Analysis
-
max time kernel
141s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
20-07-2024 05:03
Static task
static1
Behavioral task
behavioral1
Sample
5f1f3e9f04dc4ca90d0db7b51be708ef_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5f1f3e9f04dc4ca90d0db7b51be708ef_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
5f1f3e9f04dc4ca90d0db7b51be708ef_JaffaCakes118.html
-
Size
91KB
-
MD5
5f1f3e9f04dc4ca90d0db7b51be708ef
-
SHA1
2b0358cc65a41315545cc8a60d5bae1d6b446223
-
SHA256
c34ba59a95acb6762e0bcb93c47e53c517278b3c16c5abbc723fc1612fc1c06f
-
SHA512
b054278a0141fda7f8881a0a1c25f3f19b881fd1494ad9ade74d3f8f4db60689cd948ae0d96d1e40df4ecc814f9475c19e465e2695781a80e5cc043af44a8046
-
SSDEEP
1536:pbMjw2fMk1D3O9Pj2fcAcuHAHi6LCis0cZlUMCMp:s5G9L7c
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{60D41151-4655-11EF-A251-667598992E52} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0c9e84e62dada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000c430a000405de606926718ea88483454bc344527a622ae85f36ea076381a9617000000000e800000000200002000000003f9eecc3b47080262c2394080c80423b10f69591e771f0e88aba0b3c40128b120000000de3fe3a37a6f53be4516865afec0b8b61bffa364e1818f12ef05b5121bcdd78340000000adf631f6c0b2951142ba8b140b4ce0585a474ea93e256ec97f166e2bdbe0fb096bb3bfa97df65a72a97f20657f57f323fae512c27ea2ead5968fbf2fe44244bd iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000008ed955d6b7f874d04b40e9788f7a3e9af02fe3b032dede143e7c2a603ab689ec000000000e80000000020000200000005aa027ead7bb9ab65b37be7fff59df1b41dc7f5c2a56c7f743220c9058c205ad9000000066ea7cbdde2de98a9bd291f2ded618002fb62934893c2d1543f58642755b90ec75f307452b107f0d738acefcab773ba25f383a5b5c86734cf47012b20018d86f33f3ef657719cdc61bc5d9ea1763ec43c4a5ca12a899f4c46af90d2b8a4368352be24a75a30ed20f718d62b5a78a33c301ad3383ee8315feb2350f4711aa83abbbc496610d7e8dc35f361fdf6204a5d940000000825d2f274ffeb28926292ea1ecf39042f49ea1280ddc9b977c796f7a6f48477b4b4da03e77558086e867475f15b46c28a91c5e70f5483677e0b6582f4f47039c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427613667" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2776 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2776 iexplore.exe 2776 iexplore.exe 2228 IEXPLORE.EXE 2228 IEXPLORE.EXE 2228 IEXPLORE.EXE 2228 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2776 wrote to memory of 2228 2776 iexplore.exe 30 PID 2776 wrote to memory of 2228 2776 iexplore.exe 30 PID 2776 wrote to memory of 2228 2776 iexplore.exe 30 PID 2776 wrote to memory of 2228 2776 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5f1f3e9f04dc4ca90d0db7b51be708ef_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2776 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2228
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50d0e10a1d7eabb3677ff6d66af7c4e28
SHA14ae128c323640aa6fa137510275d9457c0656596
SHA256204ed553f219a86e47d1c5fe92830c7b028dbd033aa680aca4036a78bc347ac9
SHA5125fe339334aa5a35207eef3eca1892da468e6d4b3826ef84dc46c7b5e51b6e8d6358703cb6dbb4391b07a1d47f3ab8c7def05f0d2e60c665896a73dd7e5f317ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5147a8b6353c8676ffb56ea0d8fc39956
SHA1e8b91b69a88be0c3934fe051c726145687f25cbb
SHA2566ae82af1ff01f06371e8190da1521f503a78353aa2c2a5ab5a3a2a13a530de7c
SHA512a628272f65af5dc14658054dd57e541a7545fe4c3418c428027792f71202471a571b2a7517e7544d49de27b0581117c6d04cd4d064c9538dc9e65654044e2c8b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e1d2396d87e7179814d772c6e00c0ec3
SHA133864ca09f3d3c4230342932aa833ce6edbc9a63
SHA256f816b2e3301427a841cc485d7ecf8456ce40e083b2446e761aff95121295b7d8
SHA512f2cb8875694fc5f10774e7eeeca93783da081748ab48040b5724f8147a21cab4c695ef7b39aa48151a8856447d779447cde53d4e0404b75acebcd4f040f87b4a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52079f4e81121df1d19e8e4da2f572e07
SHA1586b90b43546c1e93278114f957b9053a6ca988d
SHA25680fb540d877e310bb8c23af14ee28209813ed2ba15118266287a21318cbae8c4
SHA512c0aba690075a5836a48b69686bbc1e7817cb9ffa4b612085308a48d669a51216f7695f2ae8bb658244184ba33681ea269cc1943f56b281e592276a76f441b09a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52b3578b244717bf2620b97e71fc35675
SHA1b6635bd539ab252f111ce602c9c36a2e655ea431
SHA2565ae8d1fa741e1040e84935120817266d16dd6d2cc035322599cf25e561e5d51a
SHA512677206b0142a09e8ac6e2226564137c2503d0a3ee173652a561470533739d8574d8210a84678becb7167666b9899501f685ca695b89b0498035e712a1e71c3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c1ae9d653c97db05a27d1a8448c00a43
SHA163dacf9a7d9a9466cdbb2e68d0c6ec90f51e0415
SHA256b1042c5da391f8afdba6f5b6dabbb4d209047482c1e738f426d5f86ccb52751e
SHA512e31cce2d2891cd3365b9516890e9b1a045716b4e8d4d06d50f860dd311801e2d2a7a7398bcba7bc7d00bda7f9c1747368a996d58b95af53926d5a417bd745d53
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56aa95a16fd4e35aa48beb072a9be4389
SHA17a062d5828292d5728e8b88cdab2fc5acdb99ed4
SHA2564a894b72b764e0f41c7c064fcc3506173346e5830992a7b22a319e5b43fce6ed
SHA51237c84efa62c10ad5f79d32414dbd975e03bad151819f4254662b51ce71e4e2efa092915abb7438ec7d8fc2d53a3187eedd5ee9b98e3e7c2490ff304bdb4c3ff6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50d35c3945fa2c24673468153e66d4760
SHA1e2dee95e7b453bf96e325ae7563ac9178c044423
SHA256cbed9169e0bca4bef88b8584626de015f07cf7a7db3fa117c845576de92a63a9
SHA5121ec24d8fe01565988320ad69164c82796cb298469e7e83f5ba658052a4770a8000fb6759f6ee283f5dab6761c94da799d40d946487042d1d20333da444fa0ff4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51797d5632f2ba50309a68e38500db905
SHA1501cc945866811d83b491db45bd09d6e7025bae9
SHA25696e11234dc45ee9c4f656dd5ccab7287d58c8cb3dbff88d5fd5d4b21624b16bb
SHA512e2c67c525fc3b6f2f633c9e2f15c1f6c7ce7b4069ae0d08d411cb1ea5b8eb382be67a882c171bae0188217e831c247a0ff42657ea6f855e74b6f5d8623515134
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59c896960247aa72534e1655d33e0ec24
SHA1458a0a45a4c0144af86c2465421ae9ced0561f55
SHA256a4a8810a1c07042b2c012ae3cfd7786b48943c8d8716d7788f8c848e5be8a2db
SHA512e13a57bf68d9f4f666d24220bb44df0c310561128589a8fc7e259a2abb1ff4c453057b70a841329e1b05d478fc05b02b58489821fe7fc5f0182889afb4c673d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eb3c60649c61334fe95a2147a61747ba
SHA158d7f2699ebfcd38ab316b8bca873df96900cb91
SHA2560ff0792de8dd006e551ae1faa4bc999b969b3775d9dcddea5d5ed7c25ff8d8fd
SHA512e010205a445dcf091259b4a7b71dceaa7262fe4324025e1ea80b1860f3b946e51c59bc8866ee9b6f2b62617589d939bf282fe8ba232fd8336292f91c328a6cbd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c7a5f8bb6b2dcf04730d9818cfe49906
SHA1009ca20ce42e7f1b66b7e348fcd926b8b1545be5
SHA25694a3c0ee2b62fcc3f751d1dcebdb996e577a959f09a40d6e600d5f2ada6ad5c7
SHA51224d0eadf6a7cc0c5225748f6fabaf6a7a22b6e50614edc3a4ca5643a0c348426cb85b1a7ad2719f55cee75d2b331777faed1ff12f7549e8b03412f6fd2e745e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD508946749da573abf7dbbd53443803870
SHA18cc40447d9897917e195f267ee9cb8fb53527d5d
SHA25633fdd1b34aaadf123ab89f26b3334de4a5e8c562a07f6a2f399a71eb505c8a47
SHA5124707fd93f74e6af6f95b40030f9698d2308bc90ab2cc57e01e85e65d1018bd9e1c1b3efc1d07d11fcf4b33cd83e53497c9f320a3f032d2e7df25135f2c649423
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a9b0cfefd7ab7fc50ff6b3e643823710
SHA1350f8d4683e43dc23acb3fd53eb26f1fd8880010
SHA25699b3303c804f052ee1a0082c836fa96fcfaa208f26c3bbbdcd46fb79a302f761
SHA512db53ab5a6e974f2408b876eae37137d1bf69313c096e13bb062bcd35659ac001a4ce33102e2c93236a188d60787ab0849fe22950805e82227628382d366f5df2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e7646ade75df692166a7551da314343e
SHA17d84e3ecbd41643ed9800e335f718976f2054c82
SHA2563283624db1049ef987a4d1afb73313a059b39beaef65f984a150131dc02692a2
SHA512de31c5e609e763248657c22f9eab51ce24a8dd7b9a8fb2ce53013f82f5efe2fba01411e25feaac875666961a1c8d97cb911b838db2e674a46aee820b0c022797
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b2990f63245091a95048cb48532b116a
SHA14a75aab884d1584eb72253b5f25eeb7fb467fae8
SHA25635024750a98b4ad22d7baa253f54636e0b6f6a160ec0f69ddb977bef7ae39482
SHA512ee79271280ac8a1fcb3a4aec8a2d74ad89e89f671e77b0b7e5cfe9035cb93928e2e4b6aed3cf7f3e66e25503f679f29819d46dfc1d31d125adcdba8ecc45aecc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50ef74dd83500b43f98603d64e9460563
SHA1fcf373b4c9efc55c2df06303299613f822fbe62c
SHA25628158d5f31fc7f5214d302596005a96e8b23c1e0ca27762d87c3024d948d85da
SHA512284c3a4018e0c0e47f0cc44c6f77421b448b54e23477eac6ca995a28018a01f8c0052e9614174e3413e56f11af4d954861220d07e261d84086a65514acd397b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD583849d0a1ffa8c979c7eb57a5cda5f58
SHA185f90dff4f0c1af98962d5362c1042928ebba1a9
SHA2564dcfc7e45d508a16f7eb4f52366d5375a963b54748f8febaccc54961a4ce5890
SHA51280841de3404db078baeebd49d962c63af8685b8867f7b346a4941b488b63607d9f27a1a057bd6306d6d4b50337a6170a568a5ef2bbdf2e718f0ec343c2196629
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a39f08d32ce349512073c25a248d5c47
SHA1bfe1dd92960f911510fcc9f89f72ba860cb3fd8b
SHA256767d2d273ad489707b8f7a8aa235e24bde1e5589f16c6170629b865a4c495f6c
SHA512950cf50bf4a2a79a70f261a69a84b553ab6b64e6c13d51ebe63f25c811eafd933a58c6d48924de066c41ceb7867aaf9d66fb37c3cc054caa4065f5683c0d112d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b