Analysis
-
max time kernel
68s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
20-07-2024 07:24
Static task
static1
Behavioral task
behavioral1
Sample
5f8dbf21b9f02a43db508c8d027d4f6c_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5f8dbf21b9f02a43db508c8d027d4f6c_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
5f8dbf21b9f02a43db508c8d027d4f6c_JaffaCakes118.html
-
Size
3KB
-
MD5
5f8dbf21b9f02a43db508c8d027d4f6c
-
SHA1
fbe5d48efb828d78a8cdd42a0ab2d4c77c7c9bed
-
SHA256
fb305d45a720d9d199ae1305bb0522314748017b8be1686df69ce33f6e3ed306
-
SHA512
894b38cbfcbe276c76878adb4fe39bff1f77d916b684fd2cca132d770dc7ce80efe72bf27aeaf56e5328e151aff1a93ab4a62869fe731b03c45dca2a7cf5fbdd
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c04cf3d275dada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427622121" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000a7783e6d872f4e76e636c5fedcd6e493f432e670b3ad254e51eb892164e2d70b000000000e800000000200002000000008911d995657f0f158ea1ad9842ce6c9a0dfc28dbef148c32f011aef84d00758200000003aa0a25ee9edef6187cb4b95f863c3e861118b397228b1e195bc0993e073907a4000000096695a322934faa4bcce706080bdc5662724c621f7f9abcf8cf6bdadf07a4664e619e8bcd6a5a458720ed75cb3485922a41bcfddb423b4d57cbbcb598b577849 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0FC751F1-4669-11EF-81BB-526249468C57} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000a997466b033f407e2cbbc88278536fd0990e8768be42a22eb4c49d8f0365c17a000000000e80000000020000200000004fc06724eb6897ce497abfb0eb665e687e443cd941baa71ecaad2ad5de63b5099000000065cc99a69159812528f1fc09b34b02563ffcdabf08ccae3ff16022abad9c3b6c382522753c2b10224c9a45ec49625d2d878fc319cf8551dc09b4383ed58c095067057560be20423c93bbef04ab0e5018e082401f0981efb0837a3b5e667dba4c8137b70e226a5a6fe8c3ab93abaace853d2348c686ffda12d7f22b251b542439d3902a0ee2d512ed21a73042e1a57a1140000000294d02bb634f8368c6b290ec4db34fc1f5520637e8e97056c55bb592d16a6ba74b3e3071b5a271458ee8d9e9079fa24620a6bd2d565442495ed7567343f09cb0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2388 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2388 iexplore.exe 2388 iexplore.exe 2380 IEXPLORE.EXE 2380 IEXPLORE.EXE 2380 IEXPLORE.EXE 2380 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2388 wrote to memory of 2380 2388 iexplore.exe 29 PID 2388 wrote to memory of 2380 2388 iexplore.exe 29 PID 2388 wrote to memory of 2380 2388 iexplore.exe 29 PID 2388 wrote to memory of 2380 2388 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5f8dbf21b9f02a43db508c8d027d4f6c_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2388 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2380
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD512334cba50140c794def95dc0a6f02d2
SHA1d386985aad1972e3b617b97fc6a8971a4d4b2370
SHA256c3c51eb07eb4642ef1aa462ba5222079be85b57f7aac56654c8076e5026604f6
SHA5127c10498318fb3be83c7bc1518d2b3fecc8556ffdd368226ea44694474100a6830d5ce4aae48076b13f94f9086cc099909ccefed2bbf5a46b14b60eee1d6d45aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD515d6138951c126b1ebdd6cd61f2a2c87
SHA1306a74e0d219f19c979f6f85a3b52e581482b904
SHA2567f51896582001f73cb074b1c824b3bec5ef3b78ff5d4f888ce0d38226a821897
SHA51284a3aa4c06bac1d9592de57def4ae84d250d5328c7fa716ef77990978dfe74e6ecf54fb6a94c31057dceee5cefeb194b994615ff60eb69e27cfcddaa91ddb74b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a53ee2ab7ab5f87e3a7e7f619e653490
SHA12343534d7ec749f7d442583182e2898c64e92110
SHA256e2de56efb4c35fd39562870ce95621a17c5dae605e90a878e885c884bf9a8a38
SHA512790921d6a238cb08f46153761dd526f885267827d6deecf5ff938228d41e33ffb0a59f8dd109d376d0b56c7acdd33ae98c2a8782b7c1ce4cf932e46b843a7719
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50f525e2c655df74327d6b8378b0ad6a7
SHA11cf7e852c34a7150b9e60a4ec19c37dc1df72743
SHA256180bf10b7762a53b150576b934fe95aaf8a1292d0032310c63368177d3ada2a6
SHA512cfc70407269966f64d92109913ae72a8064dbdaec1803e4064a0dcd8c3fac5ad55d1c0da634334d17a5cb38773211c934888ab98d998616900452a0afc199f6c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dcc3c1e883d49a76984715e67dc38879
SHA1fa83e0104442a80de94c2a19377883fc29fea12f
SHA2565d368183117cd9729a070d2fd210e9b6f340be88ab3fcd561930eb58439c9ad7
SHA512e421f252d4422f8df220d76543cde02190ac202acf74de15aff5e7a1c543a9ed867e2d7ea356896cfaf717e34401f9380ce4492058e716886c84ff56d49df260
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a09d8083d94d0cab4deb4ca46e1cf10c
SHA193a4d8133846e43d8b5cd59033af3cb401a3ba75
SHA256cabf3d514c28b202230b648ffd82198e19c06d476e8950f91377520d8e311675
SHA512b9050e4bfd1c8dc9197a4ccaa09b4f2ca45c23e1e3b0184dc2f2cd45fd864c2043fd1626b8c4fe5e85d135a9dec908a686a7248f65a41775896dcf8d44a78e04
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56c84f33095dde14e0393e829825d92cf
SHA1bc8497cfed70afbce9d822b4d8437f7db8cc82c3
SHA256b0bf69042f1c0ebd8943c3e3333faf5adb389c0219d5e3517045d21222dd4535
SHA5124c54be2f669e2b0ade94893bd3ea29822e98727237e19e186e569d25c7c65fac860ea6069d75710f616948e4f5300f4d0add6f8e4461fb54037aa537af99e765
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c94b83c570b3d1425b301200d6d87413
SHA1f957819390dd867963af1fba8e4b4164eda74970
SHA256fa4dca38e119652e5ed55601a52fb75429df2c0c49d5f3c6a7c75b44a8d98f22
SHA512e318f7388b05d8c6e4c5bb8dfe234dcd1c2878ce154746c769093320bd61d3c2140b50d8914382992464d59b4690baf9096f326c87b053b9c1240a26e74e4cf6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53654c2e521c2a488efe6c41b46924b0b
SHA1add6f61084db0d66f6bf45d2d11605192fff4bc5
SHA2564e09a7f94a8e1ab4d0a0d1119c2f0aa3e648f0ebe278c837be5c3761ab62eeb2
SHA51267ca101a56c914899cf7de74cf495d8e2faf60eff988e43efcf8c1d397cd4a74bbbe52b411daa47ab46be25929904c430132eef5c3aaa93593b28c445d69dbed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD517cf22cb3b35f75b5dc94f255237a848
SHA175322cc14a4b168964c276e703698bed8a9acfb1
SHA256b78ecf37df9ad406b04c355feaec99a4bcaefbcb1cb1f12a9953063e5019372b
SHA512f9872bfe7b5924a5a31e661b46995c548852965b01777e18f64a60e070b0aa4d2477f1ff84207e9bb5cd1b8bdceecec587d16d10eef215a5fc01a5717812b5f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50072248cb16c22651f6160186bfdefba
SHA113825dfaabcf44304273e06abba8f0d10effa826
SHA2569771743a0c6c3cad381450e711afd87f0f4de6b44451ce26845b9c8ddddb1833
SHA512469ca9a520fee3ed32c867112506cdbe190118e420c451812b75f81f96549f653841396ea459928ace4c5ce347e8063edc9f883ec39eb0a85914261f9f92576b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52d6472726957e8c43f2c579c969b9457
SHA16e55370a923eb0245e0683cc1cf1aa859bde3aba
SHA25666807a2b0452c7e2c279ccb21c556064fa21994e6cbd6d52770822a3ba6f71b5
SHA512d69e0e3e36806e822a33f86d8bce65d59f7a39931730912284c4355ec94a392b8224e8e3b5516bfdea1d5097219de3b2c73f27e3a523846528a86211474b6c96
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD555655414cc3e1436ee6fdd8ab21fe0a1
SHA14ab343fac11f3ee681f44435443885b847cc370f
SHA2567ed14d64d4582b0dd0f7306cead3cc9f523624d50c6f1cc5d2ea69566c2688d6
SHA512fe23f6cf729e5f2bccc60424bdbd3a11c6ebfca3a1ae3423c532fa4245ce5a7c46b0dd351bba019b5bdf8c95104cf78c6b0e5033a44c6803313743c8d9d49edc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c4d1d2eb01419a4b3b6a85aad31e6010
SHA18a862fabc9c84b3dd8925809686bf056e4a950fd
SHA25638c863238c882bc3da8e6100aba537815798ce94b16ec85a9d0c883556009a67
SHA5125e93820b19125b468466cc207c95fb9ee60e53e6b8227f5ca7b0fb39b7ef3695692c98b1dd8b9fd7133f8e3d9856c2be5a1d3773af83a3f3a1c62ef5dc58cacd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58aaa2d484d6243073713dd7e19fb3ece
SHA19cbdded4523d2c93d89d2221105978c951e9a476
SHA256a806231f5e7d3907f3e2786b861267773451976dc67b6c45d05d018af87af444
SHA512c6ac2561050980af490bca1447b6ab4388728b57325a709a9f99a229978976c54f9a80890b5f246e9bb4e73c547b390b281bdacdc7162bbcd325059c7d7d8010
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD569ea36b4f6b7372627a6e74f03876575
SHA154f480a1aaae2daadee4e463877b0809419398cb
SHA256a917fd754f81cc6f0038f956e0954f282d109cf63b222a17c0f2b15913438c56
SHA512cbcbdb709c8a57ca262b4f016303c5fc2254c4aeed12efd9f4a3711e5eeb5bf6429702ab2877d6cf9a7fe2a1887534194eddff1fd785fbb9ed859c8362304e4e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD592aa3665fdcff7dd28ff112313490061
SHA16994220e12984421022ec7abc9ee40b49870c3a6
SHA25661140445f2c631aeee607b4c45776a93a3b692a4af53b30bc76b0b492a3fe306
SHA512d14165108a7816101e96c1165c864f87319fd8e9bafda43e4464ba2a3df4a82cfeb45b96fbeab674fa23fb92737c8bea872498b287f739b7754e84a32e105191
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58a406a076dfd6c779d8047a86fef567a
SHA175de2161d4c52487db30f7f13eccced9f2bdaf63
SHA256292755fd74f6dd661587a4ab55d7a16a2fcb3883069da258f54af5de258528eb
SHA5121d8706662341c26cde37a9e5963a3c274b418bcbc5d21faa313b220a2791aa3ee57f258ffd697ba682958464add397245172dce61ac6738d76748b5e3fb9c456
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5df086b3b9c8a85ed3de0886fd7a3b10c
SHA1ba9bf060978672dba62758fdfad4f8c8cdcebeeb
SHA25673991f423d4d98dba14a29d2d3030dfd366145f61146f6ac4cf6be888fa63a0f
SHA512f08b97f0f01f89125746eff11eb9d58987ee24fa3d5366fe0416aed5dc0f802e4d25294d8ee3b9d19bcfae80cd2e95412145213f9599bc1c200a64f3511b4e3d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b