa71bd5e3f867048afce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53cfb0f6ef24b1e4048497ae961566088
SHA1da44c3b09362644bfaa3a47e87ce6e30349307f3
SHA256252fbde39c292b845dd34a4c778e98e7f404feec1d96644f736691c411bddae9
SHA512c4ff12542244460274d99021e08b8fa8b221af4e7cbef2d00b31e7b1ef66b36ff98dd28bbc67fd0596ab9b95e3be7d3081503011100bd2a9333fafbbd0729d8b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51d523911176aa4f61c549048686d4fdb
SHA1bdea454b3e11e6c98f9cf7a9558712fffe532011
SHA256a50ca5cae62c5221f945ff228a0ab3bc0f24388c00a6b2569d733f1360b895c7
SHA512369889814e438f34697580391ac0e884bce4f8fdb4730342dace9aa1b27c8193d1593d493fcd7258e7976dab3316fbcc30acb79015e7266d6f68faa805c2b5b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD587b3b6d0df1da0cad69dd93d660267af
SHA1c566227a64d632a4a79cb1117fed83acc7b9615d
SHA2568bca967009808c366d2eef08d90709029d75e3e92c3723df2c1a5c747dc0d1ae
SHA512c0b245a6e0ac74bdd20a761eab7d3f671926c804233cfb1cdad8122cbd14e1972961bcd2350183b04db33d02c4bb1d811f42d103ebfe27a166842568e2fb32a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57f00fcb28dd8a7441bb474558aa6c2f2
SHA1aae65298c57068681e7e8f74884188c0fb603915
SHA256898712de70e7665967f3bd0d0fb141f03042d41a57e088c8dfe8175bc2ea750f
SHA512143cb573e3b38fe03972f444dc8cee171d4da9e2599a9980d8dad944193187d85cd3b839ccc54b2796c43529baaf9baacf080739bb3f38863b854c0f059b5215
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5071abda4097b45e5956ac4b164915f93
SHA1256e99e0cd8c2c57a2cff68d9f927682b63c9a87
SHA256f47ad0d013919b52e1653cc1e6c88d05c8c3b32ae9b6777d07f5b6934ed80df7
SHA51264167a329272dc89d4684c08f93fefc05611b6c67be11487aba6602304ca14fe96b3b00d481246cfbb358b031453198e2ec91498629aea1875fdd1760860bac2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51a5cc0d4039ddb3f7d175c2fb63c16e8
SHA17a8b04a27b26727d7a17dc85f8342d52fd850cd4
SHA2567d90c2e23bf951cc7343c74ad757bea89986bca536fc36888542ece000315ef3
SHA5126423246ca4fc331c64fe36c0f40998d41d1c4cfca9dcb046ac4369ad4909ac12ca4cba7c256d292705bb7399187712c2d63cb978e96e01d3d1728946fb02d320
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d8f3c4232c544916c15ab7b8de488278
SHA138db65496163bf9295d1a5052f11b697d71bcbda
SHA2561c2f10f0df4748147b80821b04000dd13a2d2998c894ca8d9553fccc6d768776
SHA512485e0d3be68a418584004d1807bf40c8c81370436813f2806e67cb4f0847f37b63901f326b8eedefd48c12ebab5172a91b082e16d9d33813227a190f41ffd11b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5efd243943813cc8f0e77636cd29220a9
SHA1476400823da5ea2ebc3827a1b0e217a94ee4b794
SHA256605d948d5619a2f982a028c7575ba0d8388b4b9c591f241905b5f2c1dd82fc35
SHA512d3e0bb42ecd3004718fa871ece6532cd357a85e46593ade278d31b3a8a6411f8da920391f4807e494577f81ff1cf0e87c98912c41a3cb7277536a497da8776a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55835d2fd84b2f2d6c249d5c20ff21987
SHA1cabff80a86fc2a2af86058475564b9da658ba4f4
SHA2565879826534aed901b5b62c354de4b89187298e195b989bbff92f315d1510202d
SHA512d8862e450cff79cd13c0820e0b2e9cf78fea0f296af437872326165c37d09593215b4bd6fd9f155bb95220f5c9ef2b672935f03c0a48da4abb0c5a00ee9a9053
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f2eceab8d4e9c8b6b355586f5a439482
SHA1c38b088e3dcb4cfccdc679a2e713c46e82e83fe3
SHA25623effaf98da08dd63873eac42236092494f72b26ef22e92028282de0d4e666bd
SHA512a055f26063126457b6162b9761a70b461e3c9c600985afbee8c4caa32e6a2a49f4490af4f89dafb42b9ab5c72eee6f2d303c101418710a397ec706faa4f3a213
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d3ffb1d25867c8d6286ec776a049ab0e
SHA1c979f4e9f8c392d5cd9ea2b9d3711172351f2ec7
SHA2560ec7fe1699c1b4c5c6cfea403a5f8e8799171b2654381bac4b2cbb423780c3d0
SHA5126ce5e90905803b0fca4b9fec798ec2a342ffb00c98e3f13307c4f3f8305f7a75b8674b1db1d08ab70ca664112576baadd4d069a8c820e3b5b4fd6fb7902a6549
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ac6b991fe2f3bcdb8f2ac81cf856480a
SHA1a660712d5c488b133f1fcf034dc01833b58ccdcd
SHA256be6ee78e39bf1b5d17a09734facb6067054e69e15cd6e8b53c57eaa3b0c34b25
SHA51277116b83258bc5be62fd39d5447b1e2af6c49afd40b38ee16d9de1f67f627ec06d5704ae1a8fcbaf906d5ab5e3410bf1fe0501ff609ccd7287076126110b56bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD533a850147448a81999aa65e94c672fae
SHA182f867d6a7bfd7f4c8e1d096d26831449eacd2e4
SHA2560e81208677469190fc313ef9a1861538f9e02a3a0dda02526be21ffd8d26b141
SHA51283c2cc424b091321d4fe29cc960ed24ff00b74fc4a9c539fbd810f4b599b844831f0b4a5ad03eae3f63ca81fc4fb0b621fdb2c0fa770ada5fa103b1f968d18dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c5966ce6a6909e6162e3d94ec0f0e178
SHA1df5c6259b3b19a2a46f0d949a70f8d084cc3a6d0
SHA2569bf1a526a7b88296b4ae3363eb8a83ec16f1941ce9128432d8c222adeb2bb465
SHA512dd8b60c2059afba15336c07e17d02c573e4325f4f12811a720e0426be41c3229a423c4d60226d9f0a30c475bb0bfd701280d56633ed234de98e495f157bb9e5c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a995a367c89c27eabe96ce9f8829a337
SHA1184f21fc53706e3c89bb24c998d035e64b28ee45
SHA256332991c8b0f2a419e513a361abca46a00190667f2d6bee665ba95b71715fc085
SHA512165e3d1a4fc004d5d984e8c8f6352d6c0b4fc41328c62f4643835d2021db6886026cdd7e0e2deb2666c653419824aa48b0dfd5f99db37206bd5fe2d3a46cc7a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD560413402d93e2c0984515b5afde395df
SHA196d98a1043e9401663463e4dd3569f8b30ff0d5e
SHA25605a289932b9ffe727767a8eebeb07778d83b9ffb67209cb3f47d60c881a13d89
SHA51275d2e7b4748288c4dbdb8433b51a21ddb97ed549ffab1e01e2ec9430169c7a488689947626dd63f40f532be150b81b9973b307a391238d6df6b20cb265c05af3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fa3ab980647772a3326d61e125a86061
SHA1bbbcfaeb1abe8eb2936bf7d47ab035e036776733
SHA25623c28e3f937c8bb6aa304eb73e162a9dfb27770208a84b2b5e63a1ac9f027ace
SHA512ff77721b81849c8b1e1b905a2cc6bd47cd677af5e24130c91ab06bb939087f163db3527174b81736bf5e753c262e80f3ed9ab1d650f7bf8ae428ffec486ef3e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cb10a46753fb6b33e5f768d8af066819
SHA1eb33b857bdce03aff6dbda62f518f8a5bd4d9ae5
SHA256ba1c192f3628174e3ed3b69b6a1d9d2b3710e630ae2ef8c0646656ac97f1cb9d
SHA51295a526b5fffa4a3129e32d828416a0ce2f84da4ff359888c1a75ebea58808018c11705cfed8218647ec655ff99f0887ed6b036b53230ee9f3cd0d1d2ddd28c41
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b