Analysis
-
max time kernel
137s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
19/07/2024, 11:19
Static task
static1
Behavioral task
behavioral1
Sample
5bb7a6c547a47ce7348d3b6bac5cfe42_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
5bb7a6c547a47ce7348d3b6bac5cfe42_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
5bb7a6c547a47ce7348d3b6bac5cfe42_JaffaCakes118.html
-
Size
12KB
-
MD5
5bb7a6c547a47ce7348d3b6bac5cfe42
-
SHA1
e7ec22ca3f2969b8dca3f8e1dfa8c871ed5a05d3
-
SHA256
18cb26799aff267f4aa7619a7c7ae33cf53897d438cdc4424dfbbc29bc9de909
-
SHA512
4dfb7a6bae78fd1d7e2e3adb75bbc644bd0f87e435b0560330ccb37523b5536974a3f68954421fe44e61b24d11168a679bccdf89379394a0a29bb0b6e119460f
-
SSDEEP
192:2VQlIsr0KXyJZVC/N5Wr8k/w1wvqyIBnZvn9IuVC01SAuBuLbdU8d:sQlIcCVGjW9/gcIBnZvn9IuVC0SAguLZ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1041c6c8cdd9da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000f70b3b0db4c5d1ef558b154e619e387b235c76768882f4fd42e8937b26997b9c000000000e80000000020000200000000a85da472c91d52285dd631906b090510da54a2aaf49a447d694224e0952f084200000002476af20339cff83b50ceaaf0aa187a14728b9eb61a6c327b4c04f45eee24be840000000639c40bd0997e840ff2c569064592864c6e228717ec3ceaccb2442086652e784e8810388c75cb35cbec848d97caab912c57ae1ba18595c0261ce7db2120907b2 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000f0c8bd8cc1b80211b96b009f6f6469d8f0c82f66764a1cc9349cc832257b94f2000000000e80000000020000200000008f68e2d739d0891ad0b723732cad5da712a9fcb211bdf980a4fd1fbe4941828c9000000001a4633edb9566b1a0210c7020740062eceb6c02845da2bc3097267217d458a29bce878db032dc0032159467cfdaa0f7a0662f83c8fe24c85300be10fcf43c3edda8555be467b40dedca3e1dcf8cad36636084069216e83bc048c021f803d9faccba56413c442fd9bd3cf10213351631d90fdb91d256ad2d1d6991b3f1f748c05d126dd3f818072189d94b3a0277e3ee40000000b06b89f573e9e25343f4d2d50fa40f4e81404494894fdf867a62fc530d7f7c38106044c6e6e4e93491a8a3fc9931e54a77540711317648aa1a3ae3cf375793d4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B45BE771-45C0-11EF-B557-C20DC8CB8E9E} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427549812" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3020 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3020 iexplore.exe 3020 iexplore.exe 2792 IEXPLORE.EXE 2792 IEXPLORE.EXE 2792 IEXPLORE.EXE 2792 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3020 wrote to memory of 2792 3020 iexplore.exe 30 PID 3020 wrote to memory of 2792 3020 iexplore.exe 30 PID 3020 wrote to memory of 2792 3020 iexplore.exe 30 PID 3020 wrote to memory of 2792 3020 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5bb7a6c547a47ce7348d3b6bac5cfe42_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3020 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2792
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d070eaa23c66637b717f90aa2bc284b0
SHA1c73aeeeae8da442554b62097a3f4a60a29387dcb
SHA2562f27085e230f05e02008ca40a6c12b4b00dfee2a8e8ea45929ee7ca0341f6b44
SHA51225d4f00c71eb101b93a18f7f8f40baba61772840cb226209c98ba574abd2b63cf07488e25d7e69a2609a459a4341730b21a0034a4c0e9f3d3b0505d8e03d382f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50b1cf78dd7e65c44f6720d71162a0a18
SHA124ea9164b16a5d05e2a9387dbdf55e65a75c667f
SHA2568d1b7e1db8fa7dae259a5e4c99089bb7b21b18fda6dc35134a4098ff6f1a0f62
SHA512cba5cd9feeb53f2f22df483e87b6ec3bb01072e5532dbb601b402eb0064fc814a910b2b8d3069cfd881745a34b94cdbb4da7d40aee26d996f88fe36679069f56
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50ce793f45687d5a0a85a2337ba8b6c3c
SHA1f191e488c5cd0affeacd96b5399f1c60af0ffd54
SHA2561d18a02a95ae93abd73568427ae0e1db06fc771f097a780ed36d7e5d0563253a
SHA512e1a93883ef6b788a63f0df1d57c9bb93cec9dc75cf37d95e115085f5f2fdcc67c4743bb3ed4554eaefeb904851d151dcea2e441c2990b07a7078539b96134e7d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52ccec2630d8cacfa3928d9e8862471c6
SHA111f0c35187f18b70a9a48e39f48afecb9a9aced0
SHA2567fda98b6829e5989d3c1071b5668e27ac1862fe82a85b80dc1f6208a6b2bdc3d
SHA512f5f42105b094543ca9a9392a64b5a4ec919b89c6e45dc549e8811988875ae820ce7d4e3b6cdfad34716afdd5e71886b3e749ff5bbf38ad6b8119dbc9e18aa42e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD581df55ad9db2ac6356935c5c9ab7b2cd
SHA1e84e78735112d66a422075178ca77cd497048d06
SHA2565ebbac38a3675534c0db475eb06d3b6c65d33626fb9a0f31e2c06bc8d56ef000
SHA512e7a50aeea00769597c9c302d981a78e99891527a164ebef1f3de0272104a66fc64b06bbfb347bd75a07aafc116744ee8453649b30fab9a8fbd4b374dd483c9ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59c2431f6fd67ce776c73ca121a6e6994
SHA1456f19db82c14c37b0ed15df345f9832683a195c
SHA2567e0377f828cd2184c0b7f322455241ea9f7c249b201ef447bc68bc96e4123b69
SHA512bf8ba82729f4e8df23039e6f36136c066bd9ceb2dd767e8feef7c2f97630a3c114fbe228d4ddb9b29af48280ab2d2ce0b514d3504384b7d7968ad321609fdd21
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD516dbac8da781c319be51d563e3a6fca4
SHA186f86340168028a3c17044126b0fe81ae35a3cbc
SHA2560b434b3b35060071b7a384ae8217d02b8b397143f112b04071327a0ac4fc119b
SHA512ed368582b90926342ff4b9842de330c2cfae980831117ae81370338b4649c4212da6c85f2a32f4f9027260460c9ba7e3f66b76fe663f139537af7954f51ebc9c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD528cd2ae1dc9170e2f6b3543603a8f849
SHA18d0924850b60b10aa9777bc26fe66696eb420840
SHA25685431fced483a334f8e722a7a9b8f50e802aef0390fe57ae0d426ae8abcb0a11
SHA512da01c4f2c68d911a9dd67dfd273d1018c5356881c4bb181e5f8c3e7ba12724fbff485b42672a0778084f18625b249bb608d293c2ac959c2d755737789d9ac0f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ae0c5ae8fa24585cbcc70edf837577ac
SHA19c9582f7715377b12e1b9ed90e31e43a87b813e8
SHA2565c07f4f07120a29383623e2005f9e82fccb55085d2ad1be5019eb9a4b881ddaf
SHA512e13b4ab50fbd0075b83592ff0ea093d65c37229dd0a0965ee40a97314253a8f9d431eb8c8dab62280244a7381f42124292e20acbea4cc92a7f753fea04f0a0cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD544621dbf0a2ea49fd727a3891379be16
SHA1d2b3f46a0a71f0567afa92521bd30219073226b8
SHA25651087f61c630fd5ee6c6423c058966b2f249b7c24502fc9dedfab003a61eacda
SHA5122471d1d9bfe60d8349f0831a4da82642d6fcc5afc0bf87084a1729cf6d79fb226b247edcfee46c3fbfb6a23a6ef71b7ecb8951f772f8227ffd33ab0e0dfd3ecc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57332e8a17fc0473cc0639897599b95ad
SHA1807f8ff37448d4a79eb5e77f76ca5737da96162a
SHA2569a3d9325d2a93ae013d37c78a5926290081b1d1f7bf07b7e0829874f7c4a8d10
SHA512fad3505d40483c528a54c8c9298f9677ccae9b9d836f3ee97ba699e64226a5dfc97fe7b026e6ae4e613827e1615cba7203b4f584b18159bf97d8e2d4a1e9db3f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5475185c4025c4ca035282d534f90c798
SHA1e2cc380b942d6f38468234ea07281f4bb5bda5c5
SHA256d1649e2d6d3770d917535cd7957820d8d335536da109050d8fbb41dc106ef6cd
SHA5122d1039431da5be2e256f64f6382f08d353ce48278eeafbf55f9f3a1280327841c2a0ea93c39ab48ebda51c97e4355d18d33e9a587c25785881133d8a6189a3ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ccbac828531ff671196a39405098488a
SHA1c21dd68bc0c34f64b81e2c95abab7f322474e052
SHA2569370bacc32c60c27a2b615c25d334e8521addc27ca10ae99471f36086a426931
SHA512080e29a8f6f5c295493dfcaa04bc46f141c301f05bd5e6f910853a45b8bb424bec75fc422d09fb9cafbe06e9c8c148f6835482f64e71cf73ce4692c48db10f3b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57e333eb2875a9b79d4ade0e5bf9fc246
SHA1f6aaa92be6d8d1044c12bc9351052ca7d52bea0e
SHA2565eb77c4c4c56319f790ba5f0de43244bf43c63ffe24dfeee7a05cba7f4013da0
SHA5121020c31532a6e8bc8ca322e91dc318d6c626984a93dc46ea5b178c678ddb068ad5ba7233154df0dfc34fe776d2f61555b561e25429025dd3660aab6f5ac2217e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bd6288b648e7c889eb7a575c440bc83e
SHA1cb2ee3da16d4534984c8eab7e1fdb1fa49da8719
SHA2568fe7566e7f963b42c32149c46843303b0b951369b4aa842f4004a07b13796903
SHA512f9088c2b52230bba6dd3afea08cc69f955e0e5bb8ee1a4da19504527e628d8e3edbd1155623e612345656471a595812b92633ff0c22d1bd9e3f7b3c4f4c25b6b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50ac38c1b7adc7c90e1bc7acb19996ce3
SHA1b088d32530c11ce93cd146e30ea0be3f30b99a0c
SHA256a74764609d87b02f3d2a2cfff0233bc349af95a96e37840260ce1f12f2bd4211
SHA5120369538144c7a5e1d3b6f9fea3dd93623d6bed8ba34732a4ff29255fde0dee7cb29657021cccd25db8fe37755c3e4597b4aae610c90f3ac6913c4e2537d0f0ce
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b