Analysis
-
max time kernel
119s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
19/07/2024, 18:06
Static task
static1
Behavioral task
behavioral1
Sample
5d1158f342a0abbbb7ba589ab0df99b9_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5d1158f342a0abbbb7ba589ab0df99b9_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
5d1158f342a0abbbb7ba589ab0df99b9_JaffaCakes118.html
-
Size
6KB
-
MD5
5d1158f342a0abbbb7ba589ab0df99b9
-
SHA1
2d312dd1a068995b4592a0346009c92543bdcae3
-
SHA256
40ae35604a5ff253bf9fceb52ce309d900271501861dd2f1e6c9af0c10670859
-
SHA512
296997f26b559315a2274bcf4f5e391fab09e49cc66653b2db904f3cb4f2f296dd101a8dec07f392b065fae3067f841932e987a6c33b0d5f23b8221c3e36d83a
-
SSDEEP
96:uzVs+ux72OLLY1k9o84d12ef7CSTU3wZcEZ7ru7f:csz72OAYS/u0b76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000008a2f54abf5ebad22573662de1fe738050d667d5d741d4cbc8cd4a447d70c6f00000000000e8000000002000020000000eba93e92804c3b2bffdab83563d711f3169b9ae230c2a7865e624a1a2783a1ee90000000734f4524bfbf377459abc9d3ba91decdbc2d303407fac889f08f040d35a7900bb2e492fe06f1c12a68f0681b3e3132b11a412ff1514eb211e6516f6f728e5555ccfe6eb35f6f2cfcb663cefcc1d620e6ccfa2dd692dacab2709e679b7f999fc4280f58ce15bbeb0069bc38108729d657b0b02c6b14b3d64ff2538a53c291f6fdff51a94de197446330aeaffac14be40a40000000ccd5d79a52f95308adb99b640a72793e22cfa6412b1d7d6ddc8a229b21420845a66f2584fa77511f5c91b5d4df4544b183f6c4353c839b06c5b15d912b583dbf iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000004d3510d7c06a9dd9d39f9de893042a75755e656f5e91d79fcd2e86cd6e6d5828000000000e8000000002000020000000d1187a399701e8836fa52ff9b52cb2e4a7a28f32886026af73c594909d0130d520000000c4683d8e08d6c28f07d50babbbcce4682724b5265c734b412187e06a21ed667140000000bb9c6c7e60bce73107b9126f8420056cb8a271472fc26dca4805e0912b8891291eb252d772328e13ca687aec6e31d684a109d3ed6c0e234aac6101ce1cb06b77 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427574288" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9E983091-45F9-11EF-A533-F296DB73ED53} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0a33a7406dada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1980 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1980 iexplore.exe 1980 iexplore.exe 2748 IEXPLORE.EXE 2748 IEXPLORE.EXE 2748 IEXPLORE.EXE 2748 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1980 wrote to memory of 2748 1980 iexplore.exe 30 PID 1980 wrote to memory of 2748 1980 iexplore.exe 30 PID 1980 wrote to memory of 2748 1980 iexplore.exe 30 PID 1980 wrote to memory of 2748 1980 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5d1158f342a0abbbb7ba589ab0df99b9_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1980 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2748
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5237aa58a65c058d4f8467fed38d2a4b0
SHA1734a8d964dc4baf2d3c93c88cd9ac58115b45720
SHA256a40a24c7034ffa038fefef04f2a17c751165c2d64784720109c613ba6af5cac4
SHA5129a1e1899a7aa7951124c213ce7d3b2fe2787c1a151c7a5ecdcb61c260bc6bcfde710026943a81bad42d960d5fcf7ebdb043863dad62308834fc27b920bc8109a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e0f1f81c93984cd770e53d77440f6584
SHA15083f6ba952a904473a0f979e36fa223ad184b36
SHA25604e38669f49eba57dd7c4dde1f64ff36563f5fac38d642fca8a23b38e85c525d
SHA512e8bdc0e2b1f8fdbd1f7c5eccda2d99ed3008ea42bac49e9027d29b7eee0854badbbb0eeb0a4326b3295f4dfc04323c0b8c48028edbd7a495ec57ccc47c4f102e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51cf189576cc05e42a790c382335cd876
SHA15b51022ea832389e7d80422d32883d2076a7aa60
SHA2569c9b2c4d6f666701f581d45da0decdd9011fb9f64343aabb8d4afe0cac67dee0
SHA512fe6881fbf5a77e0dc764f8228e793cba327e9eda9aa7fc0bfd93ada1d9c2751ec585ec23db07ae21a8986838c5b91aabedd2398a15a4ccfd883b833de89189cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ed64027d83c47493807a869c1d908bf1
SHA1c5791e54dfe38d1ea9c4a933cfe32340781d2ff2
SHA25604cfe21f087fdb841ef6d123310967aa93b5d40ee647c1b526f6f0c395e32e0d
SHA5120653f612aee0b7f7067854bd415833c0088f7c78983c435e42ac4335e14f5d4c33cb024a787e989187d479ab5830dfea6711fbe97f493dfdeca52b12133052da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5def0fa5e6401b0d1f690e7b53efe0894
SHA1c0b9bbb111f0973ccb65ecb5526cd5814d21a876
SHA256056112780157d79ca33cd199bf83dcd8e997a7fd36f5ec5e4d863ec595ddc26f
SHA5125fbf2073f14265117cc4fb092ebb6435ec997a7fa495ba6621a640b434263aaff72bf94c6d33a2ff5bdbb3d55942c94551e2a554dc856278fbb985b48e121ca8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c3ac465d3d551b50d1b0a0ee65e0ccd5
SHA1704c79ff014b69999906dc19d0b336b7932dbef5
SHA256a7f8c35775b8fbce6391b2c3a47f559f780c70d6c19575a1640f76980bdd8983
SHA5123b00b779bed6554dfd90f2d1f7e9da0773a7fa656c6d19c3ec40d4f11ea0d31b715b727d9ab2db74e3f81036c6fb91db0cfacfe22e146bea616dd4b6b6356556
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c5720e2afb2f96f64f867f98124bb4a8
SHA15a7ff31bf5725e682207bef6fadbf1fca3b50426
SHA25691c8642bb3d4c98565fd4f1e720e9e79fee8648cc1d2d9a9f90a2bee0fe21c32
SHA512e6532a503fcc46d7e757aecb4827ff5cc4ed862a48ba7313f415858a8dd9a61fd6444c963c55bed7c7b776c9c78f61fccaef5656f6f18425645e0747fddf3722
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD517383051bc2f45758d7b3b439b3e49b9
SHA14207a428e71f1b74f7152cf366214a605de86c6f
SHA256ed7e62c92dc8f7959fe16ab48806f0e5734430740a166d6065a749a5005c6586
SHA512ed980d877e68717817b068cc5150b9b4d5b2c9367b5c5cf17691172da7daaf5b33d91450d740a583b634d4363d760299f47ebc3e565d84820644104000a9f4cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d75d73d83ec8b2a9bf7be8b81bbd23c3
SHA129a6dcffa379017afe72ae2dee37f6262315b30a
SHA256fbb85b713f03ea19cd03804dec04a85e124be42f5afc0c91d89565b9ddff21c5
SHA5122d7b27eded879d5c8209edf688067b933f8ebdab003813236d56cf86a49ee241b7298c9d9704e44e93c0ce9ed92e157c4144ebb59777e44caef6d6247ab56706
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50a943d5ebf0d5e307feb0f8baf631570
SHA19f033f82d1e33d5a1155517951fce8bde044392a
SHA2563eddfb133fe8c3a792f3f49a0f3d2f53906801d5e31fc0ce924f9235592edc5c
SHA5121a6eb561bdbb961d606342434455884a16beace9f4f45368039abb4406071874886b91b97c73a36bdedb6ea3173bd06b7d95d8cd2918d591be11a3daf97006e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD511d25807ad55bf756a2f3f72f624ceed
SHA1bd9f5fba74f538b71f05a9546497504f13a8c859
SHA2562b9ec3c4bcb9bc8dd5d113fe3a86383d727a4094daf1eb584fca9d2eb5ae2b7d
SHA512d5c1d33b1d5f3a69055bb36cc8831995aa5330d611d5267294858b6691c5e81eb199e3302fc080734259a0318cbff22a55daea05e62a6faadda94a0fc2dc7890
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59032ac06370af63341b2c8ea1c6ce83e
SHA1285ceb147b73fb922ba636a9d2718d65afb12949
SHA2566bfc3ac209ae9f0a208425082bb8061dfd5f34f002668a3e6f4b301f1bd3c7e5
SHA512952d99bdbcde0c692a502e7b79cca1a10f2fa2debf8adbcd70f5f4d2d70021e3ea49f80709ea27e655088e2c2c848ac0cb726b01db78325a56ace66f83a288e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50ae09f606b5da682e0f50e93bb6f9ac1
SHA1ad36e37f9acc8bd792539211ac9d0435dca63053
SHA2568c8851f1554a446219b282e4de7606a2973bd344802809853c6d71214df127c5
SHA512ee1c0c6d56d935908191da2a290ecafe635902bfaaa7a952874f700b1b1af347cdf8b9763705cf5cbfe5c8f4ec2b3d53cb052d998fdc50e7d22096f062ca8262
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD516dfa8ae6fd484622549da21b68fe2d2
SHA1b41ae2f8999258b333c36100b81cbd6866e7d6d5
SHA25630c340632f97b89161f3cd39fbf27840183738a202a406b940f8df75c303a6d6
SHA5129a5c49af97185d1acb0f854b911f040d561199e8d10cb9f4a5bfbe9748f84434be150b42cda483232d33d18f2c1da7684124ddec330f4ea90c608efa1f5b18f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58c82841f8f2a5fe1be0dfbe51495c31d
SHA11f9df56b5af4c50dcff95959b6d6a86c21c826f8
SHA256bc14a4c39615fcfbba135354b4cf375d4209e92f9f6a4c164bf414373fe1a853
SHA512fd0909d42b3d7d0bdc8a9fbf252288514348a985043611feb5f1db558ab82e862a8f30ce95c88e371ad872c253e1ebb2e0e2191e3ad2ad6a1f585a408647e30c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53fc7ad6ea59ee0c248875e707f7d7850
SHA1dd86f19342138788ae81798dea1951c1dc19c1cc
SHA256816fd0bc858be09c29c686fe999cca8468d777722b7409350f7cff2ac5158488
SHA5127953cc87c3dea20ef54c8c78d36c750683a999c92d0307d3c3d755a5b659095c41634ee4f9987d9cbf71b620b4431036f11509fd2feeaa70503bd9341031eb82
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD540513ca7efcf4598cfcc4f4a79f5922c
SHA10f37a847008103c5f77e8203462d5b4d23dd5cf2
SHA2563e60f70526829b31d33b71e8018855028d19d20a1a06b518abf74c58190cd30c
SHA512d961a89ec182f4475074807de1cae2a9bab30c8b5bd25c31452584b34e8c5d0250a5def56dfe9766242afd98cdb67cc6e33b08112e58c756991e840f0116b2af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5743de9541253e762f3b3dfdda74d759d
SHA14d36afa212c83fe15a70c16b32e27544d4d65c70
SHA2567bc7c0ed32f570b491516e3b4381199fdfdc342ee545cfc98a91cd2204f865fb
SHA512f22561e52db9ab7247338732ca70231ce29697300757f1248027a56524db65490f9a3d02957d8f3b2f8ac558aea92f2e5c523ad020a9e655c3aada65d7f2aaff
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b