Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
19-07-2024 09:42
Static task
static1
Behavioral task
behavioral1
Sample
5b6849c71b571d112fa8197a8a108005_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
5b6849c71b571d112fa8197a8a108005_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
5b6849c71b571d112fa8197a8a108005_JaffaCakes118.html
-
Size
86KB
-
MD5
5b6849c71b571d112fa8197a8a108005
-
SHA1
9a9fa53ac38fb2ba6833546e2874a23a86cba7e8
-
SHA256
1738f84eb9477faca247ea6ce3e737abad1038546341deb1ba43a69d546a488e
-
SHA512
ba4d9f7a59ce177840e45bc4e88245f0bcc9dcc8e0706d38cd65206de6e1e395857bcb2967af717dc5dc0811e54691eec5f38b93c081aab5299bd8d03f6749d3
-
SSDEEP
768:rOfiAPMz3kW1T0YRwTIGmuGbUwuifnC3YoXt:rOfiAPMz3kWWTIGmuGbU3ifniYo9
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 202a831bc0d9da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{46FC0231-45B3-11EF-987A-EE88FE214989} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d9909000000000200000000001066000000010000200000007730c38a9308566fae3e340df305fd7511c5c68d041cc8dc36a077a776d571d4000000000e80000000020000200000007c769668d2ec29264afb2379fff9c4fd284266b75daa0a372c64026889fbd55e2000000026472526f4d3252d5ce4ca82f03ef2b28df4ea5bdbf48bac86d97417b6c54b3640000000a51842291f4764b1df0ec5d425c9d4a28e13249d84d947734ce0e3cc23209dff40fe776b9d3a2485d6ec9572b00aad40a349da04d3f225d87d57f363d3e8fefa iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427544044" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d9909000000000200000000001066000000010000200000002b190c2d167620dd0a578be5d9c64829717d4c86934d66f6a455b3a2b0135695000000000e80000000020000200000009e3568e13736559909410bd72456a5493cc9380cb5bf800d394858ef03b37f6d90000000fe619b43069b225f40f6810faed37921f93240245e33ac9eae4afbb7b7820c5ae6f4af510cd1c4b73619cae9d8498b089209b8cd849caf41c58c3ba767e329a35848568647d469ce9e87993d8537d180d84c2a8a1260a04b7a741599868040ee42bf16fdd1ee3f97efc53f123d13cc61b10c4e5554b7c044eb40c5a5e246594daea3d1e71f38b229169ba97c6495d9c340000000b6b8784830bc8312409633da94738a57173899103f3bd628b8a35d4947085bcecabe87f97205bbe53de976d72366971b3274ed93ea45cbdf509464b1f290d3d8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2692 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2692 iexplore.exe 2692 iexplore.exe 2704 IEXPLORE.EXE 2704 IEXPLORE.EXE 2704 IEXPLORE.EXE 2704 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2692 wrote to memory of 2704 2692 iexplore.exe 30 PID 2692 wrote to memory of 2704 2692 iexplore.exe 30 PID 2692 wrote to memory of 2704 2692 iexplore.exe 30 PID 2692 wrote to memory of 2704 2692 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5b6849c71b571d112fa8197a8a108005_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2692 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2704
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f1ad2a1a765e2c3c01b46f45ced80ad1
SHA1a80de1502cc57eb385174008a78d471c078d64a0
SHA256b4dc3e84eb8626647eb82bdd8a121ab7512c2b42732394f489fe86191b18b263
SHA5129675e22771dcb3a9f607ee7a353808ba921f3d74d90b87aca1b8a49b75f1043b73ad4af056b8dfa370242e3e7aec6d9afbbcdcdfa8891b6b5493ab7d082da130
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d0bea6949c8e911fea978b8b5024fe4a
SHA10398ab22e8e69476608fdbdd1ed5ce66a39047e0
SHA2569e5d29cace2fdb274c65e83fff787f91312eceff786ea323ff2a656a69c986c4
SHA51294d6f05c178795de7b1d1d862343030004ae23718a3466d58a4f8e7e4ac011768f5248037fd9b2627c4a6b00d11cd442d1eacbd0a74cbde374ed58fa4a1e1e6f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a4a010ba005d8161b568cf76481744d2
SHA199569d6b4d0097cd6457059b042f0fdb27f4a1c4
SHA256d5709bce7a1d81eeb70170f584c6b69df2ca22cf902709a055698a188042dc28
SHA512cca00c3a9935348c7c717bbf79ff16de5652b982d4bf3086dd072468d0d0eeb14eb961a7fc6035604ac35356eebc0dd7b8139a8ffa8cc1bc102cc7497cf89675
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD545db67fb79581aebd6fff9e37c8c3331
SHA162566f66c07b685ca58f8d2d2903265ba94cd69d
SHA25615ca3f3ff30d28e3350f371d0a6fd60fef3c43f471c1cf372658fdabfafefcec
SHA51220d4219496bf35d6a62046855a57bc77d9739b03b1da78bb922cedbfa2306730b34b59f769db2ebc6223ec0473205f89a14cf726981d7a652441e753680e81de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ecd3a4544d301f7142c9e676cab61deb
SHA1224227adfa867d6878f9639d9b5c307fcdc44332
SHA256e1242b003ba5a052677fe22bee9db976ff065dfa085dec53d867965500dc3e42
SHA5121b1fc3f1b637df476f566ecf22dcfc26439103478df8b1e77baf719a4fec6f5576707075725645217c7e295535f3eb0249cd5bcc7ac32aa9327380d65692509d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD505ea7673938b1cce83826cb13a2d6a14
SHA17f0897f26fc06374c5d9b28c1c78f2626762bbee
SHA25629d73dad0ba675997f03289414ef3ade6c7f9747b72cc8f3d0eebd3056d66879
SHA51218697b7f2996ad304b144691cbd611d37798dc5f38035f5155d513ede7c72c3e04168728eeb952dfa14d17d1ee842bdcd68b4eafc86a3ac2204924d283c77789
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d727cb400ae6634b738e9965b2844e77
SHA16d7e37836dba59b9920b98adc37a656c6bfa013b
SHA2566d596d7ecc898f7c094f84d0717fc237165d9aa7d234ca810270aef6bc733b15
SHA5122a6bc98614acee0adcbabfefbac79ee83b6aa365ba1fc96c870b828dadb6881dfa5d779a42048eb3aded6afeef8307aacd04bdc484c6738a987563fefe699ced
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5caa73861e1facb77b8e9f7a3752fabba
SHA102f73e8d5ac2a5a4909f43b76570e1220fdc429e
SHA256ec19bd031dbf1667914f85661c3123917fc5f5531fd1c9ab7abada6a472772c4
SHA512c8f3d72c1cd19f47e024086da549af11a46296b9407b40be7a45e025d072805a7c4bbe9dd6695f96375616deb57e6abddd59d38baf99bb6a78088ad51aac1b8f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57343781d1fa6c7c2b4da3af8ec1c0f03
SHA18ed5b54039168c037a05db7437566d335b16a257
SHA2568ebeb8b3319b46bb219746c68b645ac3b486060b309dab38516ebf80f779af2c
SHA512a3ad71ea68bf5de23c4d74ed05eefb8223fcc6ec5cdc9ec754d30b85c2c27b31bedbe8cb5ce605bcbbf5cd2d84dd2ed0bf4f03cd72ecde0f84e83fc0d84d6c63
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52a6fec40fd0062def9a5fa85bdc2af90
SHA165800b5c05b7e67c876f93571a7a90ba85e4c73d
SHA256949223552d6c8abb4ca133f8c75052871f7c762719eadd51bf45f8475f8ba8f9
SHA51212181dc8259b5ebfc9d9176520eb90b942d8e44cbe891d16046e59501f258a980f195f05355fbf02375c9e2cfc9e0e80a65bd68cc2d77b1e927e3fb4b111c721
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD582d4e8604d726d9138b6f167d342ae12
SHA10774b8a21adeca5bf8a11467808fe7d7a04da143
SHA2567dfe22f771a475172c63db92880e7b28c01f79f2f64d22ce236d8396f51bb6be
SHA5121a430dcc53742bed049c07750a05a91c96fe64400f34f8c44e7bf119c291bbcd1f8b96b9c04fd9ff3820cc8100c2d61f4fd2ece24451f14293f202a802414681
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55b50fd779c78dd381ee2c335bde4e2e7
SHA1cc4baaba0aaaf270ff71cb057a05745095520f6f
SHA2561da6aa8df60ea5cf52855afa71d8fada38f57b843914013edc59f259f77d7e58
SHA512c942a844390e175c05eb8c2b3408bc24d653d08dc241aba8998b2c6a4f11214dd057985a8db8886db6804f499b030e952a4e9abf65e9de662d38a0c826614349
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fe3b2d23f9b01f365a7920a038c8b347
SHA1f828407a2db0ea7bb89c08b975a4f213a2ff1c42
SHA256d6ebcbeeb59777948a68c8b3b1385a037a305fce664450dcd45f254a21a3f78c
SHA51277ef5bc864a1b1a2622bbaf053daac326faf982430a6d73f0f95dd5ee08548704fcbe416c65ef63bc003427078f06111b07d1341820ee1f9adc3b1b9d6595f5c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51105ee1eff918e024393dec161747702
SHA19aa56e44661964cc28c37df625fc3a27e91ded6a
SHA2565ccfad94494473ed11c4035e1473f53542242d3e22058b65fac9e0ed503f2d9d
SHA512bf9f4fafcf158106c08c9ea80af4e938fa0ceaf305d2cadfbbe796f4c163880ecf737a29b55ae2037fbc4169e315666115d61a3c43b2d1206ce9046f7eb60f08
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eb41b3ddc8330d8e11fa48a7da3f2ca9
SHA1cae46a552eeda0c45b56f0a3653ba6b75b03adab
SHA2567e5bebba8425ae656bbabfaa142d63acd98198d26021ea9517d50c2c165118e5
SHA512b7bb26020c4097ccd9adce6db9333eb767176c634ba1eadd20765c7e5ba3dffd87989f2337630e594f9f9dcd40ff4a2ef7dc277b7812cdf975731cea3cf93184
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57d8f4d807ed5bcd8b555fdb7be6809c7
SHA1f20b65dcae3d523d1a4586e0754ee43893970067
SHA256522ee7120acb9a6539a1a778d96d5d91204e5c7b49b178a059c50633c631511b
SHA512547a4fc61b3387a5093a1987ab4333446ab8db46b9f3823ad2c21de36dd33289ef0fc26e9280775c4d6a58fc9561aa3bffb5b80ab8aae941266207c96929d59c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5544da2495c4d7ce6e2581df79910cf6c
SHA17aeee0ee3f3e642878d6f6e5001537b78f0c6a7c
SHA2567eb3a12825984d315153a953837875e4f83c287130109c8eb952320b691e4329
SHA512d0fc47b0705fcfd6c1eeb9162677c484432c2ed3b1cad896d04da20d528cb37d881623cdc0460d43f6f1587f26989549147dc774883eff9ac3768dcb85d4c8fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50a06dd8edd17982bab7adab13f8f79e7
SHA1e453abb677a2d79d5ddf3a7b5bf06041f45665ea
SHA25621258130e36bb54cbdf110c88a8ab007e7b1b856c2034d64ddc1296a6e679d25
SHA51268614a2c65afcc3c4d72d94771c52d37a62f206ad26153f7451851a29a7ba62e931640f598d305231b587b00dedf1a5a73c1e7159d49d56b5375cc285d530772
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59d16401d1da686ae24615df466ce950b
SHA17f00a265225fb73e58d832735ee31c57ecabc178
SHA25671fdcfd8b14be51e7929e6b57cb7f8da35eff5cc6540692c0e5ad5da8fc21f79
SHA5121e34811dcf8dc8cb3b4a58e765f549c4504be6c51e625d2bb1b76b5fe40443939493c0944b1c8e874eaf5a7e6b477344adff57b83dddac3cfe75a392d1b3d2d4
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b