Analysis
-
max time kernel
120s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
19-07-2024 13:21
Static task
static1
Behavioral task
behavioral1
Sample
5c1c55f49959675760c6b5956cbcc201_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
5c1c55f49959675760c6b5956cbcc201_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
5c1c55f49959675760c6b5956cbcc201_JaffaCakes118.html
-
Size
227B
-
MD5
5c1c55f49959675760c6b5956cbcc201
-
SHA1
315e5bc5869babeb8d9bac6c67d9e005e810b1fd
-
SHA256
d8360cb1f842d981a7f6b3c11512079aa896a865b10de6631c6eb96f568d966b
-
SHA512
b7cc83655354c997e62edad9d27566e21b63b03e46df816851f0147eb7b75d330f82b34aed2293297a44a2f191b5c01536f42aaa748301fd3c8016689e8fe5a9
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb00000000000200000000001066000000010000200000005884fd3b29699ff1bcec9e07fbb45f18be39bdb938b436fb04ef63274a02ca10000000000e8000000002000020000000402fb9c083c4ca42a0420f2845af427c5b7af0031eb0706afac94788864bd173900000001221d5784574730f548a24e0d5337055094149bdfc0ee722c0fed50daba63a039680cc9fb09053ec687fe096dc00cc79b390afbb1001d60e147a31ce01e7aabc6219fe03171079ba31966364116954d5496ca2b7165b9b80493fe13c9b98f9c8179f3e376e8ca8005edc8e0dc4a1ad5247846019f955800dc044b0991ce9a41ddec8c0dc4d525a3b7f2a4f33c2c51eab40000000766f3d4e27ca7d01d1d0c0562f9ff6c57b5bb10e51cc2f6f40288766cc7c9f77270e9642563750e28fa497f4e94ca4527054e8b36de00de1df51a68f770cf751 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000d9fa72d04d3c6c2c9465c7be961e790e09c38392942ebafa7b6cb7372ce65d4e000000000e800000000200002000000004fa63a5bfcf743655937eba667ac8bfe806acd03726feb641c037751f5995082000000028498a1ba75853b6766689e424ecfb5d6f2d22987d50d308ec6fd7c554897573400000003aeffad47a2e33a86d8a11b877bc6d0a7a440fa7eb9aca9322198090ff229d950e374599d73a24d383b4d815010427bbf75641c25a881bfb7b0b0ed0a4fa75e3 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0022459aded9da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427557139" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C423E981-45D1-11EF-A1CA-D22B03723C32} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2280 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2280 iexplore.exe 2280 iexplore.exe 2144 IEXPLORE.EXE 2144 IEXPLORE.EXE 2144 IEXPLORE.EXE 2144 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2280 wrote to memory of 2144 2280 iexplore.exe 28 PID 2280 wrote to memory of 2144 2280 iexplore.exe 28 PID 2280 wrote to memory of 2144 2280 iexplore.exe 28 PID 2280 wrote to memory of 2144 2280 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5c1c55f49959675760c6b5956cbcc201_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2280 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2144
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a2bf96b75c59c29feefdaaebb9fbd6f4
SHA13e266b4728e35065eacc9b333119e987d81324ad
SHA25655fcb6d783d95d151db0d1202f483732449bb9e26896d18b590e80ddfae67107
SHA512f1965fed2590a16c20d1cabbc5ac46e6b75448fbd2445851f3406dff3965537b0e1c7ec704869a301c2a8ec2c65fc7e2d7aa2a31632ca7b97a77566816a08cc9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD575f5048c7ccc185aa7c800d1eef27132
SHA13d9178986d602bc0ebf894b1485f8c0220d400ff
SHA256b8ee6ab23691fc0dc71941a99328f7bd1fb5ca6340e7a086cb3ba3f6fccdc76c
SHA512ccce7fabc260d793fe22d5811fba6baeb164eb339ad87b8d0ab63547e4eb72e112a8099f2259dd3248a8c9402a30c4d0c8b303e5314505cfa06e9662e5f8621a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b7492717639cf452e311c62a5b2e5725
SHA128eba7ec2d085d82e992d64080ce093e753cec17
SHA2565dc7015e715645361c1faaafea5049d8ba5d63099191ef86f9a1ceb149bfcb1a
SHA5124ce48e77744eecd72ca6ce27253655023bcde437c7b0da9a305f2967963e0577ac4c95355144385d5473dc80a9c8d4afa56707afc5566b96d1a20b79732e0a87
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a0fd76ec3646f69ef68c84f2e54f6f69
SHA12a1a7e5ba1dd838a84db9a793a23dd35ad737392
SHA2565d6f5bcbe180c7edda809c6bba9836e8d4707447c727e407720cb63519754c27
SHA512f1762a48317c9d98c7990b64eeef0c57a7f0a4fe5698e2b737f5e99da95d3e136a3fcf9f888fbbdac7c8a33e5b53b63731fecb992e9af89af13953413bb4c5ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD523fe133ead768c19bf164f7d3a7b0881
SHA1f91f87d1d605e51e95fe1ae21151d26abd95e97b
SHA256ba9a4d487ac60f801e3be4d6f7ee2488d7e8fe2704480e1aee1010f5be5fdb66
SHA512eaccdcf318216afa9084340bbaa7fc473183f8c576b8f27ef08684ed29fca008e1acc9c100589d2e13aa0691141c36016083563ca52be41b0028359bb97abd2a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD578c8028a35f8c94d5087f2fc95c30fb6
SHA1b4924413892a285e5b1880de4a2bc0457cbb4987
SHA2565ce33688d6aa565db401e8164dfd814db0e055933500dabd77378a8eac61f22d
SHA512196666640e9e94aad65518048d755154e2847733deaa132d6705511944ecaaa1af36375390663a8c309364304cc3aa96602b19951946e741209a640c155e12a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57d66aa660ee79c85ad2cbf9446c43183
SHA19181513c46943d24e544cae88381e0feea758adb
SHA256155e2942d3445e6388acaabcef5152e208a4d1af4f304df2879ff0addef05b38
SHA51229ba0bf993dd7e4411efe183558c46b931c22e6fbbdbb30305ae15ec4b04a660c0451c5c727fc9f4c7b141a7b00deae4b12177d809c6372cf20a1aa939ee6a2e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5381da49a4748194ad1b2ecbbe26bf694
SHA1728879dbb0c90f3bdc3350e5ed5732c2020c3a79
SHA256c34138944b0bc692cdef7d8685f62dc6e41b0426ec073b71ed22b77d71a0a15d
SHA5124105e6b4cf41829c15c246fd26b193e56395acc8aa842bf291a897a8cb06728d7527f5906542ab06678d66e29c8a25d64f3e303e49510b3fadf92d3f933ac453
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a1313595a28cc0519d6b1729ca91c73f
SHA1d035d4f1bea30f5b6364e6c4c9bdeb1af3195b13
SHA256db3fa6b4fa29d365f94f325e0036667ce8c2285305f2ce9d734611e34a6efece
SHA512366a7446b93e0f685846c89d7630eb36be15b912b563f2314954013922473a5887d50ba67e6dbb0bad1b73276b8e2fd807ee2f214db7b2daaa079582e4f7d599
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59bc7b6c89d3cbafe9688e8d1050d5e3b
SHA15dee1062abf5f3c89d3df81c27d541033e3c61ab
SHA2563831fd33446752399c782ad7838b92f7bb82c9662cefd8221b8f21a2bc87cdc3
SHA512df4d86b57d72fe610934a708c228b0c71867f04ca001a82d1bdba091cdb29351bef124c1a18b05a5c24fa9725efaa8fcb73c53ba498a5ea3f9af675317dfcbcc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f1d7bd6e180cc6af8763d6835e0e16e0
SHA1c33cdad1acd6bc29e3bb592852212f1e59da5b82
SHA256ebc1a4a5ee944ef6560cd41f6274364b9d54893471ef9a592bdb35c17dafda5f
SHA5122af3ed11996bc79c48117ba6ed9351eb238f207c10388eaef870659d2e8e1e67e6a92ca3e9d74da85959741ef962cde0817a95c695e3248d587060c517a00574
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ed63dc996385eec97380bc9967fd818f
SHA1f49001ed9a0159e7c087d37908656519215dbb16
SHA2569eb626f6c2e444e6e7e2951f3c91e74829cb217924cbe1858c7bed88d2e6e1ac
SHA512bebcfcf79dc870eef000263275ee5a7283b9ff67c34b4ff3a407da32c8bbe384c8e84d956967ec8372d2c4070fb0d405defb55e95da2e0abb14df1a3046b2b9e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59a1d389023b380295e0dfcb29d8d1fd9
SHA17c68d3aa1e0f9ea41046be62612125bfacfbd292
SHA256a6989583bfefa6899ea086bf223a8907798bc5fcf3a329d96a613b8e6e1595da
SHA51247146661149bfb8ca3e7224ddc03c30f4f7ccb0120b9958ed9bd0ed8bb94560c66808abe0a0563449fe12846792756ee4cb5404eb16c18aa40b93f9fd7462c96
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59c3ef07c4da68568528444832fe6d02a
SHA11f7e6f1d2d2177538e52e69bb750b365441bf0ee
SHA256d9cd7e5dceb6f4cf646e2660c994a9314dc1b6991c632555b1ea8790e87ca0c8
SHA512de8dd2a35b54220b451f9c6e360d8f96d4f9677523a0b4b8e43d598cba698a40dd5486701a6d86b3aafaa77132b0c542b8e5933b25cf5095564ead4e6b3b6e8c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD573ddd7a791acb7e5d2a4051687b7c703
SHA1c6e536370c89e9adb3367011c72c939cb4bc7a15
SHA2569a9d2e701cd2914d03b6b7672af4065fb92ca66ca805a78dd34a49f4e5038a5b
SHA5128ec442fe1d572bc9c5d617aa0ec5968eb8a4b1498974d5c212143e8fb63b2fbc5a0f892cb2c71f7b9179a21f989697119f0423e7ea562d3411df8276142b245f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51d40caddf40ecea3608fc2b7ff59df7f
SHA17fa2f54bc1e3e4d77596a51f1fbbc203c2cebff4
SHA256287363f2544df57e60e5a073c736409ade9cac82a7096182ebaf7d9ef5a81446
SHA512aa7cfbdd9fd0fb39be823df45a1a66c837cf404a8bc634defb332157b9dab900a19c90e58e750dca0f68b2685b1ff39909a31b120a5f099066ee8bfe9019e85d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50f8c850ce946e0244654b6f8385ae707
SHA15ff051beb86be7b0bd7bc9602b2259ab5f41059b
SHA25685077c6cbeac899d54b44cf7b205e0b45c8e0d38da271a1729b8d532da8b77de
SHA512739b002c9ba0e029e6d416862f0b47d13c372950ed1e498f33f103f926c22359bff18f0c2f28767523783a5e7e2758cfc06297c058ffcb54d24f5bbc6460c623
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bf56c7a72c009a8b6fef324ff7ac5617
SHA1b8687723b8be6b21e07e6498b44c3b2c7a9156b7
SHA2560e05323d5587632c8846c5f723faa1d804890bca6106ee21cb417a5ae40f15c3
SHA5121bacf251a0860bba746db068495c0261d6b5949dcb1227ce285b2c09002f721965a9dd22330da6975288b4f2ec2c679847accb049c9081fa35f69238736b75df
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b