Analysis
-
max time kernel
141s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
19-07-2024 19:22
Static task
static1
Behavioral task
behavioral1
Sample
5d521e01effc6d96a777c7cef6c88ba1_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
5d521e01effc6d96a777c7cef6c88ba1_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
5d521e01effc6d96a777c7cef6c88ba1_JaffaCakes118.html
-
Size
19KB
-
MD5
5d521e01effc6d96a777c7cef6c88ba1
-
SHA1
a0e3371b285e2d6a82fcf6d6d216d445e32a3835
-
SHA256
9045c08e5946603b7b1ad29fae7347a91b33336122bd49d2f3b95c8a66bed1a0
-
SHA512
b36c3f4ae3a4596470c41c4bf8ce35df4bd5e8afe4fa0a9a07146e89d6174255c73c5fec5bcce739411e75f54338e696bbca8fe65554d1f75f648e052ff91122
-
SSDEEP
384:4+QfPFd9QZBC7mOdMYCtKfpC5IgSnbmFe7Acw96z8LAPd:Zcd9QZBC7mOdMYHpC5I9nC4ZPd
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a061c32211dada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000cbb607fb102bed91c9c5815b3ab3afab73f00aa18113802fee9331f54df584d4000000000e800000000200002000000025f9aefec062cd60b11db9c3ee607e571b458aab441597048b6e4effe58ebe0890000000f3b9832cb5ba299f351b8b8ea56da63bd3da7c66e3b3209cff057667fe24261f70461d71337025137806bdb64d598fdc1ca2b1254214ca9b9e1f9c2c808e92e07cdc2f148dd742a58a6c39ca635c00efcbacefdc1b754ea9430099a0dd307e8e828d4c19b797502923b62424ec5c8ca52cfd393ef25628b413742320b1fbd22a48f5750f2c124f38511a58acdae8d07940000000fb2788ac5c5554e5ef24a40867de70ce40aa94aa728c5128bc5fc23354b2963168a5d0c7ee0aefe78e6fd742d67c50ddca2e30fa30196b2faaf81bcbecdedc02 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427578843" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000b96a4e9b1c9ead943427b23dc9c21a842b4ab14220ec13baf5912528e4fbe9ce000000000e800000000200002000000071d31a4cb0725cfd4ebfc755875e17f8d4bb9bb9337a789e4f8cf02f24797cfa20000000035236904edfde747a398718111aa7606a7388459550a5a930d14acbcd0f45df40000000ffbaca6b993091c3c106e901c51cf8434800cf2b4fcf2ab92fc882d666fb7ee4c24ba5e3914f63931e1f857b02ebf99a5e9874a8d94c7118577308fd0c853881 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4D610C51-4604-11EF-8470-C2007F0630F3} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2824 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2824 iexplore.exe 2824 iexplore.exe 2728 IEXPLORE.EXE 2728 IEXPLORE.EXE 2728 IEXPLORE.EXE 2728 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2824 wrote to memory of 2728 2824 iexplore.exe 30 PID 2824 wrote to memory of 2728 2824 iexplore.exe 30 PID 2824 wrote to memory of 2728 2824 iexplore.exe 30 PID 2824 wrote to memory of 2728 2824 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5d521e01effc6d96a777c7cef6c88ba1_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2824 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2728
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51b5a556e75a74225d7d76bd2af65431f
SHA110504fbb5cd8b38b5a66f1d0223f69542fee220c
SHA256df64856e2818f7b13d49c7f36ef62667eb6632c606e84bafbc3278c45e6d8aa8
SHA512de785288f17f7b030992e7fe847da241c60ce9d0711ad054343374bbc801f8c89c59a0c82f6c7ccd4e621e3564ac824ba8f6179150d5527d3fdb70f0bd90b46c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5623f305d20a3926aca9997b7d6bdef40
SHA1f450851ba71bf4523abe7a58ec52ccd6e17b229d
SHA2561828b100b84f46d5fb0d14b09681bfc4ea5a4bd95c502f035889752f0941e358
SHA5128bdc14e7a2168517fe3444644f5776882927c484bd7b6288d7a667b1e4c9afcf7265372fa752a078b7c815c957bf83f855ad1b5acdf0f5ead558f36bf8c52f9f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e810c4dc27e5fa60eaae47363d4a80c6
SHA1dc32b1781848fa2502eadaad7a33d246db159de6
SHA256e7482ad60fc05751a072e0dc0d7cdc4069e48c003652fb11e7a2ef20216512ed
SHA51259cf25d4bead77ba0bd84d3c8e63dd201b6029bf79ac7ef620056a8dd69f851fc1c8f00541643d6952bf5599963dc83329d9c41087400b0ea5d9f3f4d6d1fa1c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ade0044bb1e4188c4254f0b20d92d7bf
SHA1dcbdb30ba614a95e1c7510d73939b7a5e61035a0
SHA256805cca082b55255b011a31495bf84ecc43617de5a42b17c90e297a7cb0361f5f
SHA512c14df6da7f5eacb75cffaff3616d8d220572c521d32797ff24256255720dd4e3a66a24556f6818f7abda511a5e7af9f98fbc938ebf81614890952c5c2375c28a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e6cfc16141985e488abcb376d28326b1
SHA194ce3d790cf9278dd90eca385150f5e09f6606b5
SHA25688d1d7e3a7e464ec2c68b58c7aee97495179bb3cea07fa32a438b0550e602f12
SHA51245fc010741227c5ea95c4582301e3413d23bf3718b1015bcdacc6e790657befacdba997655ed70fcc177decd374e675a9c2561dc157d070872a534471ad0c8a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5073ba79e3cd7204161b8d4d100148e78
SHA14a2adbe957b5f097693fcf3173545f0ea484cd6d
SHA256a060be3de932f293b33870cac93ae6345a86ee18d1975ef9ec5169359a22deae
SHA512bddc2aac482bd891527c828c01c312ffac3ee0174725edd03929ec5f6e45bcea5c494f5607864bfb828940c37d79b8ec1b97637f45adf43054aa064c5d1776f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d7a758945f1c2db7316503877246709b
SHA1c0435c77977628054ea357288c1c755150fcef09
SHA25602257ada80672837f8082295e16c61438596fc4833e0a587c4ffe9bccde3a03d
SHA512e13d9706e306e111681a62ff2243733b49f23f7649f52cd90720d2150df9562b4890abccbf94f7b23684e180e90b0fd88d1112860ae3411662d34e329a4f5488
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD524082a339f4d11d865e7afe1e352d548
SHA152abc86e4c7dd57073ac5a29e07e4f0aba5fe300
SHA256b92b92561f4b33d686961f6db3cd42f05ebce9d1e426ae069cb8e22e79257283
SHA51290f1e535da5a770c1810efed1d7e3e160cf0b61c014c447ff292e7500b404ccafe1ee42ef6ed4cd016ea4a0615ea188da47bd3e59f2bd5f84c2a65ccefb9dfbf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ed0efff219aa06f7428c66dd94404ad9
SHA195930499bca100f19bbb4c7014c84234a798f208
SHA2564cd1acb0be31db5ae539af014a2527c2a3b63be4061d53347ced047ceb90f027
SHA5124774c2dd4ad6ae5b56d042ac54a572c9bb5534326f3e25f52692c5c71972c7ec025a46653d462cd873b4c0c5850ef4fece6a3522fe13dbf8efc0b5de41292b5d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5406dd4c683dbd516589bd0762cbc6b42
SHA155aeb954e032e33fdefb40eddb7ded9b65f36cc7
SHA25694483352090ce37c877bb886b3e577732b4faf78bec0e33ad5ca3be29dc158f0
SHA512937c2ac8e58b0bd7ea022c4a9fa0a9cf03412e331dc83a17ed44f2e23a6313de6720540304c4ec2627237c66e5ed3dfc4903addbe7584893b87ba94a2ef7a412
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b146318cef83a46628d2f565b81b5bdb
SHA1e80e302526b5cd0eb6eee7c46a082290d745ecfd
SHA256c4967838d6e89a1376593c1f3d6e1749dd525222ff7d4a773c81f3cfca5ddc91
SHA512a42edf8326b48b15d7359f85c9afd17e32df3c4779566215ea1452dc6e9ee49af6b74b6aefd57386f5622be2a100ecd0a8665eed57e5ae505d6517c7d71a416d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bbca31f76b9ba23cf7babac722acda3d
SHA151f178cc8798ef74f23e09f85fcf160cefb790b7
SHA256ca902cd14b76c9ebe74b1a1a297f5adac858f696fd9a70475c1c3ef021ea8627
SHA5120ca3bf7142e0aae7c822162cc641b72970fec1bb4105c82bbe8fc9d98cb097f4c257fd13ea050b4c28918613ecf1fe2ebc468ca4e7c86a7a5986296f1d4e4821
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bb241111a8921c4a1a740d2bcda81142
SHA1fba4e86b9c92c4b50a09c4145678928a4f538159
SHA2568afa19023e5c08450e99e1dda26db5af5a7faf0f9dabce2a728c5bc2f791d508
SHA5126ef22b4821e51381e15703b26c18aab9301b963b15ecf638ad155efb1f76cfa41b70c43dc43ca003a730d8bfe54b637513bb28d2f2393b67552ac970b153f14b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58c4a533f6625a2cc7ff18e14d69b96e0
SHA1793474f67e508c01ac22431f14a39bfe8dcf3475
SHA25645171df18f645b9ed2fecb85ab03b3b5c748ee7b2073c2a261e0dbcb76b6aa50
SHA512aa2edfd4a6d4b600648cd9a788c19239dd4bb3fe136dde072d61a0ebfb5ffc8127581d94f58e4a4ca6e347f2fa9a8d459ba172f2cb5786a7dacf08052eac3b17
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55cb2cb7523a02b7886502fde4bab856a
SHA114177b6868fc0843a12c9302ad82dd5fdeffb425
SHA256a127729ff80641edbe3a6365c466aa31b242f23e96afb713c964bb0e3e58c375
SHA512a64cd35e0c487314124ae2b66ef0decb4c81e8da3b93a10b722895fd04e4ff7f5b2974fdf917b85617fc989216c7e315183066342498656e5a42088f0abd7ea5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5895d5d52ee21f6327caba8e711621991
SHA14e8cb8e5dc4c887ecfd7bcea2e32d2459122f1d4
SHA25606770a8aa778d866ef32de4514e4276fd71a4e2cee0d087158f03c66ba6dbd0e
SHA5126809f50a7dfc7e3407335c90df219c239e9affc2b80ca7c8c2abdce33275583d21d7861a52e6f7420dc19ea52b0d21d8dcb2414932ba6537d9d5891d8d0b96c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d1893b52d6e7b1803cd8e7fe72d8d44b
SHA197b273e33b3eaeca308af6210b36e00534c1cfa5
SHA2565b8858749265b57f4a345690214348a0518bcd770bbb88d550206b5abf036fc5
SHA5122306727a3f00d39b72747dee0cbb4374c01c67e6a26e973587752f236cc96e771536b2b2f3fbf78d767f3dd85b417aac6dbff27811baaf0f61baeef075dd65c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52099a2f81c3b879da5254a86993823bf
SHA152bf405586d1018399d290cabec611bfc11e5316
SHA256529780f3189312ecd981a5123a753648d3b760fdc0579f3ae371cbdfe6db926a
SHA512f4863d77594e01a35784f94bf1a683bbd8392c71f21cfd00b5b6f31dea46cdb28faaeb843ae5edf2a8c56170f4e2efc7d1e8b29574d797d0c5df3c7dfa997398
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD577fa945e461de287a13943099687cfd7
SHA129463cee27af396cb0bf9fd096b4f7951e59e90c
SHA25650a3ac13973c9811bc18407e0efb3783aa245b7b32f58853a6358bc7ef51c44d
SHA5124cf39336b8404a1580199202e237eab3d97548ffbe013db615c44be4c1ce826773e463ceae315af46d9ee1e3f35c43fa8659b6deef22d7d01ba42c3c428f11a0
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b