Analysis
-
max time kernel
146s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
19-07-2024 14:02
Static task
static1
Behavioral task
behavioral1
Sample
5c3f46b8a4153279ce481e5965ac60f6_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
5c3f46b8a4153279ce481e5965ac60f6_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
5c3f46b8a4153279ce481e5965ac60f6_JaffaCakes118.html
-
Size
21KB
-
MD5
5c3f46b8a4153279ce481e5965ac60f6
-
SHA1
e8c1e0f517c517675b4685e79e29c1779977f164
-
SHA256
7987c298182a9b93b98b99b960cd0b9215d8a380ffb0f7ad80332a492599f259
-
SHA512
07f4a258c8bd9106b24cb72554e2897112592f1954c98177e009c36c787e0551bd47e40588d5bde71ad0db69e9d8e1f89e1e4ff712f5458c73f29da5cc20247e
-
SSDEEP
384:VGLvyG2USpYP2rRkFl+e7cMk8NqDMD3BNS4:4LvNXp8T8w4
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9B133091-45D7-11EF-B96D-66D8C57E4E43} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 103ebb74e4d9da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427559649" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf710000000002000000000010660000000100002000000051c247bccf21d8617b5f69568697c6d2618d81fbfaa235edb584435a57f540fc000000000e8000000002000020000000439ec38cd403dd7f0a5910c66797ee02c4916ad3ccba2cf9d580d77a59de102b90000000a3774d153d4f2d0b1f5935f002424fa028dbe40250dcbecb302919a6d3bee8bd9f332fb12ca2faa77f34facb4863e88aa02ee3f865148d19b1c9ff08cbc1d5b2b6012ef3ad777648a8d566888a60a1e4fdaa20ed8484e5d56ea61946e2a39c006d0f79a27518d02dde35c0424ba7791e267082b6b178feadce4c8ac7c1c520ab9acf22f87ac810c245a4371ecfb09f6940000000dbf2b7e29080f1567a21bc396a273c0b85ca32e911c7f6eaab0d961b670f7f4a58ee7a7771bd251716ed9dcca2eb8fa60c8867f55499eed4e24126380d009bb4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf7100000000020000000000106600000001000020000000a848bcba22c50cad63d8f3aeee63790e20a196da8f71cb3655b74cfae4fdd530000000000e8000000002000020000000e443bc933af0bee3433bbdafc527ff84e145e11a1dcb32673b350d8382bc621120000000c3b9a0e23217ca59f16692de8879d8a60a39ff9257d5850c5fe849ec9068b9ec40000000f83fbf2469e561a7047f74e40ac260fc1a8de5e985d9874e42956f4f16d1bd0704dc351e0259ff5adc6de579ffdc40b2281ecb661216ef128ef62b39185c6f8e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2124 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2124 iexplore.exe 2124 iexplore.exe 2188 IEXPLORE.EXE 2188 IEXPLORE.EXE 2188 IEXPLORE.EXE 2188 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2124 wrote to memory of 2188 2124 iexplore.exe 30 PID 2124 wrote to memory of 2188 2124 iexplore.exe 30 PID 2124 wrote to memory of 2188 2124 iexplore.exe 30 PID 2124 wrote to memory of 2188 2124 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5c3f46b8a4153279ce481e5965ac60f6_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2124 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2188
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b99e65a36d1c91b38fd9d5b92c0ca4f5
SHA1157277c3063c3bb7788ac0fcedeedc3e5876d24f
SHA2564ac2cbc0870b44cc7cee111507bff1343d44f74ad6f4e7d46d0e6f1f32c0ba03
SHA5120b5e792acb93996f5b44ae90a5f287830864c8c7a166d77db5761427f10e47678278331d80e0d8747f6fa031fa36aa94a2773257c57bee21c0e9d6060b796f75
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cc2fc780867b7ee932e2f75cf601027a
SHA1ced52e529ab9f8eaffbd8155bee23a59717ef979
SHA256a0d64e56f8b65215b0e2ea4f3c0c40e43a76006af4d27280fa8e546dc7ce5082
SHA51290a3c4e53b41c0c0acb771c6eae40bfca35544b9395c297a3cdb39dd0443676a65e05d96a3e4762edd186440e3054f5ca9e49e13ad3c56f299d9f2ddcf986b74
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD536b3c168d9534cd996e2ec8b6c78bf81
SHA15f353350779fa2648db94e32a0d66af6a68e5959
SHA2560c393c9a095fe261f5f7d0e33d7bec9bdd82611ee50b46edc2c84112a17dfda1
SHA512f701137c40a96165265aa67f4c46f4db8a56dd1987f51a6e24f3ea4ec1357869e428c06457bbcbd596823e50829d048fb6c26b20f6db5b63844a0e3398a4e2b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e04cf108b1fea6ed3851466912858859
SHA10204d905e7ba3036d48a4396c75bb5a356795b4a
SHA2564f16466c2b60316bbb578f0e348ec10c19ad9ed0fc7bbbe523caba117c20c2dd
SHA5126543d7f2cb75c7f526a6cddc05d9fb8a647c609da5a38646c274fc5a9c04b0077d6d0d8772e87b0b78cbc331c43cbb6b81b791a4a23f03c078cf208c18eae33c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD507d119fa9a9f6f278bfeb57bb1b906e6
SHA182c449a7a9ac6115c10b2ebadc57b175fb362b71
SHA256d33309007c7ae0bdb80c8f0b846a352a88833b7215094e73028f46c58e8cd3c6
SHA512807bca8a478d31ecb8ad8b48c080b9bb96c2ecc935dc2d17465fa99871510583977c5638c0f9c3bdde296c231c2f54586f6f5a35898f6977b78d1a08fb4de05c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD546cd1b172984eff0f6e7cb12ecde9507
SHA1b7fef25c40b7361d35fc2e1e4c40dac4ab828878
SHA2566c4ac04c3aa00048090f1a2d284e95dca9bc9f2571c3e83e60d1632b764474c6
SHA512005682e6ee2e118aca7d075280575940780ed44f5d645e63621586d45d82f0c8921100c9eb16e558b82ed7c0214975f27ec41d8a00581eac4ffcc4131f15e45d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bdd240db21c397d321d7cd83509460c8
SHA190edb987e2bb0c08328002a168a06135fdbc46c3
SHA2562fe7c17f79f4414ffd93c035897c9ca6522c397920f36ba2c2310e4153013225
SHA5127942969d3375639b9e5f3cce4c346d39cfe31915c99d20b478d65bd60231d2d2da2baa3858290cf1a1d07b02b54fed2a7ef0f65780eb8dfce42f612cf3769231
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fe44d539e2148b70f0b22dd24f0300fd
SHA16eae4abdc59fd38eae546520007b9e9ca47f51e2
SHA2563fbdfccae9bf9bdbc17075d720e3146e852de7870eed2f25d5441a9ac3ca23aa
SHA5125d294e363039e2d03918b32086ede36784e0effd4ad699f5c62549e022c9027f7a8fc1e4aab4225f2ec59001374a5fd8e6fd604251708ae677644b38970837ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58fa1ff5bd2006115d024857caddf359c
SHA1103f2e2d19d69a3a9f4854b7b04f07a7e8073add
SHA256e8e21d138340d828d6d8bd33ae41d42a68aca96dd6cccdd9ba3d0e36cd4ce491
SHA5122cb8e5e45e9221a6d81a7fbd6137f7ba85b500a7e1b8aa7661fd045968461ea14df6f855d528b8c921dd3791ab0bfae6a6424572142861f381b6332bac50d75e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bd8cb3e2239a385959381e30cc31a6b4
SHA1f3e103c7f5e7a5193dea705e350a0c481a88eead
SHA256f68afe6cc118674bed69e6eb31c96d6300ee316ae18a6ae1dcd80378f57e9fbc
SHA512a22c25bf22fa8ac1520b6508798ba10fa70e04460b1ff2318aa8dfc9673696d0af09c795c203edf3af4a7e42c25c274d69dc012ba4d4c5b5655fff4ae5fa0f7b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dfb1195a94b33fd4a9197605405de088
SHA1ceeaced8dd252bcbeabcd809352645c2a9618d8a
SHA256be6212b5d09fa35201643833c85de9382ca6e8345c342989412a48073eb88d9e
SHA51293b1937044a20acc537364bbcc5ef030be71beff3e19ebccc6d26a2fde0b91995b3efb3f82c414fde38b19dae1fb86bf99d24e910abfeb4f84c8b78b14f6990c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51e74e7821521df3063c20e616daf38a7
SHA1d111b053e591f080d5048f86f133e61323f43ae1
SHA256b7bd22395fb53f8c1b1a0a6a2608a0c38c6216b11782805795c51a08ab1145c3
SHA512771132389100a07a725261068069a7966332c1cca8d8f326a64796599c8ec1f9e32c2c7d95a7e7edc6ede8c998e0232d1b14f6049171a4daffe1088a69df10fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ed05e72fdd492d82989092e27706015a
SHA179c14cf70cf26f951eb89b3b7d5810fe5b8ae5cc
SHA25686f727f89099ebbbb609f7821ad9e97ae715158de89e9be48b623b9c00375003
SHA51202d6990d5d734d8a6f394485f7f5279d6ff84e5776c4cdca46deca212b9c1668673abd616523f92726a1a4441470899b18e720decab9e42eec7863296ed2c64a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD571d6fe9bd843a04a6ecd42ebfd99ded4
SHA1f151ad4032858a4201784ecba6dc3cc8e2a9021c
SHA2566efbf58df9f5774d723711d9998c28e86bc0dce95839a56067b13079e5c59bc4
SHA512a0cb267d07587ccb11cb54bd8627b13bdb9e1de664e6e3b247e9ac79d36d08656c568eb04566fff86c8e486670f37940cfac99a20abc5f4b8cf462fd8dc7b466
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55f460a513ed40a2d11555df2f439a714
SHA1ceb19111b24fdb53b0d24c774360894093f2fa92
SHA25636ea2888e82f1d3dab5c8274d0848777a35f1d2fe1d2f79e240b059f9c38b28f
SHA512f1033f814899c2a922e20f79931c03280eda9035832dea2a6b1827df5cbe18d60cdc74f77ec07c8c1005431b27722126a9f6d8bc4b6f8ef9d5dbffbfb1a6614e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d0b0f1d427c744f6ff1df8c1a7a71370
SHA11984d70b3a816debf845bfe92db752c8c2202160
SHA2568b268a095d184966ad2c550e26abc7e6829f2ca8aed93b83739b6a460247310b
SHA512bb5004ca5bcfd26ae34d1450e7fef4cf3846c7cb5ddee7b05e7e714f2f45b0ebe626956b504f168c954e94f26ad63cdfca9d5ee028bf4a502a50a624c2b533ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5697a3afd06da0b45b47a7c9ad053c54c
SHA1c1f22a26e2ea46e1cc8812a556a851a10d700613
SHA256749a14f81f105e1fe7ad54f893a3da44454202132961108a7475518b32fc8312
SHA512207ff568fd3c10e6e6c2a64c71232a84286e8c4c5b5896b9f03df361e8be21e72b4b9c2ee0345e1f3abee17d0744e3c7043fcf9808436133a24dab7167b0835b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD563d8d3808ad04bc6c6af70d1c31ef0bd
SHA1caf855750ba1e19df709f956871d4eed6bccbabe
SHA25619d54444b965b87aa9ae37f610d58f02f90f7444921877b95ab9d8699b9d4eb7
SHA51246a09b9fd126117730aef2addc0d99074bd062f078597af1eb33fabddb833ccf512d656cf7d0c85a601689c611947192aa9ba1cd4061bf8c207f77fe69ee8883
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b