Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
19/07/2024, 02:28
Static task
static1
Behavioral task
behavioral1
Sample
5a182532f4aae68902faece7f70630ff_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
5a182532f4aae68902faece7f70630ff_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
5a182532f4aae68902faece7f70630ff_JaffaCakes118.html
-
Size
11KB
-
MD5
5a182532f4aae68902faece7f70630ff
-
SHA1
58fad05bc22e70fbf45ee4189af16fce6c939a93
-
SHA256
5c3dfdff47ee679b0d01ecb2b88530c1206df2f269bf22f938e7d127fe2bbef7
-
SHA512
98dc6079937c7d567bd14e64e9ae221a0fa97f335063e102c47d56e1f00ef5d6ff825f3fc31e5de222bb7820a52d451bd0d1a32aff1381f64be8831d6068733e
-
SSDEEP
96:uzVs+ux7FYtLLY1k9o84d12ef7CSTUnGT/kqBp2IZLOiedxxWQLiYNCa+RiVa7il:csz7FYtAYS/WS2IMxWAuLPHb76f
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{93FAB001-4576-11EF-BD75-DA960850E1DF} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a05b7e6a83d9da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d9909000000000200000000001066000000010000200000002fde82a7feda6b7421c7d4edb570d631ed688a96cbf115572cb4b693dc27ee54000000000e800000000200002000000093876d544cc3b1aab5d2271a6433d5536d5c2e257a3f0342ede901e6572a237a20000000954622e55678d3151461ab514b09728a190655a6e94917ff60e596b10ce10ca1400000004c31a07eb867661f5de5314630537ed500c3f1eac7230aa74a6a530a2d5af44204734bc23512b3289ecf487ccfb927cb687d31aa464ff29f117ead64db43c7b8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000e1bdbb2772029018fe56f76cd99581e00238d5d0e707cc5cc57e96703afd460f000000000e8000000002000020000000118b29f9bbc391b4bb3c41b502c193fe1084d060651db1c1ceb0b4f6c83ee20890000000cd6b44545a286a64c4138be88e2ad09113352a51638f06dbb85f68ca3b98bdbd61cba7602885d12bfeacf7b77627bb05d4e27c7aca32d0853f9465b14c43ebf830cf367984c091aae1132e9ac4bee75c6f9c66a2d5d2205ebed490f4744f787970bc4cfd13f13fafd965379ccbcf1a6f164abc06a1478af9b072ed1d171b05b6f6f8fec211fa3de61a01f16342e06b54400000005bd15dcc473025b1d6e594ea82d870192881b9f75fdf68802f0c5042ec788c9ea31ad723c3f599a2d4e69c4a4a803af823b3a6d6e62ecac27bbf86e4471e8561 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427517973" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2564 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2564 iexplore.exe 2564 iexplore.exe 1396 IEXPLORE.EXE 1396 IEXPLORE.EXE 1396 IEXPLORE.EXE 1396 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2564 wrote to memory of 1396 2564 iexplore.exe 31 PID 2564 wrote to memory of 1396 2564 iexplore.exe 31 PID 2564 wrote to memory of 1396 2564 iexplore.exe 31 PID 2564 wrote to memory of 1396 2564 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5a182532f4aae68902faece7f70630ff_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2564 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1396
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD520e8da3d6c3e034e2a0020686bfb7d7b
SHA1098eaf02325a6ff1687c95986d08669c676c5bbf
SHA256c0bec952183363c2bd062286f96d1b79c4bbf3281d5f815c2b41e37798dbf6f2
SHA5122bff8222516a6f32a83667d2d610ddd6c83d47d2cd735654234f892083a696381e14b81626213b458c10ed784a90bbe44ec4b996e7fdc68c017407cf002749cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD557c1b4163c7e330c04491309eb95065c
SHA18b44d73f624420ffdc639aab8e3a062629b0ce10
SHA2567590181d4e3790de462dd322a7706c46d7e829fbd5cb4e9f76b483cb5abeab88
SHA51297bd03709cc74c6454d2ca6a20699a9d380a91e5d411b9eed8d16a6321d73f619884256acdff71c09f7473c5784abffb0953c61c14ee02996d9018d37ab78c54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51c0761e695498421647abee407baa38f
SHA162a1e90fe4bac24060aba9e056219829a6f6ed77
SHA256eb17b78ca2d3f6a27f43d4a041e8a5b41efc59462d2bc5e29eef33ad70b9e1b1
SHA512e2bbe62ed9cebb446aeebc0255e360b98590ddabeef0b88ca142839d4fc874323858ede271f847fba095051b39f2871c653f9430bb4b5b701ecea8a1da748d0b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b19b3a32b72fc8ddd2ec179cd726304f
SHA1f1be3724c8ed456ccac33f6fe68d06215d96fd18
SHA256eee07d77b1ea0591aa97f20c9b7cabe66434fa4f8cb62ae54b9752244fa0e9f1
SHA5128e8da14c2ac42ae0570031e7300b6c58afc00548db73e57e20fcb06828153cf48c4b9240f9a2332625569b9b7ec6d7363dd3935c3a02cfc3d91cf549d3f6f2b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD526bd08e252cb556dd8ec887c6597f2c3
SHA145046b8fa1423b265cdf4fab05c63d967feffc82
SHA2567b65c92ebba07186cd79e0bd108c78080efa22c2d808082a1a12259d3ae4de6f
SHA5128014fb0e2065d6aba7826c30d2cb373662c9d5fbdcbea9ff1ae299cc8ba157e2b51f103e55b1c558b716135dfcf66cf2467e4745f875e42a4262f1975c80531b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57456e005ac946e90d87bc61320daf1c4
SHA15f39d27606c3b110aeb1c409501c396b6de7e941
SHA256114cae0523c417f1656a12ce1db5b7d2ccc3538b7eed66299a72cc7895e09ce2
SHA512f54f4cc1fcfb01af8d90c1d47e33ca756f546a3dd0b3f617d093b6dccab65899c31e6056e6d7085eb6d5b759133d9893ae9da4866a7d22e5b58723e9cb2c3b65
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD516d68ccf54b0ee17fb330576ebe45416
SHA1d908b8557025551d8febac762b1123bc88b0196b
SHA256b14f049e3a9244a8620fd59c76d9e477c986f150553c42279a94bc42d0f04bba
SHA51242a6e1afcfe0b8950cbfccdd5f27d8f1eb2fff46c1d7afffa4d39e4c71b4941e1547049a983f08edf18e0d12aed5cf6d3917e7c166c18dda79ded555cb30d28a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5db7317b10d5b9e96e6c84028a075e172
SHA1fd53c36c1d3ed10a05d639eb6ce60ad8913cdcd7
SHA2569a95429b42dcb8d7b253199bd2818e8dcfb81f977695f75542be3ee17c5baec5
SHA512e36037b41ee0de5be13d606b5cc9c1e7ed80e3cdcc6b3b65477f4fb53b073b37c59c92f39807f7ac2fe809b866a6b4bec0024ca07ee59e9216044c1c57e142ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD539c3731aa08f510bf3944c9aff832fbb
SHA109beab00a523391a28215cf1fe27fdb58a2b3fe8
SHA25682d67b9e825c2c90081d0ec231ffb98f15efea4d6d5594e869d08f1bdc0646c4
SHA51211387c31cb4b6b9bd65ed3b625ed4f3170cce08292a24001ac1ac9a1ef71bfada88f9329cae25dfc54ae3bc5968ffb4428b744c3177cf07105a233ab743e0760
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56139beba4c56cd64bc1b8e01f3516e7d
SHA1919c5861cd72ceff9c6fa1d5d2bb71427c10cc2c
SHA256c09208df6baf358df3ec32bde63520328620dd2c11641fb1d0dc1678d203f0df
SHA5123866e7dfe52d886d9c903f7c8676135ad1bbe2bff94e864381b30022ecd7dfd89e67f1e58349b2918de26adf0df760309a000c3343474c5dcabfc2d19d24c1d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55646c93864ed31660f3e8f4ce2af21eb
SHA13ccc6eefcd1ee0717755317452f6adae40619823
SHA256ceb186f79c86dcfa132828858c39af17c04b98ee51a5ec883f8bfe37544fa95d
SHA5123c15fef9753206083911710a6440d766f24e07d917d9a563bd95e6f7b3396ca5a02c1a0235ca7314eeb95711d36a27aafaafe2a2a02a25e25aab0adf162d3912
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a1f19f4580c0f96c9e2511e7605a91a7
SHA1591ea9ced5007bb38f9baa2b439db23a1e19649f
SHA256efbc39280c93b0a9e6caacf603f600af7b67942f4c85ec87f406c4bca8935d80
SHA51277e31a00f795a0ecb9f754709900dd64aa60baaac4e2059a602d704fdff23a6501686291b0e5b22a8c5d30c82dcc5e4668d8f1760861edd972c32d06c2a05c1e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a51e51dd81a094a9510e21c101c90022
SHA1135229f3223b472a4125ca53da894088f0ad9747
SHA256ffd61cb6d79760191d2a2ee96f766591f652d22c289bf6556dc3bc31b485565a
SHA5128efbb493d06408dd41a02d933b5bb5c109e3c5206ae0034067ab7f02fe7a228b3f0e0e76168656bcedcde868de2fe5bd38bb50efb1addf1cfdb23fc5ebf8b456
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5172c7123b4bcf2ed5a7d02131a9f5123
SHA1f6bc0c364677bb616d4690a34eb280edb5a3fcc6
SHA2565e10ef8677d4667de8b608b86682de5c8d90321c818789e63c15fee0142dcf00
SHA512c34e11c88e227b0a51681257b1a06fd726d08798b22acea1b5ef1dc5082b884a573f9a772428f4a045e6e4fe788b10ec093f349f5a122607be254533a686e8f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54d6995cfab5916ae3ca93707fbdf82c8
SHA1de98d6f0f5eb53ef5bce59054068697862464b6a
SHA2566361d3ce355fe24b7c2cdd0f33d84659e0804a06eb07ba1154b0de1e67277448
SHA512d0eca1ffcd92ed2fca32ddce0e91c1bbfaf2266d43cac36716092db02a931648bd2766e78390f7ef3e9229a353d0e67f17cc2e765049e7e3a8892852c3a66e92
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eb9b5b8bef5a229c473f1fa9c6398700
SHA1edb384abd36939c2179388047374301595335a88
SHA256026d14ddbe004ceeaef0e213a1de18bb1a7cf1db617214473575f77b0942a02c
SHA5126e7c6c97ce12710dff203c317725ae828f3fa915d3cb5c96272ea0bd8bc87fbc7c324fed6153da1b52272dfb428ea6a11fcb12b6ba8ebdac16efda344725a83e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5936966c6f4ff4e20231e2d00df09ea07
SHA13046b21136465c638629412f59b1f58568e5f443
SHA25672b7088dfc2b3c2bbfa184222c91bbb0945ffa2355a1c79c9b1dae84699fb174
SHA512311249241bf98b1cac06a877925bbf90dc668a56b96665d757ce7fab3b8f80a35cb38dc89f2d73c200f635b8508df4e0c3aa921f9dd8c254f63e981dcbf86ccc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56ac4f92cb78104087a2b5740cf82d1a6
SHA1aa50e7b0aa3b0e77a4c4739e23a5c3ba2ed0e963
SHA2562e593d664cd77dcbc1cb586b2054ef52507938f06370718241da6d7a550c66fa
SHA512ab07e6b21a6229b18cbd60fbb44aa2a8a2d39c88587c59a591a8159d45d199d827f4913826b62abf6bbb3ceb86f8e958860e98fb01a0a914de3a7828c86246bf
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b