Analysis
-
max time kernel
119s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
19/07/2024, 09:49
Static task
static1
Behavioral task
behavioral1
Sample
5b6d327964af202158a137e41b197347_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
5b6d327964af202158a137e41b197347_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
5b6d327964af202158a137e41b197347_JaffaCakes118.html
-
Size
6KB
-
MD5
5b6d327964af202158a137e41b197347
-
SHA1
53681a3d5ee684ccfd452419a36a8ac2439b18e8
-
SHA256
42dcd421fdaf3d716a0873e40ba3ed37a6f7b31276b650a71f1e543244469f20
-
SHA512
c6de541fe360dae451e712b0a110cd5c501f7127b571162bb9692a95311d5d1fb0cb644f314d69fc17d5523f12138b555d421772b1c6aa3bbccb7604bfc71895
-
SSDEEP
96:uzVs+ux7tVrLLY1k9o84d12ef7CSTUjw9ecEZ7ru7f:csz7tVrAYS/qxb76f
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427544443" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000e40191a654a2affc382b95facfe23a67943055057a17724e791d45672e773001000000000e800000000200002000000075e780a3cad807d1ca8a09e3b90134b4122409ce23d6f31cd2fcb6df98ea005220000000b894824abad7351e8319efa0f6fba86c4359d25d9b574f4554598df7b20b154940000000a17f651ea00c49082ea056621cce03629a0eb7e94a8dba7a543201f2fcc77ae68d23e42067de03e8ed7879915cf68d6ad49068f821ebc0de0e3eb56a3b66303a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{34C00521-45B4-11EF-A205-6AA0EDE5A32F} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0d6650bc1d9da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb47000000000200000000001066000000010000200000009169dab8d5ac08c6ff9a73c0b6f5369adc69ed979caaa6c89ef70afbe4ced1a0000000000e800000000200002000000072a99ecaec842e67e44dca20fd2b258f24ed826c1821f1418e4f2fc271ecbab5900000000e777c62dc9ef382d35b713e8bdcf1cc8b1947b898bbe536d8b58561eae4b7daa1092b1c88a86e38a5f7a28bc76901b3d2961f7e039cdac6dc7b08edfe49aaaa058c687cb52f927b0cbf310b5ee20998d62cb8b28dd86c0225c2edcad4d3de17040642ae390b238560b8c9caf54261c2e20a6a9f8f91df3c3845ac30118d99b77f803aae5cec5bfe07f552cf5abbc674400000001b53157277c07f1c764c33f9d0f43147670150e186efc084eccdf95e2aa61139f270f89e5ae910b8761c20cc5dd933c28bc8e9376818cc24bb65e7b04515d843 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2696 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2696 iexplore.exe 2696 iexplore.exe 1848 IEXPLORE.EXE 1848 IEXPLORE.EXE 1848 IEXPLORE.EXE 1848 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2696 wrote to memory of 1848 2696 iexplore.exe 30 PID 2696 wrote to memory of 1848 2696 iexplore.exe 30 PID 2696 wrote to memory of 1848 2696 iexplore.exe 30 PID 2696 wrote to memory of 1848 2696 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5b6d327964af202158a137e41b197347_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2696 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1848
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52bbb5febaa21f81958c6621cf652205c
SHA1f96a1205ee55003456049a53a6480dc0eb8b5357
SHA2568dc59499175adff107c77c0dc9648df4cc074dac07d318a781b3dd24fcf75b22
SHA512dc99a8082fb3c7971d20aba7feecc8c2b929a55815ab01bd4b9902aaed1c30235c12f7b43ad9706f18ea8af8186e22a8fdb2fb8e487d02cf2fddf287d19d8b8f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e2c58145120fdd8c01e108b03b972a66
SHA15e3d5dfaae6e6dc583baf6f863ed475049b42b0f
SHA256cb4965addbd612a8939985f2abbfd04dc5db5d803152f319ff7f40a56b3b32c0
SHA512ebbb92b6801da3260c9aeea880b98390b4775c906df17807c6b753a6e06938c5740718cabc712c4e9c04809a889bd219c3a9b2a0174a4e97e765e02ce024529b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d1b9826992383ed600a178c6fc27ae15
SHA1f00dc4f5f3b99be2d19051fde4329d55e8dd6d43
SHA2569476b28c40ab87a68d068147243791b623a052237c54475fed5b017f405ec9f4
SHA512b821f41d1374640a60ec5469ae9d42cba84e0f972366501a8737cb411273dde4bb491f2342bca53ab1ecc70ad8cd87192d4d001b346185c5d21733eecdaa7de9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5835b26f69965a4b7a4ad99af52772e3f
SHA1697a357825d6d90d8442cca7a3119ab811803512
SHA256320b1916ea05f32bce579cf1e65b568611652a03969a03c3b91bb01ae41a8ab4
SHA512cd6345f5dce9e53c83c391a8f84d200681b94240ff25f1af84379048a0a9833dc077ea08b4c14fd7a309084610a03e2463ff8b41da61456faeddfd5314bebd1a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52b373f25f5a129629b83aa1f79d935d4
SHA1e30d577c4a443c7c2510df020cb7ebcf493117a4
SHA256b96e199c345e85b209fc173036f0784418401772971e60aa9157fa9e786a13c1
SHA512ab1689a26b8a0a5e07367049776899a317078200262d09b789a81c94e84b33fbe8e3a9a0b870a84587dc06dc5e2acfc9ad756c8f86eebbf9325769984f432a14
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD506092b7606d8b681e027857d410ee49f
SHA19e12d327a38c3478c6266262cd898a9c951ad1cc
SHA256dde2200281339be2781265cd77dc53ef08240eacdc963140ae45ea85611b345b
SHA512f8a8c59c209f8db5b960c93b070f9e17a1d376ab65ac2b585fcb1b277b9cbc38aa3a3690a08668f2f1c7edf91c9aa3b4ef52883e7a49c6b7106f940ceab2a4b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d8d18a97ea25d5f47f279d9b860770ed
SHA1725d7e5579c770b17febee189f73cd628a4fae8a
SHA2566cb4873aa25619c7617adfd5ce95008ec185f153457e6e9fb28dc2fc9622db6d
SHA5126162f45053c080706cf870ab6c652b98467d1b38871ef93f33c009701150b7ea22cadc9d276f7a54b0d835df08aa58475b9aa91948d400b4673b05413920729f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD542306fa371e576cdfbfaaab98f9a8e46
SHA12b2a07411f38e1908cd1aaeb2bf2c7bd13e003ee
SHA2562bc6da5135491b85c14d366b831b4dc55feac63c8e19b06e2065dc3bbb82e59e
SHA5126cb2fa009c9175a5c4a52b38566399862d80d45dd76e094328e5cf06cbbbfa4f6fe12e4d8ac78116c6c16832d0bdf50b33080c3a8baa526d90a19bb303a8e17f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a188f6104f7ee785e3b78ca73fae2a44
SHA13600b76d743665a1c0bddb7ef49cbee8ee8f3b1e
SHA256d3c6693312f6dff6475529df8305b3e07611bbdd7f12a68a7654be751d64f9a4
SHA512eba9f2d1a2580ef0549008a6857e28b01c4b44c092cdb33aa22e7002262b17f6f431ceb0971bcf1574b58cb354d54e963312891aa6693cdebb5acc6c56c77bf6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50d644330a8537c8b34a76cc72008881a
SHA1996835032e9051a8edb189d00b522eef330e1419
SHA2562fde99394880c2e65fbc3685cc4bf6d3364313f9c0e4d958eef61f27d553c71c
SHA51282ca0b8b8f8bc58d14b1a7e47b6f4a4375ddc36e81f97679e68bb7dbff67abbe4e5d2d8689e693ed9fb8199770a315248ec31bb0d6032a5acfde176f8c375d4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cf3d84af2691f80e619b6f7defdb0fab
SHA1cc0b74db1588af270ee55cd03593d9a6093333c8
SHA256fe7647afe5b71980060b49f182bc06d00e43ce62a59842a301e32b98078ae182
SHA512dac5b49c64d89a4b3298d982eae5ed5133e1fefbb2ce2a65fc3f9d632a3d478d1af03efbb1a1df1cba0b41e317ebf16064f957a2feaa136b8ae6aa333d5a7d5c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54523a40dbe74d8214b6a948f5e61fe68
SHA1f85daaf9902404aa367bee90d98fd25629b5431c
SHA25672217282f595d2ac880dc7aa3ba9f176fb2f70c36434c8126ec48d5842b846fd
SHA51288fec15204cfa2533262e243a6eb1d2330ef693c34f32948342040c3bda6a2351d9529a9dd4f0af0eee2103eec636f89913284bf20469e5a8237dcfa2db2f7a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD562c2ef38e6ff2ab15165a7b7758d9090
SHA17d76ba4923905c5c602f4666cdc8694ee9b7b415
SHA25615c93bb2ad3be6b0ebe5a893e9f6ada64888851b28be96efcea6d71d54ed509c
SHA5127a82dd539d7fb912c043571a53da6c15bdcb784dbd940aed21d6e54a8b2cfe9bebb5d35324a72e5d9cfc4129e597e0d8bccb5639cbaf08baa0834727f078fb14
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ffc52f59644f0bafabbf0d4a61044231
SHA158d9a5dc55b3cc3af20c70d1d1f48deb55291c2a
SHA256edac49d46daa4976c838bf92a0f7ce4df821fbc9c981eb8bf45d4151985acc0a
SHA512ccac95e22045ed251239c35f9e6acd18244bf86c39bf9cd4ce57c3975cef3b58572c23ab194d0af4abc9b9d79d064dd72badb42ee7a85e4c18830fa6f6686b4c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c1585bb14668b1f99e748be66acbd64a
SHA142712d47dabb92011c359ded6be4f57edd8ce1f5
SHA256fba6637e41b26585ca50d402c2549e48eb1e97c923c5a16a539d2c3b2f6bb551
SHA5128b2537a48eee93b6769a9b5918486445deafedfd8d8afb4269f5b2ac14f451a7f140e1fe80d1206993fbb30284ed40af321fbec28c0c230275ec849c347f605c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dd640363cfea4cbaa869abf24b600024
SHA1cbde2a748f581d4087d4353d8d069eedb124f7f7
SHA256e4710a655d838e8d479812943e3de7bd5244a4e218e52e39809c840b2d9c8790
SHA51204533ad4b7708c9e34e78a9118dc3994838f0bad229ed37ad298763d683da8b2a905d5cf4d8d63f464db728fed7b2cd323e73ef6551691ae40e3098a11c9eb23
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD589234dc244bc659b77b4dec6985bf6b8
SHA1514306358b39a69b0937b54feda0bcddbf3f8bed
SHA25610f1c2299fd1b882a98b31fab44323d644613f489a7854bd7134825e1d8781fe
SHA5122114b6963ce64f95898222dfd6630354ca06c1a2ade601b4a72b87a0a5fa931df03ac933e08cd722f0dffc8df35e409f87f2b5e6578e4617387ff366b6e25cdb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fa0ebdc900e9e841c9a8394cf254f370
SHA1975342f5a6212eb48dfb01c3a96a34e8ca0260b8
SHA256945a37b5096734cdd80224fc4a1c2944511295ee31c78d084ed63ea9c2bdb99a
SHA512727416b470b059db238dd4779a2bfdf62876175add8b538ecaf726b37c46693a73154a124650fc43d11a7528e4c036848132d70eb66db22bcce745dacb52a3e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59073967b3b5fb081c7fc5f57c2a6b735
SHA185cc75ca1f5d4b6101c8958f6ffd464bcf2a8895
SHA2566e09164049736f77eaf1632a5907c55a5421cf32031b250d73e6fa89f2567363
SHA5129e137468a18fb8803ebba9c0531f507e1bfb9cc29ce34c115be488398f7e964792365e26d41937ae604fc5d4b8ac497d1369dcf66524ec4fe521a01ab22b97bf
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b