Analysis
-
max time kernel
120s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
19/07/2024, 08:38
Static task
static1
Behavioral task
behavioral1
Sample
5b330dc457b27e1228693790fc7de433_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5b330dc457b27e1228693790fc7de433_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
5b330dc457b27e1228693790fc7de433_JaffaCakes118.html
-
Size
44KB
-
MD5
5b330dc457b27e1228693790fc7de433
-
SHA1
9ec20349f8df5082c8b36aafab41e81360b5a11a
-
SHA256
60b5716372f7698250abc67d14621812227f20dd0c14d3d97626a222204f9842
-
SHA512
915f64b885d45555e5719e96dd15db707914bc8bd56578e58253a752a9323cac4ed4f99b8e151bedc01babf10e79cb22edd92a0139cebf9aa62e13af91ad75bc
-
SSDEEP
768:kawAqeM08ZE/JWGKzcz0w111l/QkGoP1kn/crRmzCHGbFp8xZhetifLWKr+S7tcZ:kawAdM08ZE/JWGKzcz0w111l/QkGoP1k
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c00000000020000000000106600000001000020000000885801dcc438e1bbb89882f0e3241f3d81f2ab999a7c115a11fb441813e47f5e000000000e80000000020000200000009d593aac32f1e6301531f21bf0b36b32eaf1a6abe4fc26dc161f3065e03e821720000000a16b516a19081f5d3a537aa3068e900c228d14ceed94ccaadc8e459a0b81aafd40000000c44cf0f120d066559b2a8071dedf09b7392e01c8e74dd78a0358508bd067af2539e14ace2cc16a6e83192bf946ca40858211ab8cfee0641e1a2a1cca86886eda iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427540151" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c00000000020000000000106600000001000020000000a7b2f2863c39412450e97ad800907a9ee22cf3e25db8edd17f8984ec7f8e24e1000000000e8000000002000020000000329868abe8a3151cd90c8c82dd52831fa37f1500811649ce100d976cc7edb21b900000004108285f9bca404ff4354b324881e77b73322d5ddf2e6aa92920d5d95cc16ece6bf1ba6557ec9c0ab46e4a7318454a15d07b0b95147a3d7d714fb1709a12b70dc928c41a87dee649c1a477c5306b458d88af41abead008795e6281d7e276cc573c3137fb3e1ae9871e2f322f2dfba204153bdfdf650d5176783f418cecba7da09986f0eb644912374bdc545217603996400000003c93ef29cc2e2aed24096ba82b1278e914967fbe013c6efc00630b504a38d18758b034b562df5fe17bdc1484c862663877d34a576904bdc25d5c5a90950693f7 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 106e360bb7d9da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{368B9951-45AA-11EF-B161-F296DB73ED53} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2092 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2092 iexplore.exe 2092 iexplore.exe 2832 IEXPLORE.EXE 2832 IEXPLORE.EXE 2832 IEXPLORE.EXE 2832 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2092 wrote to memory of 2832 2092 iexplore.exe 30 PID 2092 wrote to memory of 2832 2092 iexplore.exe 30 PID 2092 wrote to memory of 2832 2092 iexplore.exe 30 PID 2092 wrote to memory of 2832 2092 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5b330dc457b27e1228693790fc7de433_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2092 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2832
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5a946df6cb7bb1eced7091d3bd688b9c3
SHA172ed92cf5ed850b91a4817e91cbd216c30651537
SHA2566a37ae5b961c2d0464ed59c31ee4cc96ff68531e2d64be844952664f5ee20aa5
SHA512b6fdaaa22e189d69716a97b54fd6c2988a40043987c924bddf9ec74949af164ce237348809b79b7019f7fabd67491abeab0091c4c5e88acb70de44664c9f2afc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5ee3d0a03e439a69952345b849ea06ae6
SHA153a176903b8091beb0072afb9ee00242b102338e
SHA256f48c05b992b83616e5f678778f16373421f6fc204dee7c52d14876d0ea0172bb
SHA51292cb91ec670c3b46c9bffae09d032c475df9d12fe3f935ec2e38a60f606c644882e2f81bbc5962973c5d75017912be09217b3997d1e770fa13cf3cdfa684eeb7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD59968f99d2af45a915edc4c044a193222
SHA1107dce02776adcd402d5ba2451213a110f727ad5
SHA256b124bf5d40b221d3075e389bc716e215d5f7ec493513f703ebabdb35273d11a0
SHA512c69ce5866c5b0fe443097e3dadca374087ba4e677957b792a6f121b30c697dc512ad4595474e73d0805cdf8b7fb87a7d42273fffa45db18e6bfead371f4ed356
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5bc00e1dc0652e5bb90417795e378d8ac
SHA10f54e3cd215515ae074042e770cec61ae9cafe26
SHA25675d3c59246cfb5aa084705527af44fbb3707c4964df0f04584a63d5c05a0ccbe
SHA51259f1fda613f5a43d99f49f515e91aff20adace7ea9fcfd4762fa53b6397ad3dc30434a5ea844f5cf765ae8a8e47d7cabe70a5dee61f590d2ba146e9b0ecb1628
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5dce9af087d57defa5163564616ba17cf
SHA1b55e02c0b73b5b11c460ba867305ac3af29dad7a
SHA256eb8f1e0580661759c15b987abe3c510cf452fd9a81bae9e61ff10ba711daed8d
SHA512acf8dc08d2461ab10dfcea7057419078b9e4212d3118d654e7782b3efc9b47f45d7e04c7134a30a0fc3151689cac63c55b6c9c5d56d43f283f11e356040d809b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD57cefe5d1bcdc51d59925795951ac8e47
SHA14ad6a560a9f443f27948708ea0213cfa298c9f7f
SHA256c2d86b7b4bc3ea5c956a2ebcd23fbc0730be16b49d41bb115701e575116446fb
SHA512c582dd93c2be976b0e1b180efeca1254a42c65f3cebb518a7ab18f63487d6eb2a2683f440748ef1a98323fadde1cb037983497d79fc389fe35d2b02746937988
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD507e96cb0983511879919b3650f4ecb0f
SHA1316959313e829b48c9e291900d1a03a45c7e276b
SHA25613c28843ed1389a5a017a68b82fe8dfa01b900665e7033b76d3e8a088e136abe
SHA5124709332fe01df46a0c77e40682118d931cd016551c5444ea542c39a1c11ac01cb92b77d70a00baa8e7aeab0bccd2a0510f9388acb8f70e5f3d47836beabda9bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD59b9b038bb5ab79af6207ff1911f980c2
SHA19579d6ae5ecb9ad377785afc1183f6f8ac960444
SHA2567cd0e8d6ef8858d14cbb03d876fef7a7c59d358c59cd8c64aca012c02a7f911c
SHA512b342c797bab5fb6b56ca4cf4e39e8621b391facd0e6b18ba55186595f21f6bcba4caa131e4281d52fe918a1affb5b9b56d4707c129bc3d6a171334649cec3bb3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5528b0b150a15cf7975bb3634743c6dfb
SHA17ce34f6c2c821aa7a0a7e92ff2f6da2f6992fc19
SHA2563670a5a5d2cae94c2dd6b7f8d48b980fd8d27cfdd6939d73be33322b3e4479bd
SHA51211c43de8051d37139c605fba3e7b93f4bee6fafbcb30ea917db603004410de9cb84e340bb3e8c7093db9cd9ea5767e1339b76a727aa95fdaf5ed4547353bd850
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD54468f39db525a81abf12f64b137eb820
SHA1e3e3876d6a7d8b4b425ee6f40cf8dea5ef1ae771
SHA2567c4844710272c032b1442be604354bf5bd67f4f8629a471cf7648b70bb2631b8
SHA512703e66cadaaf02cb9df4da1cfabc9130a91e49ba5530a520553c2940dc1610a36894c14c3b9adb259c6464293757d3189d28c38e9fad20f19b68caa457b19ec1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5d2c06a5d78d4c75fd49a010d00982181
SHA1ff768c1694655b41bb69a1200a141d57cb8f07ff
SHA256b3d834ce8012296da67c3785f1149c3f5b3dcc19d4bca8647da71630efcc6d06
SHA512f7a47427f5571ff673db892c5a4819bc38c7e4dac5ec4e5c7da03369be881e8d2b665ff214528932a28c145e863bb52ee0a6786f47d34f45fbaa9b0f5b93221d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5e5a0ce8951e09f36a9a517d11d4ef421
SHA1888ebe7d8082bbaeb49839cac9a0eb5a8390bd28
SHA256721dac2074aafb08836be6f9812ef9bdbc30c2b3aa662b1764ea9835aaa63fbd
SHA5122796ecdbdeb0f4654821ffd333435a0295327809667af3830ff0936389a7463a5320cd615f12dcf4a357d147fb71679d4040321d48c5232a4994b8b50223f177
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5b371e5be385902aca92cba2e82217da2
SHA165bac6b8162275e80195b0a5f5c0b9211fd3c4ca
SHA25631e0c87f109394b3fb9d49116f6bc4146c579d2f038e31a809bfa3429784ac3c
SHA5127465574d45c05d726c51b4965116fde8ad63b0991842aef1b7a8d5e2a72852c795213737e7d6cf6dc7e2caad191d9ebcb3ccc43124f22049e2f082e71c6de36a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5875157f768a5e501717bb16f042f7b7a
SHA1b27e92a101c8708a81fce1b980c41edbf4d38880
SHA256deabac303550a2f48ec2349fa0f528b7aab148eef5cc242a0cf43e6169cea475
SHA51261ccd11a607eb47ae2b83903bb9b3feaf7bf50a2fa4c2922b199cda09146482396f6fdebe267a4ddbac6f45e2f90f50a2fa39dbcb671ff4bf907e94cb7e440e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5a617f187a3928c896ff13ae37f5f9eea
SHA1e973c8f7d5901d42ba0c63674583070e373d2ee6
SHA2564d58c737edf63d1a729143525e7ff96f5b4e18db202a16102f44ff30da039cbf
SHA51235de49408732769f9a28cbf2ac15cf38f6aefbdb64067fa098a6eb02b55f4b75a67d984731423b0d167464e34667f7958cb8648c8d270b7e0eaa5df5ad58c81d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD52cbb04e5cd7ffe31d47cafc875bf2f76
SHA10389a483e439bfd635a628bb61bbf9515c801464
SHA2569898193b13b5d998743f5cfdcc61e813eab1a865b0cf3045a8e4fc5e027ed4cc
SHA51257580893d5989f4213e179445298cb7f9e6e5d41abd8d0b44146298e2a149d28c168eb0b0795c14f8013d6231e7474123dcf362cf6b7e6bb8e6e39b617ee5345
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5e2822416b1c3f7a0242afdf61625f6b8
SHA11e574cf0332276e10240712dcd9c700c9d3b94f2
SHA25689a0e914486772979b6334724fd90566e7904245447bfb2c77f3c88b94b8dde1
SHA512b9bdbee632138a41dd38c0f63f6d013bf1db58f10a73589bed073f2d238572433184bf204227c43aaaf4632ba0846edb451de0b2bcea77da5466ee1ce36f0c45
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD51b1bb5c02a3320935b72bd435cf41613
SHA11fe8526c0fb571c61c486dc33b0e677a1b75d9b4
SHA25693bef937406bd49fd8ab75483da7e661813302cab9c5efe9f5ec13d6ab285768
SHA512bb1474990b8f94a9e74c682dd17f793366a60f975164556dbdafe66cc5e5f95090712bb420d0cf502573d15e378153dddfae236c5cd7f2af4f7ce35c1f55d647
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5c1a05935ff6fa66d7162a40f05527d67
SHA13b4791f44170bc972e848c91d191070c79c14709
SHA256a7058bf33cfe07f8c805db515b7297dee8b2cc37602089dd18c8c75b5499a7e5
SHA512f3030ebf2d7a7c06210c2af9db0af17875b633158a70e5ead0041552be5d7c45b788ee45e2f27aac17c16fad7b896b7534115d6b09b01d2286225ec699596ac2
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b