Analysis
-
max time kernel
69s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
19/07/2024, 16:03
Static task
static1
Behavioral task
behavioral1
Sample
5ca4c5cf91382956b047664d704e3033_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5ca4c5cf91382956b047664d704e3033_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
5ca4c5cf91382956b047664d704e3033_JaffaCakes118.html
-
Size
6KB
-
MD5
5ca4c5cf91382956b047664d704e3033
-
SHA1
5a2b33daa7999b7175d895a4d69a79542943fed8
-
SHA256
5174e5b1e13883df7319e89e1034bb829c1dd4027729534332b5866130281883
-
SHA512
cb03bf0281c46955b95b122d0e080f151472174ac5f2dc6c9251c640bcc70edcc85d9e4b30705c4c6bb26461e81ac7077b2bd3360c198330ebf6b4aec5667f59
-
SSDEEP
96:uzVs+ux70i0LLY1k9o84d12ef7CSTUzZcEZ7ru7f:csz70i0AYS/Cb76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000d06866a95b18c465c96dd1aa07059ed78733dc939485515860fc609ca8644611000000000e8000000002000020000000d4c7a821cd41ab961b9efbce3365d78f10e4daeeccbf23a6c18fe2df10f18f5190000000ee5768174cc830f7f077dd56f117270daadce534dabb91da986faa0e56e266d884dc4f68074544232d27b32d6cb6f4a141da6a98d9b76f946186fbe4451ab00bbb8d4b9e2c189df336da666f43c9bc0ab012e02b96f209a894627f5a9bc8563d48de4e9867d8a829409287d08144a55303fe49a1be64df11d63aef29ef33c5a409fd737020ff691a71c59b099864b6c040000000b9503af81ee0c69648308f79b94d31b8e9f82329f321fc9a8f894508c7c5c1202a1931c994b6b726d826f7957c72c4ad4e690d63e935caf33c2ef29221af94b7 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427566871" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000ff50e6058a2c487adcf59f6adedc34f991567b19ddca2a266afd8a337ad51b24000000000e80000000020000200000006c0bd8191d692566952ac0a44e349ab4decd42d3651b317120b0f2cfde6b31222000000058f6693c2e3cf5d5bbf18d8bff700386ae6128b42681cc868d5290c3f0f49707400000003eafc1d0622b070820791474a735ec1b1a01db2545bcdc62bb48ac8159b6aad7b8b557b8a1aeb33863e5b9ae502502dc11d2b2b42b6e2a7ae22acbdd3434a7b6 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 201ef741f5d9da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6C0EDF91-45E8-11EF-B99E-46A49AEEEEC8} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 760 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 760 iexplore.exe 760 iexplore.exe 1484 IEXPLORE.EXE 1484 IEXPLORE.EXE 1484 IEXPLORE.EXE 1484 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 760 wrote to memory of 1484 760 iexplore.exe 29 PID 760 wrote to memory of 1484 760 iexplore.exe 29 PID 760 wrote to memory of 1484 760 iexplore.exe 29 PID 760 wrote to memory of 1484 760 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5ca4c5cf91382956b047664d704e3033_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:760 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1484
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56f22b725c641713a040a6f55e2b1dc43
SHA1b30d0c34ee2b1131897990eb42e1805a89c00573
SHA256032f089ef79b8e192d8b940edfc3bb8c4f42cec21981b9fa8a84de98f1c8c1ae
SHA5129a7b61f2d18cccae28a1ab5f0a67d72073acacbb73709b73be0b60f8f81940e54b4a391643ecdf57ae6182ae30dceab5057ddf25449fa6e4b2124e671f0ae954
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD584063ca56bd916a3e4197288fabcbdb3
SHA1173d97548d6d7c8cac969e37c58b1e97b6525e5d
SHA25663678d43a7eea43c850fff593dacdea4b2198c9f28ccfc4c7eb67ef92f2a9685
SHA512701e863c8f80c8ba3d5212f7f73665558acc08e33a325025b652bc5ceafba9f6ac02d53b9ed0a7fa88e83a8a27c4e2c94bae92739ba06bdb6e348198069553a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50e41bbdb75a315b19c15b58980468977
SHA1d6beb4f2cacd8ec402c5156bf86bc546ba02eaf5
SHA256aeeb814f7c58f512590c0cb5dfbab62a77c695683c1a8b23d4b8ab628912f261
SHA5127d7a087382bbc8b0c760e66fa30ae88c45a0012d7f11bc319c82ec991e5a53d23dd12e070eaefb5b0803b99b1259da5b7570581a54daf9b19c491120ce2cfb12
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5affd2fea419318a738cd493f9bdd15e7
SHA18b21852fc388f241a613f08380eeaa7171e940bf
SHA2567911e828cd7424af7e6bfb24ccae1b0780144e86e8f0af5ff770f641f22d00fd
SHA512db1a14793041ae0a73c967afe11ef503a38aba37eeeddf0c2e5264db73a18315e350156927905c30aeee421418ba87d35a708530d4337df99ad050639f678ada
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58e19dd0ff047e499daf4e71cd03b98a4
SHA17e72a780df9dc100b28f9419896caa01c52205ac
SHA256f4314802db57695d42333df977fa0cbba45f3f057914eeccd316e5ad47c8851f
SHA5124863fb9f942549de44af9bba7333d8b449ebc306f7411c82f73665b25321f3e8d9a3b885765321a7b8bd6b7c8c14359720f595649c5034dc951f0d11cc92853a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD574d18356616eb8992789cec6c9f8bbcb
SHA140040e00ba0ee184d15090b95a85de7a38d3a31c
SHA256869efc5719606058bddbf9427eb452d9dab09c9f4883fffe3295c26e0b424285
SHA51239a9af01415f620c01c8b5b121f676f980ae60731b95e97de02846a9f1e40bbe6cade407f759f9dbd46612124be55d241380abfad1904a4c92e5c40969b96912
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c866806ee18d4ea1d3e88745024a5f1c
SHA160aec358cbaa0ebe8856edb06da7ad5de519b006
SHA256a3ad8c0f1121e210bb6d07b3c747100a47ea94be2637c0f35afc2b0fdd323093
SHA51215188a4ba71466859cd498ad1c0c5b385b4c21377ee46639c209c4541f99c4b19f3b2e4facc472e374dd539e06762530687ea90d6172592ad9638e763631f9b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e061dacb5e8827abfb1f41da79a8f044
SHA1de13bb637f8494c0d8be5a3a42671a0b4a4fda9e
SHA2563c583460a93f1e05a50410565838bc79c6909a449ef95187a99703728d0498ca
SHA512b8ca2f4d5f6a1a8242a8e8068a74640b09a888525e604011bf266258a625cbcb8406f8b463b97a4e3166ae01ea3d68e2b772f98f1a75ad64520034bd0e4c2b7d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD596c7d243ef3c4946da04e034946ba211
SHA1537de762b425e204ca492fd13f4d29bce1df35b9
SHA2569411a6ef0352b90af4be072bd29911dd5f37b9a295a0f31b6aab74de633de489
SHA512eb89b21eced7dbddffce909a9866ba9571746a14f0a75bcad96fdc5cf4a98b3bfd8dc6f06626e5aa326e58818e8651d30fb77496a013732be35b6a8198c92bdb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD552c34067e320961d2993786283be79f9
SHA18d4ab7f8855cc39a8c4d2884106bacf1a9899792
SHA2565cf332d91e43be52496ce76570a777deef298fbd776e7f522050fe9c570656de
SHA512c341c0a3a7addf0ecd4ed7d84897c04a8e2e749fc86a9ab13b2b02b949298f08dd95786324bca6ca48d5d19ed369063fde522deb7cbccdc3bda18bc6ae8afa8e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5443c0f787369bf68d55011a4e4e1bade
SHA1b8ab24d24f447bfe0ee1fc85cfd0d35dae6530da
SHA256b134dee68d86e5a33306799193f543d36d12eb8e93a97e6a2ee09970f02d60e6
SHA5126f58e02b0e1cbeb2b04d58a5fe3d5fc05a64787ea3f418e7fa12eea716e1dd95b98e38255cb6051bbb8f44d6c777401c26524398a46ebbd5ce8c881e47d4b8df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dd4dc2a4b80f69dbf687786ce4d18480
SHA1947effde11ed9b6f2da84e74c0109715c0434b87
SHA25666822eec5ad4f55a9454223fe943998b81291120de3492b163b1923c5bc33554
SHA512ddb27b22f6b3274de6a93d6a1727cc0528235151db2d3eeeb2a887236261887a0af484ff9c29d6da8c6cfd5e19c30a087212ca32a0e5b07030b455d574297618
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c60f050ffdc74f00671d724ff0c29a13
SHA1b6779d38b90019188ca53b38637eeefcf0eb6cc1
SHA256f6b46f3568c2b498cf947027ef0dbd7727f6d5b7f73b020a2d2c8e2dfdbaa481
SHA512c341232dfac037978bcb5dce80c822218dbb825e62b1ac473254862509ee05099cd6672dc840f3176b21b7c18fc97d09cec4443a8588cccdf0085ee0784c1d8c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b21072888707ec8cb3fff911e89c9588
SHA1c4c4e5afafac61cb30784d81064c746e6c3722cd
SHA25647f7953d20efe8378e91f6aa40fadb3de51d0cff065c129f526d0b7065d04756
SHA5122d9032e25752ac41182e57a5ef3e0c0d1f4e0b17e9e8748f0692b20221aa37a79162672839f1865f8d78670f82f9f9c5b7766ad90de70310a71ec09778ad1399
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD549334215f6fa26259e62e477c4ff4e16
SHA1a63f0d83d72998dee07be8d35b448ac98600020a
SHA2565a92a397425613687da9e890c7e3a24930a5479d855258aae08d9d902ae94018
SHA512dc4aaed4dd7876c65261323d8541a47d19e53a3e5d5f3fedacd107ddc9c3a593e8052aadc3d8564aef9f83561b676d9ba3ca7117691e849fdcf1d4569a4bbd62
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f00bf78dd05932c4b229e3ccbdda4d98
SHA105756d621ee99849afd507ef1f28ef7386283749
SHA256a7e72a0ef13e9adbc260d2dcad9cd073151ddf090080fd19648726a19607cf93
SHA51245a3b81318fc13a9f8a0beada48d7256081abef6706b49c612d3c43078a307f60a35124ed184c141741ae02a1deea572a1e6c7f65f332fb4b42a4471e54e65f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c1499d318c4b8241f4bd329d1059071c
SHA1202dfc7e918609649137c62df715fb776a553d24
SHA256b68eb2b3a5c83c476576cda655019a807dc28d59f447b5f8ddaa4a99c38accfe
SHA512a9a3882b5935eb317b4a805cc720afd7c00ccb06cc1cbc56049360bf18fafb61143884eb75c34c1def98aa1b169d4683f6b9afd51fe407f0e314d3d556ea4a43
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a6188ef29c1a81935abd7cd91727a81f
SHA118a80e18bcd9fc2215da63af5a6fb4633947e0cc
SHA2568d03486e1b53985cdd80677fb7f44334c145119de75db746c5345df67e149d7d
SHA51252537d084ac012b9790b0391d7ee8cb72554e7da049407af3cfc4fc1bd50bcdbac67713f38ed4b2c1842dc48acd6608750514cb8c94befbc4530a660691a2c58
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b