Analysis
-
max time kernel
119s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
19-07-2024 14:07
Static task
static1
Behavioral task
behavioral1
Sample
5c4402e5c2c96ca5507fb4e197baa27f_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
5c4402e5c2c96ca5507fb4e197baa27f_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
5c4402e5c2c96ca5507fb4e197baa27f_JaffaCakes118.html
-
Size
118KB
-
MD5
5c4402e5c2c96ca5507fb4e197baa27f
-
SHA1
8f44b3fddc4cf632d98cb545e5cedefe42fa2b0c
-
SHA256
600f40335a063dcf092bfdfe08e9f568eb28e7567fa0e70749680734d5ba3ce7
-
SHA512
8798d5ed0d6c91b06b8a4977530e89fa563ea32168e076241fff40ee26797915931c9aa16d015882a59f5069922077d63d11cd4f9cd8e75f762446c65a6b62eb
-
SSDEEP
1536:4v9tkTjjLI7qXcOp49iiNtwUC+sWedXDQE4dMU:QWHjLI7qeVNJyMz
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427559926" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb470000000002000000000010660000000100002000000000b27fb867ae954e004ae50a38497723138d69c31a87d77c5705b54555fbb12d000000000e8000000002000020000000353d9f72ddcacb904abd37288941c72e99e51e57a1991024543fe536c975904c200000006984bc1a0fe44c664cda04dc590527d2d808dc60c7018932049e3005186b3b3740000000da118a1943b166167a1b159adfb3e9f0c486bcf0b0a6184c322522717575f5b9d2d9a462f8670e9a9dda966ae0b5f54bf5ea8316817522966fae1d03c53b3cb6 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb470000000002000000000010660000000100002000000006bed6c3723a3c5bf8b79928b67a6b268f0148b9e41ba879a00e425c170cfa75000000000e8000000002000020000000a390b12800a07acca565407e430c7a168a05f96d02ef62fab20662810b602d0690000000ef6e27d73352ecc925af85e8a1a8ca031f400c61f8e259271433e398160c782babf363daf2179efae9ff0292c38e25a230d4567bcdb609d0bb43e00e4baca84230f0d9d6ed02abd03a8bce4fc9c1184e5f7c776a9d7b5d787be1d67d69f7127256ccc5e89777a8cf8d82e8e6f9aa58a7973816be9e9b61bd704598b99d5ee8650199115a0888d46b5a01e92da7bf281d4000000017e076a2e42a011e5197dffc3a96c54991ade0a09b9d2e0b9c37b31af97720cbdbae5afccbf4571f08391ff15deea5c66346f419389d72bee30a726c487cb27b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0eee228e5d9da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{415C8691-45D8-11EF-80BD-DAEE53C76889} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2280 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2280 iexplore.exe 2280 iexplore.exe 2548 IEXPLORE.EXE 2548 IEXPLORE.EXE 2548 IEXPLORE.EXE 2548 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2280 wrote to memory of 2548 2280 iexplore.exe 30 PID 2280 wrote to memory of 2548 2280 iexplore.exe 30 PID 2280 wrote to memory of 2548 2280 iexplore.exe 30 PID 2280 wrote to memory of 2548 2280 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5c4402e5c2c96ca5507fb4e197baa27f_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2280 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2548
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a207c89294f319a32e6edbcbd1fa4b3b
SHA1f82c1ad4c3fb1128036912b457be93df8a04d0b9
SHA2563d4801ccb6aafb56d203e1b9262787092e56787e4b91f936741445bdad9c34a7
SHA512059169785463c0488a6af81de9658c0283b7bc87c2bf9de6dbf0ce4bb966d9631a0a22c7b1c221fb448cd0b4558a56690d642bff5bdd5fe89a47d5ef60e55da7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52f637382f21069f34e92ed08978137dd
SHA160e62267af9e171b8fab3c8d520c8f39454c6845
SHA25616efaa861c1222778b7ab4026074f7bcec8a96b848db825e011afb8ca31c2ef2
SHA51235b10d8df0e41bd9d5aec97227d78fef76eaa402f7160940254373b0d9fe31b678d27da1bfe68c4b92d545bb6e83d594d6731981f6ee13c17ee07ce451b0cacc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5058014676de23274811fdf609106760a
SHA199290bc0ea3b3027aaee3ccce148f9ca5b320610
SHA2563e94d616294d057795f2a1c6aa0c6095b8c86a91e8782f4473d0d59c641f83a6
SHA512badb6c6c2fd38de3e3be6fd7602dfad053d681a5e51f12660fd51430e5bb33dcb2e963386627da09c3cccef55fddc1ff26b94a17c2bb87d6e04980c0d86e778b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52d7dd118572ccbb798e11e6074882f2d
SHA1b67036bb8abb78209961df77e14ee986c69f76e2
SHA25676f0e6bd15cf502e3b7fa479cacc07a7510bc877ddfb7a0828f3cc32063f67be
SHA512408668121298b2e4e70604e883556800bdb2652fcad2a5b48ba4c498a87ea820296792568790b268badd19ab976db10771d2368af65bc65b983a65659bb4483b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58d50c387604a0c51b44e795b2b1bbaba
SHA1b4e50255d1bc763f392f87770f0ee4fb170f4055
SHA256204221b16f64eb36eaf0c416893cfab26ef4ce5687e48a98bc2ef6282dfbf910
SHA512dffbe4b11951d29f63448b49de691d831a62441009792ca8abb09086069c207f77a18732c29399b4ee1080cb3e5db2ab5f6160935717d5325d33a09403c79fab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58291b55464c0bb9cb6cf74e5beff93f3
SHA110746745dab2954a6e2bd4799c6920c8b8bf0259
SHA25682cfef2ff87931ef6ae2ffb22b88b67106ca16237dd63117e486620df5a31461
SHA51268da9ed07c797562304a3640c93c1b980e6c2285ac702d97c5ec775a17ab9a1a897b1736637f0c311aebab1e02d3b3707f9440a4d6fefc86aa75b228b0c342f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD579d7ad379d0bb2d491204243772f3fb2
SHA14ea4b6fa1281774e2f6ec47db5e311ee4700d0c3
SHA2568a4c0a29bf72a31053deb5e821c39e06a207fb63a7a494e09fdd1ef511288ede
SHA512761bf27766ece8b8b3169b53bc3df425382e1814494998ba814460eb981cbfe5950ff084d592325706258872d33eb9e36ce8c78958a3ef0f6817f439da4e365b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56c1d91de04a15f1ade4d7ad1e08dead4
SHA1e4bc77f486418540a21a3324d270d35f68ebb5c1
SHA2562d70e1375814d1944047271881143e3b31eb3b741985b58c4e893a58cb123190
SHA51214a4920d7d776d663c00dfb0e62a28c7eecc6cea582511e657da01ebaeef473f42a519bddbbdf69f7729883ec7d59e26c53ddc78acb8f81e45e7d4ce74b444c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5414974a0c241cd82afea924659a5432d
SHA18e7687a4b96f8c6a62254951bebb18399a4413f8
SHA256789b982c3db824820710da6a4eb83d7e182de6afbbc55537667acb86e8749098
SHA5128ebbc9c16ab4de7e349a67cc0464fcb7946120e9e9da4eafb06b32c912e06e0d580a11b22b64bb2b5a069aa872ac23b12269dadedc2c6f4aa42bc2d0872b718f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f522ae03a738e663e74fecb6e5c151bc
SHA1d80f2f333289e42247d91d6e257266be7da532fa
SHA256377e4ccf0663cf034fd79d602a89df13db4dc16c69462491183656a5f271f7b7
SHA512167f79a715a32a6cd61d1cc7c767e324cf25c455c0fc96d4b563869244a300f0dc1905dc9db94f10dd51c29815ca8233d48236371c0eb1b2cfa72a1a4b49deff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD511a1f5424dd267a03739c632e94c91c9
SHA1dab1e386fe411fcc2233dd07182129db7b3cfcf8
SHA2562961e64ed1e515e4e520b30ffe8eeb9635df44d7af8159248699006b1b770d6e
SHA5124af15b250f15b84df4b4647f2c73cde3ad622b26ae9250fafc0370a94363b2e37bbf9645b76fd73ebc9af3a1d8f4b17fc54b0aff89ed0c3579daf6d24f662089
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a5f6860d20c9cf35e9866c49a2d139fa
SHA18cdeb02994b3e15b57b2fc2dd8cb1b4a7e9520d2
SHA2563bb9c22a1eeed6a689d2ef5db561331ffb0ce4457abdc879b5a0cf8e697ec60e
SHA512a7e2ed8eb51e736194dfe61e05803e6951268c2b70cc364ec8daa3e283d9231a50d996564f6be1ee099e9d98baaaeae9d19f2edbd6d1f0e80a1deee2cb62ffb9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD570412e597d85ae7184e25360c990cf9a
SHA10ac691342d2e2dc63e9ed2db3bbd4cd3a39ba150
SHA2564fb7b6d9f85db34ee955f45538f07f35ac291ab1746e4ca366c62b888f1c12a8
SHA512cc0251355f0edd18152b6eba5e65acc6d7800ae8ce708bda862d0047c2c1541929970eb6a8ff9403a66d7c3b7f420e284e80e0f490c49a19d598ec3b94fb110d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD540c810c444f9bfb38c957a6c006ee825
SHA11ffdef0a1d95a277117b07d5a90a8221f42d7628
SHA256f3f9fb09c22960b414de79d059cc506adc4fccd69f69874573122ec7e5f36c7a
SHA512a4e2c5dd2984ebd24000ea8ca2ecab09b811a45f335a178e12222d4f38e87047ae7b6707269a72c387383115f309d1906c8a11c154437b6d71da34208afdf96f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54d0f184f8f87297939314a378be9a4b7
SHA1d2fa715e8b0746f040aafab68eb1e2d5f4a9f2f7
SHA256ccee712c6f2ac0ffd99c8fd5bb24a54ff93d504e2ce8d80d3f5b5c108871ec66
SHA512561c8c31b9836c9bfbcf37cb11ac92ae40c47dae5c5c9d6ea27c26b475d1e57dc608d56871af1ff315241cce21c631fec1225404ee437fbba49015eeae01b46d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD598208afd83f0d33c20e2be3be7fdf09b
SHA189b058c23f79381892c3e74559e1171ca055bee7
SHA256a2a6e1b8eabd7638ff10f23dbdaa37f63fe0dbf22ee0ddb15d7ea00fd97e74fa
SHA51294a8dba3511ed1d653da0a75f9189f5d63ca038e8903adaa036c332b55fa6791c91cd3f0118c560bb1b4d83368ec9ba08df4df0a9002b009eaff69153452e6aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57e37203db51ada9f7d967762331f1846
SHA1b559875bd5ec20092befe5fbaa0c6a96a0302632
SHA25669514fc43e9ae297a9dfe58ffed1d969d3ac8d221f9e00b5820e82e899895166
SHA512f82956e1221c9e4c8731b46a4f41578195de1e7b53d3f67ddc8e828076fc39efd72454cf85f7562c704c4e77874f75e690ee84d52e400dc9b3c50b75b3adecc0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dc0312b58f919d7f974a44fe274d2148
SHA150f616b1fb128c262e36dc44ef34f8fe28fe2829
SHA256a1879fe507c4398c8c9a651e2d51261cb553781af4073f0182d038f6b66d6ed2
SHA51296bfdcaffc7cfa97235ef7cd84b94ee524cf6be21cf041dc8e06441e843d7de414612e68b1868f4e593a15a7fa2bcfbc6c068866b9804a590d471339ca32149d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b