Analysis
-
max time kernel
142s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
16/07/2024, 09:49
Static task
static1
Behavioral task
behavioral1
Sample
4dc91a08f74a263de3b3319118eef5b0_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
4dc91a08f74a263de3b3319118eef5b0_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
4dc91a08f74a263de3b3319118eef5b0_JaffaCakes118.html
-
Size
57KB
-
MD5
4dc91a08f74a263de3b3319118eef5b0
-
SHA1
1be5d5ddce73c74cb91eb18a317097986d9f6c36
-
SHA256
d3032e8cdfe92a1094922f34666953179640d7bb1eb4db803d9a6ba6d5495b05
-
SHA512
d5c6634690f8a82ecc31d28e44525efaea822d35e34f86f03842168609aad99d7e901945e2c377cf962354b118af260c094c70e3a7f407ade3587700845792e8
-
SSDEEP
1536:gQZBCCOdh0IxCwVOxf/fhf6fCfIfqfUfQfwif0fjfIfXfzfRfRfzfZf0f3fuf1fY:gk2H0IxE3piqQC84IicLw/bpJLBMfWdw
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 208a619465d7da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c00000000020000000000106600000001000020000000498e8f063c7553c77fb4237da68ba6b794acdb21ac159295561f9fb49c857747000000000e80000000020000200000004283d5dce271ae79c5acd40e33ebe715349da3cc765dba03f731ede578b3d9f890000000d7d7081b28a1785233aa748fd1b8baf8350ef555ba0f68da61b51b938bc27c05b214e81be8ac689b2e9f563373dacd2a72199db43a2d2ed720746838b71d6d8adae15681dedda7632067eb59b18364a5e4390e34e436e3e6a7f2b9865c645edf5b11679f3a16c795da7540d72c59dad926bf9d9116b7c21f12795c141012a46c35ff1f74b3432e3ca776fecfbbf3857940000000d0c1e4dccd81fdf2b6e78a1a8f8e71ddde267eb244364e4da9d645851664204413e5060c0fd13852e1a256a808bb19cfcc7be4522ad404632e7629a907ff9abe iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BD4697F1-4358-11EF-BFD1-6A8D92A4B8D0} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427285256" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c00000000020000000000106600000001000020000000e11f074ba790354c9cb0815d38a78c648c96f38c63da2def26bcc99ee2899fc2000000000e8000000002000020000000b5c4db4eb3b1fbaad0aa7061a39419ba4c90baf12df931dbd9aae57bb5a1bfd5200000000e4e7b4e2e238251bd14f79b1899408efe0b626af59b7a3196e097aa54310d9940000000e1202d927826bd3702920d590074bcd3d55fda295a775ea69f17694750ceeaba1bed3ca377b1a4ca9629b2c4566625fb1a1e59529084488bbbca5e340efc5ba4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2312 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2312 iexplore.exe 2312 iexplore.exe 2268 IEXPLORE.EXE 2268 IEXPLORE.EXE 2268 IEXPLORE.EXE 2268 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2312 wrote to memory of 2268 2312 iexplore.exe 31 PID 2312 wrote to memory of 2268 2312 iexplore.exe 31 PID 2312 wrote to memory of 2268 2312 iexplore.exe 31 PID 2312 wrote to memory of 2268 2312 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4dc91a08f74a263de3b3319118eef5b0_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2312 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2268
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD568ab163e7cc8510f16d87bdbd6d2b984
SHA151d3cb959f61c3df6c965c4dc467e26b9eb223de
SHA256e412ef4157bf6583381a7675b5ad0e3b0c74410f1d57b42fc717e3c345c1aba3
SHA51214613333ead5bf3923f4f754efb7349789ee5d9ab71b8607b326c6cd4de16a5cf68cc716ea24bba4a79d2278d6e5876df2e96a07b6c4474c9d93c6384cab864e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD51b1679efe02fb68bb5b3c29cb89d6b46
SHA19270414f2f6d3efcb25457b6c13d0c0e0ead22e1
SHA25614a563aeba46b6f45aa0b3633ce8c50c74b00667ba4ff1f7fec89c8a69bb6387
SHA5128bc67096000783b85cd65009ee1609fbc0d5863fb8d44356bb9e71ccd15488c77cc9c7acee4d9c610733bb36b446a57a93eb5ef2c3633b97fd3578f51315fc2d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD52712844b5afcc7dc3a65d7af24bd903c
SHA15dfbefc9fc4c07cd571aa9245766ba3faaaca4b7
SHA2565e380fa19cedb6cafdb7651ae9f040f28d467c8f72924a2935671db668864065
SHA512368f0c94d15408d27cf504dee03169dce295c5c95e68c1d78ab9e1fe4e4cdb868a0d07699e4d66b8d5014061d3b0ac45deeb7e293a964a8a1dd229b6f8ab045f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5961918cb2569f9b0bc00b9b269b23588
SHA191d44f2d212904d5505d660ffe64464c420468ac
SHA2565b4dea837c3f4bef013c1d02e3c0fb5f6ac2cc03386d7e360aae545e1afa65e0
SHA5127717ce238f2fb40c5e6ba1d89948aad627e0869143a6980936c73d5357a768fbd3ae12c769ff7b370b958af9add53630bad402faa52dbb0d8ec49b7817ad51d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD53dc6b0d04db70f1deba023620ba65c8e
SHA1ff7911043404311d3937fc0d16f0b94c81d8e4fc
SHA2560c3280e7fbe3fa803273dd3cf378b0c321954cb00728adea53737215a5f7eb95
SHA512c7a31acf44dda79e96c1167464a73c194d0dac52b4f5ad4c0fb2db955756ef2e31cc6212a99189d16183d4cf23cb7687d4a1ece9fa629c29788d7e5710067318
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD56884661e55efddb8475fe5f9a6e4f71e
SHA1d3e3714d071c722e01c26fc88c98421bf83a234a
SHA256242c50ec136c6ca0e3512fff99c709b948bbda4542ab5da15300d9963445a3b6
SHA5125e2f1214a5a727e6010d4a31cf1e01ec1311694ecb826af7f30f4943052e0868ba049d97e4fc2c1767046a2bc9d89a285bf995e8951cfd9cfecb323456736787
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD55d2914ce99cc4b7982b74b9930ea2396
SHA152fdca904a5d424f766f48ab0a3403bcb2519c05
SHA256cdd5cb121187b1b72b09f12c50df0dca93c23801849a8469310c4c7b9999b71e
SHA512911289196df7d83dace628b78b3ddedf05f994fe3f711d51fd571609cbb4a174c8e4158b849f43457ac3c1d7f82c1b89327dca8f3d9f03e10c8134a7da95e515
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD58c123dd489b5e11bec3b98df6b2ebdb2
SHA177fd7632ba7200075e91918ac738f760b396ab57
SHA256ec5c8870ccbc2378910c5f5d7b7679d2711369b4ee1f54763e6fc2f8c282f994
SHA5123e9e74fb06ef1552eeceb88c30ac1497171cafbfe82708b83913543f23b95941540f8d4006d11adb97842b1e728be11332a64c07362fd9a33fbf35404107be8e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD508238ed3bbfcb454db0b57aefc3e88d2
SHA1ecf18e7074afedbfd64f2059b276158cc3b4eeef
SHA25698c97ab1f35c087f329fff4453a99a0ed43462c693c6b9677a4bb3e32c84a440
SHA51259f0b162fe2090f01d8e707f69924e51c0d811321744cdf4eb19a8f99f7ac0cfc77e0887ce0fb5b085636567d84880ed24ac98398cbd765ece587c39720a80eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD59a4a3491198eb53288fd1002bfbdd453
SHA142b0287c9372c4cd2d750819e41518bae272caa5
SHA256892003e613012b00f15eee900136abc55f52a045153dc418520809b12d5b3f64
SHA512c4fe7f5977524e56bf1d909c7b578ee5d9435f87efee5323c9634de2476f25bbbc8c85aacf1b024b6b0bc80be764d70f8952ac8b823e046ef123addfd963e27a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5307bc658be07506eb5734223402c82b0
SHA1d292cc3c4987a36f626dfe7e9901b01c04761bbb
SHA256dcabd7a6698e43a2ce97f12be18a49ca0886c13a01c319064a94d49391517864
SHA512903eb142ce242a62a30eca3c7a95460e7061939b7a29cefd382af1d1f0a4dfcaeccf0ffb828efe7794a35ca43d335e16090c889dff5a929a4e47fc7109112582
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5737d3ebfa388a3c9a414d3c61585f465
SHA1d54a448680eea8dc184c7eaf20e5d0fcbebe35c1
SHA25685e4611957a02fa9445c8d79d258843dcf4d8f03b5cefbf278eedcdf81145eb2
SHA512b6d83c6e49c7f091585709fed29bb92e012894c2fe27cb5dd72cab2663ca0cb13ab2e91b1d460ae61731654ddebe6a43f48494e02ceb2fd3525a73afda2cc7ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD50959ccec5310d258d9831bba1a497be8
SHA1c10cd98e19ed4cba740b2e769094ef5c5336c293
SHA256129c2aa670197ca6175e8f44b538b1dbca9dca3a33cb67fc448dc5c6542acc24
SHA51257cc229bef9dcef6307043f2635f132808d8deec81a5ada4557e7a5e962994e2e24a22f426f4a5ada679f0f10d53adf0c14d68eb0d9a36fddb1bbb1310126782
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD52e568b29add0455d576577e50bc754d9
SHA114be61ed2faf22085fceccc7cd2585b475920514
SHA256da1ed4c7da08663e3940c0b399c7993150d6511a3c6f540a64e305efff03e10b
SHA512a726833e4f7cd88f219ea9106bb0e060ee9ac9edb62729c50d1d5dab7ee960f328404768d0d6b0d033287e350e1aa2137754a516d03c80bdcfd686c1a43b6e1a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD521bf18f1c04b26f4ce772af4c44a5003
SHA11dc8906343b76391e5762a10915768ccb627c88f
SHA256c9c363c9ca0da6c994d48091b5112277e50a864882635f54e0d76582da6c3257
SHA512cfc1cefdef8c6f927098c3734de3bc5a775819b3c53b1dfd6c4eefb647d73a5079eba1dc2762831b11d484458acff3521fdc96a44e545a1feefcecfbf8cec686
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5769267593a58e0d8d4e7a656634e2888
SHA11c9745ca77e7e46d624ee9ea1a6c44fa3c654ced
SHA256c752ee3a182f61069cda40d6897e78b89931c89a7acddc760d64d8614b43a0c5
SHA512c5cbcc714f7180d8136677f49bb02fb5f1ce01c354bc088d36eb4322355b2f9b42421ab658ab24ca239303d2ebb65979ef2b256174fbfc4bc078cbb0312f166c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD51956ab9846d313b4ccbe60980c264d40
SHA197a3d6ab92a013f8cf37738ec03ce597a27b3e73
SHA25621eb9a7a4fac60ca6bdf4125fbbf4e0da5685d19daf13785536d8129abf5966e
SHA512e84243e3d5b750ffd5a291e840442755552dbb2fee768d6a5eda9a96e91d14c72d4738fb6ad71065c36084d29ad32ee2486ba0d4162689fc15be996bcac16016
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD587e80f75f6497db9ad422326fe08e0b4
SHA10d32693f018e9b4fc9255f240bd79ea218a587d9
SHA2567d21f9670a5b440fe52a2b7e2336abff3c20141e7240b3a963b03a9a53c5b506
SHA512143f8889e8c6bcee6d782dee59c08b23039aa97f4e87705af82c00e2de9a61db29801a2ebd4e586e2ca08955b7959e1b66d41fe6952adfe44cfe93fb99fff418
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5a04b228f3bc6443f0427b16ee22b384b
SHA16bd39d1a440857c8a2d617fbd718a2d93f3d4c22
SHA256fd34564061e58391b5679f0e38aff8ddebafebc90e1149f88b592f119172e8d1
SHA512427a3bbafd310c850ac9372eaab146cfe5822ad6f4b5ffc20c3075efeaff40f0f7445ad672a6110b6dec504c66b9e10c63919bca50f8e051971d9dcfbf398a77
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b