Analysis
-
max time kernel
133s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
16-07-2024 11:29
Static task
static1
Behavioral task
behavioral1
Sample
4e1d6e80a68604f7faea11bf70a09e8b_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
4e1d6e80a68604f7faea11bf70a09e8b_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
4e1d6e80a68604f7faea11bf70a09e8b_JaffaCakes118.html
-
Size
26KB
-
MD5
4e1d6e80a68604f7faea11bf70a09e8b
-
SHA1
88b4d3e7dcf62dc97687372cfaf7e0d89a77d971
-
SHA256
5ed849e2ef7770f889fa9b5d0dd9f0fe705e500833139b683d35f2642c82e73f
-
SHA512
bf9153b536dfad8a36b47dbb9fdc22437e9cc8003528e471ab524c54f993cccfaded4685a65987a01bdbe40fd81d25eda09de0bae1cdc0c8e927c3d7e831487c
-
SSDEEP
768:bjPQ3DFoULPgPWbPB79zO8AT+lk9F6XaAmaL1z3ngnfhQNUhvZ:8261TS3
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8016ce7d73d7da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427291230" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A6AEA011-4366-11EF-A3B5-DAEE53C76889} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000a66626b7ea1e91532f9db43a9a30503431c6d3e63b564c7378962c3dff4d62ba000000000e80000000020000200000007f63f208ae62636b52058b6f3434cb137760575c14425837493109324b05843d90000000f00436bacb883312331f503b8b14c43625843eb2ae5520a77bc89a7f7d6a0cb23d2e7a3a1e3e7444b15b032a24464ee969a2833c00a995710546caeefd5658bb9a2e0f08ae72c84b89403dfe4b9beba8a1739f6c3a7a9439eb0b05e4ddb1d1065792615bb2f6cf3a2f7c2bc5c1333a18276beb4b614404a9bcbfd974b078a96a1ddf1e93079194c99e78a628545887ca4000000063406244a60fab9c03a323c1d345ca7961811fc4278a8a932f0f0e0c967dcdddab9e8fcb061efd42f92c31b2da0fda25d0df25b6b0ea0c1d23d3166d24f3dfd6 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000d4a143681b4c0a09b94704b40c98ddff58a3842625e1b08ea437357196aef395000000000e80000000020000200000002052cb1109803c10eedc952d91f58029c8afd5341e19d8c5fad260f5d847b94320000000c3dabb2a20c1efc54c89be18f36cd3de16a22619d75d5ce3507d28b06c3e8a88400000004198bbb60fa5bb949dbcdf21fbdba2a22aa994f2c568d18326c268ddbc222dcaf6045402eaf1d0892c6d4b9d8e176381512b1f21a8521c5f011fd070b6c152e2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2740 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2740 iexplore.exe 2740 iexplore.exe 2240 IEXPLORE.EXE 2240 IEXPLORE.EXE 2240 IEXPLORE.EXE 2240 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2740 wrote to memory of 2240 2740 iexplore.exe 30 PID 2740 wrote to memory of 2240 2740 iexplore.exe 30 PID 2740 wrote to memory of 2240 2740 iexplore.exe 30 PID 2740 wrote to memory of 2240 2740 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4e1d6e80a68604f7faea11bf70a09e8b_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2740 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2240
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53960939b20c840b7a5169d995a520e54
SHA18eaba4ede4367fc00ea6b570ea031d478078d3e3
SHA25630be0cd762814be3cc69b746fcdd90c5ea772a799f5fbf02534c689508790536
SHA512f3a055e8715350b060ea118a32649d9f0fc308d707f594163a8382804621bf405959d25d646b885c934899dbcf3a69137e8350e37d3a34209b1e6e68fd17d8c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51521c2ba5615b475cb86e8b624e0b9b3
SHA14a0e462f72d6240be600baf0bc381eeac0b7088a
SHA2569334265b5f82c22db302c1f7054ce3a2b61df5a310136a72c4170590f7f60103
SHA5121771a288e7030c66c6de6f58113940aca60db0eb4471fb9e2c100a873a9206cd85085fb4d011c0d839265459d71cbcfc00f6bd2192c449dab4f807ee323c35b7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51710864acaeef027f661980db5b26f36
SHA1ed7a0e3628cb31b65e7735d483ad1db72c825285
SHA2561c5b446f4d754432250793528fb465f9926e4336fa57fcbaf65055414cda4ea1
SHA512b1dcad9770b866c67cd34e82ac99886e25a7666ab1411826eae238f3e0be63150a1356d3d3ea7a79a5c5c035846877b31fc28d1efee918f406f5a7bb676d4481
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c47f4ca826422c00ac6536b7a4d2135c
SHA18c99fa2db443cf6068dea17ce2781dc9df0c5042
SHA2566145fee3977130a2c8e72c4c7606e73eab55b3824ac05d39fa034f81cd054be9
SHA5121ab5e11d431feebb46f8c0d3c9dcfe24f0ecad96ed17fe2b678533153180e6be794782c6285b23b147769c8537d11e102897a8f2160738214392eddd6c827776
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50e068c9a6cc6a1fbddeec5e9aa93d570
SHA14c6f6771482294a2f4ea1da3a413528f472e8b33
SHA25663b9c13c541153b17480188d04de5d1009310d72cb75fb217bede3e513dd9925
SHA512807d46211f3c1d668a1e8b8fa85e20aeb4a9731a36ce34190055502c7cd06aa61ab9a013fe39f8e44f4ef656591e56984ea88d486c918dae77790c600e1a7b3c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f8d2a6ec208b759863d942488744c759
SHA19cda6b698cc26f388d622af8b21ec553dd626f37
SHA25661a14f341d49fe12ce3c7c6931fb6f4f0833303af71126895c7bc525369181bb
SHA512ead0428722dc36dc95b4d411403c87225c4404abdd5c043fa3902fb1c4ccde999dd6fac255160fccbe720866eff8108738e6ec18891f401e43c658ef5553ffae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aa0b2abc640341e967f3c81da2f5ee42
SHA12688580e1fb6c7a524b67a95c617f1b58adffaa6
SHA25614ce844f78e42718b6525f191f9c650e13c2485f0b3624ce5b08dd69f0422189
SHA512ab71232e23345c18d09b17f9ac4c5ed04c4b0662db42f4511ece966a1fbdcc182fb4400326a62684aa7e8045a96038b848176e75b8110b5eda2e3a09240fbdb9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b4dc3179a58328dcdc89019f03ee623b
SHA187ff37f18f3902a29f0acbeec865868b729457f6
SHA256c26ccbbb6f98bf0dd78ac55acab476430d943a71c11e015b72ee4774596b129c
SHA5122c98d35966b72abd1687fd0926e9d2b586821d5827334d8a24042d004097f571d1cf5cef62d773c1e43250d5a6ef1c3f76809bf1cbc5bb45f68d7723238f660c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bbee04bead064dc89ab680f692f0b54c
SHA1eaf92e24308d026493d3a29e67183105cef3342b
SHA256d8a694e7d77f69c0359f0699f8eaa36dd6b77d392f71267a596d33d14b1c7c8a
SHA51264189fda93a823e790c38603775e1fd45b1580e7948c1fcf891a482b20556149cf5c458d61db4bba49437bc684e9b9241d0ad23a84bdf4bd4164c8aeccf95547
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52cf9ed642ebe35e61950a17ec6f074a7
SHA1c317900b90bb87ec573cd4b1ca9ef31b71e06c7c
SHA256f134f9e61d1c1567e5b6c7be0e94405a94d355fda0058e36069738c479812a20
SHA5123868cc44c97f5a41bb9d8a9868777536af47d557b6aee2906867701ac4670103fc5a5fd28c61dded339bbf334da2d59a0f59661cbdceca78ea48203d15f4e252
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59d4bdcb7bd8f4acabde0a6e92c9c35e8
SHA11dbcc6e3095ec35754ad2662abcd9db6156a246a
SHA25660344748944638569ec462d94ec5c4cb9dcbd1279e2d24efac1be558cf20fb49
SHA512ed8cb90851a8d2e864fd2cf7fe56e3394751477d0d958ef08adee1e4e7e17479a0c3feac79b5af15b0b8fc31623edbab1f2ca3f36250aec630d44593188fa17b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5703570418bfcbc58a47db8dda6f98df3
SHA1c60e446de6ecabd5acd100a31478303d9a71694f
SHA25684fb595ceeac80c7e9466f2d9c382354179e20198ec9bd51038acb20a6d809e3
SHA51277c7f71736ee8bfadd671dbd205cbd60a687c3713ba8d197700b8583b0cc3a59b053728072e8fbe4a14477794f10ef7af4aaa52a014002aabc348076f707c402
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5090c7a41b9e254f3864d58fac6cf989d
SHA175e18515d7e160adf556360799b89359419ea17f
SHA2560cb8d632ab1826082ee058968baafd99d853febe86de80e959008665eb3242c3
SHA51281cf2b32eb45138456e572e7a5d4aa64375144613ca19ca1d4766db0591769fa5a12d5b6bf656c61e20ae2aead52f8e3c04bf46912933fd09fee61b46a501e20
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dd648ad273960cf919df7606b98c343b
SHA1779e7a1c9568149f9059e9364a95f50b0631f223
SHA256a9fdd005d8e97ab766137af32bb8035cfbd4fb7098a42626b866285fcf08498c
SHA5122833f1bd296cdc88219d5a1e31448c94393058084ea718b6311788f40eb5b9dace09807514e7a67d29db138aca081c346c7cc13538b5135825d0c0a527a55293
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ff8cc16d470b1562dc88130fd8184124
SHA18d8ee4b76bb282c8b3b940b1f0e6769ae1998558
SHA2563ffa661e2af2ee1246339449c85781c371f25d9e11119bb9ffd412a3329acf28
SHA5126611a24626ec78ed3bdaf35349001e1240a8908500f85ca513b03d7a859dff5cb52e192f97e0bbbd6b9bd59102124f8d24bd01b42ba82588c7826ea0a58c5e4c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fc987cf45ed56df222d25e46a683a752
SHA14b63b17007f637755f585025335f15f65ec5063b
SHA2567c1ef7194bf7a5752671813d971ba2ffd99f792878b3ff8259d023fca747479e
SHA5123c24b187f02aac1bd657a0e176e3ba07263b5258500da83bc90d8835a9488dc8e846e3dc6f6f02aeae0e7c989bd68f1c64e8b95742cf6ab81680e02c32f0f106
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53a96c73566d18b40431b6bc7aa5d248c
SHA15995ab812726331e8cf4c87d310bcb5656ee3d06
SHA256c2eec146cbf996d09eea5ae25c8133a59cb1467077e3bd4b8949432db1eafc3e
SHA51241cb31cf91ba5a920a174e0a7aa200d5633a7348361f285e0e70a42760f3aab22099aacb1a513118c0aac79f21eb5e9ee95eca95d7db9797b07b46b2d18f3f6a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f0ac0bb5667280255019d1718c08e9f2
SHA141af0db28d9f8606d76a3777d7334305b92eb6a2
SHA256fd46560e725888ac0f17e6cd54741cb328855251ac6a1d7e7a8282c4155acf21
SHA512e753c9f4d1d3cbea3fe80ba1951ac540d5147beac8f7f57719468cef887a6bc2c05cd094e2c5e036d681e330bc5dfbd1fdff730ed7a4a84958ba00da0cd1d2de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a7c2123ffdb4700b4dd0e15d74f69a44
SHA18fb160593f31d30622ad0d87127dc5e6d101109e
SHA256401abf9f6ccfb18bbfa78916f640b4366c0a7741f1e3d43ddfff14d56d92caf8
SHA512d43e6ed8b7c8864a695c4fe99996783619a4865a4f0267077a8b358054dbbeb4870e7b0b3d4521311f324d5803f68c46a688c4a46af25a3616015823ac8c60c9
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b