Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
19/07/2024, 00:02
Static task
static1
Behavioral task
behavioral1
Sample
59a629e4430ff23c87d82b990cd62cc1_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
59a629e4430ff23c87d82b990cd62cc1_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
59a629e4430ff23c87d82b990cd62cc1_JaffaCakes118.html
-
Size
90KB
-
MD5
59a629e4430ff23c87d82b990cd62cc1
-
SHA1
91711dec5d0e41414353091226559c03c530f18e
-
SHA256
189809b1b88b0126fe5f0b9d6cfcf290b30415d4eb42f7e8d343523de3be8d40
-
SHA512
47249c67c41701fdce57744f9e4de45c3f292d87ccf4a91129237d2c4fd8aa7e81bf2a4691ca89c6b785531d44667f7028e0005ad698422f34576147574b6284
-
SSDEEP
1536:gQZBCCOdM0IxCeN/gNJfLXSuc2tPOGe+Oj5jecuWukXc4YsnlkaQX08BBIAPVqGD:gk2W0IxYPd
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{395380A1-4562-11EF-90B1-C20DC8CB8E9E} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd000000000200000000001066000000010000200000002af17ce0d116404804652302db33c0692f294666b91876432c697844b59c4013000000000e80000000020000200000001b32d744530da99cef89d2d0a8219b4b41188a15f7fc2b268605d26614eff8bb90000000fff7326b28ba234a6b64d7067a3171b8eefe7e0773183446fffa76b76e990a3cf54cc77f3f24405c2c25af64ca0f3052af24f8836fb29d07258f93dc3a1ee48b7d83f28350d0c94eb1b4d6f9453e35c7932f6563c46d6c26033dc95525b8b37be414a40d3fb71c54829c35d48aa1a7a2b739c1f6f0dfc5ba97d75d10e61c906bf67648677c1f12fed7b0c9ad75ef724d40000000eac5850128c0a3a19d5d8a99349122b49e3b73a8f5b7083d35114cb4acd963b6b02538328857bd9bcff356d8ddc3f89d7b75930c80926e215fe96a040f06acca iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427509231" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd0000000002000000000010660000000100002000000061bd49b56a03e1ea2d55f8d4650b9b1ef2fedbeb4c58fddf6ed20f59e6d8aedf000000000e8000000002000020000000a9066402fd13ca912396798bed31f259a50849fe5bdcf4d4c787d528ec44d6fa20000000908e36243dca5f16420e38996664ea79c3404f8783580e20b5d40ca49c145b3f4000000088b7b33b94cd7b413c1974da93df15a5f3bcd0c077be1e2fe5a4f01b3a48e5f9a7e7603db6a034b831333beaaf09f4f194a92a17496ba9aff03f2988080380e0 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20c742106fd9da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 552 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 552 iexplore.exe 552 iexplore.exe 2296 IEXPLORE.EXE 2296 IEXPLORE.EXE 2296 IEXPLORE.EXE 2296 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 552 wrote to memory of 2296 552 iexplore.exe 31 PID 552 wrote to memory of 2296 552 iexplore.exe 31 PID 552 wrote to memory of 2296 552 iexplore.exe 31 PID 552 wrote to memory of 2296 552 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\59a629e4430ff23c87d82b990cd62cc1_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:552 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2296
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD576bb24f54bc5b591e580316bd2679cf9
SHA184894d9e0f260b5cc21978ff0dec3e89c82a2b8c
SHA256d49b9af7cb011db5a89469f0da9bfbc151f243c52658f5ed44a13227e05e6216
SHA512db82b1f8f55c7b1d32347f60bf016ca3e4fee88a02285fb3cfcad100ff96e49067a849851dabbc7fb8592ec0d047310aba16cd48a71f29ee259dc07f7ba5aaaa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD523af2f88eaca524efa4a30e1ad2539aa
SHA1ef8fad216cd4ec3853ec3481fc33a79b6acfcff6
SHA2563f86108531ef9b6f435b3d7ba21f25b06f91a95fbe2f127c85a72685c79ca196
SHA512197ade877081e22f683be2552662e7f0ba2cd16f2477226046935feedd0265d5208abd8f7f057d25143ab12f0109c73717724be0f8328daedb49067da9889579
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD533dd4a690204c50eeae667cdfc1dbadb
SHA169de46056201370f8ead24b188e56100f1716284
SHA2569abdcb26d590fc9d4ae3b25a4dc4d9e9e97da53e49360c4ca1bf2992e4355819
SHA51265731046d6e8530fff4e2de266a62d6b7d0adb24d3f732f84626d351974b02ba3e2c2852150121ca9a6c657bbbe176938b314e3bf47298aa6cd8bb5c6b915a97
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD569fb01f688a97b0a67c3668597be037c
SHA1cde288fb2b1ce82f68372cab11cd6d66a517cde2
SHA2565fb74114692b84a5e63fba61e47eed57bcb2b6995a25c3abe3f9ec8c2f42648f
SHA512bf76554269108b1bc9be0e7966cefb6bf83b6b5ee993fe7074d091f23e968eab19de40375c372913b3980928e403120bfeba96745505dfadda49eb2bfbef6429
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD535266df090b193502bd7a6475d4a3f34
SHA16eec52d308762b2fa36a0bb6d42fd34bbb822d75
SHA25663173411999751d33d6644459c69907116e9a5718e588431d387ca6d73d3f033
SHA512e667eed68d17ce45c00bb8abb7539fad0b62ca520bfb6f69125ef37551ff9d7d8e9ebd194ea5a30d42b8977ae6bc6134ce17553a8a5c25607a5783c0d90633b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD511563149577fedb74c9ecc5deb305bf0
SHA134c847e90db1d11ceafd3bd6536e1dc596ef58a0
SHA256e095fb3eb986fbab79a53d4ead3fde75d63088ae9c717a340397486df3ffeeef
SHA512ea56cad8a6aace9eda6df02dad0e474a972c6711a776ee5fe1eb0334639a47676a2d9e48485dbf58d5b557143bbb264b99d1994bdeb48824e2a6d7c9bb96524e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50099bc7602a43319d881e45a405ea176
SHA14d20c4c5b2400d3672d3fc944bcf143f6f86bc7a
SHA256c6df360ff706aa4972ac3252ada257e40a37a6dc58bc8fc41b9ad8d04ee7b025
SHA512e5d631eff5c3acf9c6bd23de90ba7e78a8d12276702975b6462855f6d94966c04c7efbec8bf910928d6e91ea15a4b9790ce6e9f545259bab7375efa1984d6720
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55e8fe7de9d6690252dec60841801a8b1
SHA1b48641d001d78be80b8b47f579ca7b44e86e7b86
SHA256a0b1c797d0c6270bb0603f995cd1f671c138682f45d06ac3712b317c7e62e73e
SHA512e533bb4b3401498584082f7a421bf7a00b22c99dc5e380b488e6ab3cb0af99f9985703ea907f9a666ebfd7390139e5218a85f31e7fc39d8d51d4c584134ff717
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57835c9db5fc386bc2fba9a120ef9c37c
SHA1b42767271df989d2c4a6570fbdc52387cb057e5d
SHA2567e5f862e2f3ae433e2327cc88c1dd4a3f6437fdc04b350e76b85ea1d25f6dec0
SHA512fbfd1ed7dab1ed97708b25af2b795a0a5b91e315acc1d72e006e24859e42ce7e305d95004301066134b02785d76c2dcdd626d4306d476cd21290a5c5020d8ba2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b1a5d2e947c25bec53efe0f171b6dc4b
SHA1e22cc9e3b8cb45df8cd7f1b271aa33b36dca7cea
SHA2562467c12bfdfb34e2696cf687dafd9ab939242c5a4fc53a1f31720d802f83f4c1
SHA512e0d0f6101dbefaed1325f16a3bacda48130d8af102bde6cd62d838ed5ba08d62d3a27a82f95085418db9c76c38f22b0346356ab22d26a4d897392890d39461ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD569dc41fdafd4ebe0471a7dc002ee4b47
SHA1e0ca452c77d10474465b56e61d57060591468a21
SHA25606710e6ebe0eff2ac9c4be25aa7e95daf426b5d4757771e5fb765ab369d71ddd
SHA5121b95cb6dfc5bca4c502faab3be58380840ff5f2ccc653d6593b1e225aa8691d3c635707d769ba27c1141439e2a85c01df64dc4c3f717c27dcebe7fb1737ee263
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58ac697c93e5ef40b0afa22bacdb59edd
SHA1d2f6bc24ad7176c80a8a25b432b3777209c01d31
SHA2562afce64f5cc868198c845896f244fa780ae1036817af9c1dbef7f424b6689072
SHA5125db8b2095648c6d3d25dfc0a798ff8a1a08049a7090be47e3ee7c376ad6e42110cd2f7ad13172c2458eb5c541e66606f13289e7e8cdf4a5e35ba42a8be63d4cc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51d78561617d602ba5de853f675604958
SHA1f11f44e23676250939d3c12cff8faa65d3491e4c
SHA2568a63d334f0de57952244cd858da0419824b0785f2d534a8c8886f4908ad78ee0
SHA512b8ecc5c9fceee557e124a26874791f5e23773e5da2e204e13f4501ce6df9968d920ec72b0fd54926e8951cc34ab085936d581472fa28cb8fe4e345b84e5265a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54058988b2c3f4dc34a1992288336143f
SHA1ac9ef822d1ff0f1b97632c5e2f84dbc11ece8a3f
SHA256a0d08c1e1a64d8009acb6e27921e0f13c496c432339104eca2748ab65d8e87ed
SHA5124371e29dab87516856d415451d44d3a471ebc452c9ba26b28e9f69d0fd0e242e8ab239166b2fd6b1a6abbb158e4c0938a11a959b2a5909513222402e7f85246a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5578fc3c12a013f7fe1409bfd40d2435b
SHA1db1814aec9c5be23252c9623ac937c3032934b45
SHA256c6c949cac0640fb82ddaa346b71385484424e38b605ccac6b58963f98acf932b
SHA512da8175fe73638aca026b39d70059de343a6f23e38fddc80718d6af7f8abfa760b408a3e2a02e0cb8db090ec3fc86c37260c43ff38a466442d2e0158bbc3992fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a4c1f209a7692d06ed7755c784062b35
SHA12258f1f04c394a15230b89942714a4149d262390
SHA2568c749289f5c83957592d189d1404f20dac86d0baeb6f4123bd75aa9397f0dec7
SHA5126801f13cf51e08783c71dad7cfab0604aa3c3fa615e7af6a6e19f38afbb54e0a3d351392e34d2c35ca0cc0564f5b6f29a816722e1593b5013b136e8660604e67
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5128090e3ffe04e62f03cb6ccb6681860
SHA1711ecdddb232b4a2ffbc767b6928df799d072afb
SHA2562a4af5fa3953b4c422befc0f76463360fa78b6da98c42bc495c06c2bae2c2e71
SHA5124e61fd077311de4e28a87d008ef93112602b608ff7c6707ad27a70a05821dfb07b4747b24584be7441b3db7e02cb7a6d0a1730230e23e99d7e3c5420ba540b56
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a459bf6817b7d60989109cf0fd931387
SHA19a3daef7f09b9d9e7de49c516d1a99f61ec5b12c
SHA256cad7f18289fd94ecd69d4f35a91173976801eca7ba8ef93b4878ff97d6318072
SHA512e6b5f0b4944db251177dd32ff5f0756fef30ac13157269790583614c3ae8892a815a964b51da8f3abe361ffa62908fd6dddf511ba0bc2e1d33164310094fa82d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53cfe0768ba3b995e1fa8ecce55f9c3fa
SHA131254f1438c810fe7ff7be7efa2ecffe36f41b7a
SHA256e262ebdf8d4cadef2f04482ee4d0bd556fa1f7bd42292556aacf81b14b9d73f8
SHA5120161b70d37643a139ce80607f245951d65aa66a15ef37f03da4416d358350085377fee3afcd4519c01c92949a0ccb3025205e50cb3e24fa241ab0ce1afb526b1
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b