Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
19-07-2024 14:41
Static task
static1
Behavioral task
behavioral1
Sample
5c5f9ac04e6732978323242c0f57b2c2_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5c5f9ac04e6732978323242c0f57b2c2_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
5c5f9ac04e6732978323242c0f57b2c2_JaffaCakes118.html
-
Size
26KB
-
MD5
5c5f9ac04e6732978323242c0f57b2c2
-
SHA1
248961977a14ca024490627dc6252839a266ffa1
-
SHA256
ca32eb3c1d91634b216ea7090a55792f747633975260d580e8aba7b3b42ea4b4
-
SHA512
458b945d5d67d8b95fc984338b287a803c973c31e6bb5216a3be1df69e25c4e2e2d61789fc45763e9dfb4272bf6a2f3ee652d223a38b9dda7d43767e043f37af
-
SSDEEP
384:4+QfPFd9QZBC7mOdMxiBKfpC5IgSnbmFe7Ac4l6LukJvAgo0iJAePd:Zcd9QZBC7mOdMxPpC5I9nC4RIP0iJVPd
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427561959" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FD1C4241-45DC-11EF-A1BB-725FF0DF1EEB} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 606e9bd2e9d9da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000537c1c7b817b7c8e47717689507d21f875e9525720bb1ec36252252c5694cbeb000000000e8000000002000020000000cf39f75dea7dc003aa653dfe2b4137ba41f83aadc618ada680868a168bf0cb1f90000000e130a4f1c1a66439d401d9d11e40516be5cd086840270fe018e8aef12fc7cbaec5b9c8d53910b02dfc45cc7617b14e879dc8b69aee81871049115bd96d535413c8c2fc5197e4a571ed47a9bd88f3c0bb53e1421903d0d69bc36049e36eea209bce83b523d09ed202d7f41caad1b97d1daafd6dd3cbefd60e956170f1c52de00cce969dbea04d725a8118d5016caa022840000000e631f29004630f2c6d55bf90d3f619038b6d336845739c41e25ec2ab77bf3e0cf68fe936a1738adb3a71445e0c14cd22169099292b609853c9fae8ed3efc8f13 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c7000000000200000000001066000000010000200000004515a54435ede8f7684b4f5af121f7495c77cd671f231b79eaf059236dcbe1b2000000000e80000000020000200000001d6b241e4f9402451e456359fd548f8d397d4704d59cbb3ba0985fe3cbce5c6d20000000d2f5ddd529dda2c29d11ae12e71fa3a1675a99b782f1f47e531475dbe7c1cdc94000000029c6fd4d9b352376555aabbdd83d48b7e27107857a9a219f25d567742411ef0608f68a37e5cfa71d7c11960a0df3e10315b72707a2587369e5ee6bdca0c6cb06 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2852 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2852 iexplore.exe 2852 iexplore.exe 2688 IEXPLORE.EXE 2688 IEXPLORE.EXE 2688 IEXPLORE.EXE 2688 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2852 wrote to memory of 2688 2852 iexplore.exe 30 PID 2852 wrote to memory of 2688 2852 iexplore.exe 30 PID 2852 wrote to memory of 2688 2852 iexplore.exe 30 PID 2852 wrote to memory of 2688 2852 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5c5f9ac04e6732978323242c0f57b2c2_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2852 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2688
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c6caedda6d770949b4670d2d4e2799c8
SHA1f6b6617d2aad6bf1751eb6c9f87b039db0b5de96
SHA2569af0688af795367b24f6def70f6125797e4c02df60ba74a36c11d5efab75a69f
SHA512b2ddcc912d19caffe1827189034e15e7a34669996e93f62e5e35ff4f2c79c91c05693bf94d03e849a168cc6a857279d3a0f444883089e3c31f2598aa2958d2fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c121ee54f498ca909a8eaf6aa5616904
SHA140a469a70c4e35de4fb9414c124eb374a99d638a
SHA256bba4be94b4d37440f7c1ae06ace78eeb3d436b26cfe6237e1ef31fb0c83f0828
SHA5126d6091b9f5d1dd66a96fceeddedff02e0b86ca92cc954739f43628509c45ad5bb93e673891a7f6c3bb4f6c345e6a5542201b3b59dd2d9cda8e10da860472bfe7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52dfe1f7dc1e0123edbc533daf7c1872a
SHA14dd917fc1dd6016fe3961876e93eb1aaf175d590
SHA256aaf4283d0bf2a0cc8fac93077eceae3152877870f092c8fb5a451c028a833fea
SHA512da10a52d95efbcd788df287b4d9a93ed704aa3ffd55cf80176023aa953156dfafd7f16c988c4729a9bdcb6ac9a930578936fa793ffc843b47f856cc501cd0db8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD556b384d39030dda7f06ea0ac9db1e16d
SHA157b109bc00a4817e113b799c1d4fa9c4367cbd76
SHA25656e9da26e4c5a6ac535dff7b3f58eb0db54d2ef2e0d546e6243d323eeab9d3be
SHA512618344cac3d912ba6f0ada72c75f2137f4fb30ff464608cc6b2450ccd4c9bb19c0e5672cd80383040aaadfa3ba50fabac9d6ec601b64a94d13d6816813419c97
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ac8be8b1376968d5a1d0c52bff36c0a3
SHA17d019290e77abb2d19edf3c343fa5efb523f8e30
SHA256e1debf98280617cc98da64888ccc67387e51f24fab5531472a9cbab0cd37c85c
SHA51202c36519fc17a7736946cfaec1d7b4c0e5535c952a46e5495c779ca31687f69bbc6d144fefdc1ddadc446eddd796f9128e65a43ebe63b004aa472d6fcfba6a25
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a2ffd3bbb5a31b23907b0a52742c40a0
SHA17d1cd8fcd9998f13b3f389598af3b963ae58ec62
SHA256cd9e925f906f719c528a5aac75add3c9a4034d04c162558f04f5e44fd5fb7b7f
SHA512b040a9eae8d1be9b2d33c7934a2a4e72bb284a88619dbe5cfd441e85198f6ec8b279118050e35efc6139203e1cab17a83e6a4caa9c23a9b9dae47116d74ebf4a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59b3042b6c51c08965be85046ed4e2860
SHA19eb8e23b6a15dc1f9b3b4860fbab34529079a9d1
SHA2569d34022f38ce4787125585b3148e21314a684d65df147380eaf04a9779d5da53
SHA51228e4519be028e3615b79842bc9e4ddefa0dbbc87a59354d7afb2b048d12be5b63d313743e1ed770131ceb8c5d8fb809acaccc96dee99cfc120548623ed56629f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5413c5f2d4b62473d6c8e8801068cc035
SHA136be5dcd3e8385d5c2de4fc7691ab8c7a93ab26a
SHA256da6fbed06a1f66f8ee30f1d06f69de2cf628eb2e4010ff4e8b7156acaa934a41
SHA512900a9f79fc7571686e1cfd9d5afdb44cd5a03bf92e5ce0e528651b480a07136fe7aa24712d71c04f59e01aa187f2653cab15a2aa51bc749c173a73350dfae1ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52c010aa67e70b56c887029bb2c164182
SHA154a31ffae5a712e2c2affa8db604bcf28b247267
SHA2567fcf78ccd95ed06f75b3312b3a5d33e3a0d8b0a33b0d0685583852f64e5e9578
SHA512b6aa653e91906a47e2d2228b0c0fb704c197d7aee3891800c81b8ce02299fd102b922c9987c0a315db87c7933e06a932a2c04a1a182fa1f2fc2c89fbb07029b7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c9ea19d3a8f5ef93b03802d3338591c2
SHA174e453aeb986ea2680a9d534a4fa0b3af6debf9b
SHA256bc55cc75bb5a4f782b717d7cb3e810e3c2dfecc288ae03e952977a5e198c1645
SHA512b5c35d72f32f12d887e7cf013beb3353cc87625990de5bcddafb731edd4423045ba521b6a7cbc0f4c5774fa227519e4e9001bd56d41a93dcd086def1e7e707a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50204d84cbba2950e95c51eea982f44c2
SHA1ea568cf5e62b1a4d1b2730c31bbb193273c71983
SHA2562695495f988f8bac2487109adeb5edf838a4efa74134f037bdaf57ff08526372
SHA512c455c0241340df19faa4168bae5b564e5e5194818b70e5508ab135bcdd3fce06645fecc0d761cdaf444cc0f795100bac3ce274786bee47009d6e0cb4bba79eed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a2ecd7293ab7b3ef1c4ceb71039fecc3
SHA1b844011f92b02b84b0117c914f8e09d224f8db60
SHA256f081d00499822e32bc136e46a882363545bde0bc63260e807c2113e53c918ecc
SHA5122fa6f614e7c222ae3ebb8d1d81d09d478f6b5872ee102b889d967fa502ad7727beb58741bd8d162fe83be31c76656a054ee51d51113f10246899cae07d6b73bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54dae9bf310c7305a478b82f1cf8778b7
SHA1b89e207ed1da75ec508f5943ff29471215368492
SHA2569acfbc43d21e5680a983c83b61678923fb3f1defd6781bde7710dc43877b846b
SHA5125d2a3f7036e89b93661e6d71a2873e1e4884b8a1d4c0b04ba3a9dde7fc6abce1d31584de0570630b624a7558c07453f34ce2219371957ade19af5e75870a75d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58895285de753d5c5eef4b5154c7ad2bc
SHA19a8740e804d4b6690e6b8210e5169e3de9178446
SHA256946b0cc0fe70a14064914599034a48b159612dcd201a9ac504061e7ca6ecd5ea
SHA512358934656c1a4057ce974541fdbd7261a7172094ee98ea0b60663b50437f7e0dbaca252b8fcf84ecdbd1107265b6cae8c0144f1076ea54e81021f6a880949065
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55ff247ddb8681b41e70d38af50c10943
SHA151e4ca1d60eedebfd23517a7101ba2b3a4b01082
SHA256dbe87cf55ac6b0f5a2dc0f19c4071ba2badd9c0a09e645722f1b742a4878f2e3
SHA512d6943074f644aee02163b440d93041e9325850257c82d96c518b1434f661fbd87c6ddba5a4d034d8c79b0b7735ef2a9f37d20986e13b1dfabe51868f484bda41
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d2994c52cfe1e1b72cf29cccbfeb7bde
SHA14a618ffad53c0b1de0b71e935a9133540639197a
SHA25669188ffb24c5116e982e9541fe41dd2675b3a347036b7487d348aa57c49f5c1c
SHA51281118d1a7922c61914511f56025c187bad5675cbd7d21fe863ea806c5141488b136ed60639e60bbfb7a7da9816e27be50fe80e7058bd1f2494e6e5eb49f1565c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c03bc115af5df185d89c5448405a34b5
SHA1ea564e569c9e96cdee1d9c1d357b5c518304c060
SHA2567fdde43e28c45718d7980f71881944ee31cb5a3b93fdb09e45262bf296d3820d
SHA5127219f927dc2e281d2adb27c8381d24004e1b13cf26e935e5a14862ad2f11b05fdfa338051d1c03d7fe0752fbe4996b3d84e1142bb42f2f41d9d9057822610cac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51bc4668baa93955926db2275d4914eab
SHA1cfae50275f135ac684d2dcb32296ee0215804e69
SHA25672c378986d3147211d14b45013efd646b107ca2725a17f9c8b68509d19a545c2
SHA512e58051a721f8ec8913af1712bbd149ef1835a0b284bba804676680200b7cc1e17089a6d273542bd7aa94f4dc326583c9b46f610bf7d298f3d0c75cc4ca6bf548
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b