Analysis
-
max time kernel
120s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
20/07/2024, 06:34
Static task
static1
Behavioral task
behavioral1
Sample
5f64a16dd928a1176cecf8014733e07c_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
5f64a16dd928a1176cecf8014733e07c_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
5f64a16dd928a1176cecf8014733e07c_JaffaCakes118.html
-
Size
11KB
-
MD5
5f64a16dd928a1176cecf8014733e07c
-
SHA1
1f7c182bd1088303999a98deb1e11da87cf552b8
-
SHA256
2fa797a19a833df6ab55089816e0f7e00672938593ba133fbc95cb4908a42415
-
SHA512
1c1e76938289616ad0dc17f4d1abc09408466f08c59b1887d66007e4b6183cda806a2e72bebf053ded41ab9286ec982a8c1b26117ac158b8e6321af591e49f49
-
SSDEEP
192:2VElIsr03Yp8k/w1wvqyhBninWb1Kip018LOXuBuLbdU8d:sElIcuYD/gchBninWb1Kip08LOXguLZ
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0EF14171-4662-11EF-A6D9-6ED7993C8D5B} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d99090000000002000000000010660000000100002000000016974970821236dcbaede2b935d2f9857d0cbb59f317124f75b091ef412c8b67000000000e800000000200002000000068c21624a3364b32cdfe84c698c530e1b725d274971d239ed934d1436df32be020000000753aa73c0c9d067b1a176f64f6a42e60b42d670b33949c49b2762d458c09d0b94000000060ef3ba2efe2853be4dcdc483817db06f51e73db5e3b640fc529c1decf69cccfc870493644a26ae38ab27c0bca567061bd016ebc12fbc4a5d7becab9a9c4cd1a iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d99090000000002000000000010660000000100002000000098524f60ff5ca13d56533f5c1378400cfb010a31c13b2b983f07b97054de6c9d000000000e8000000002000020000000f91af3f899bc84b57335570b4c93d0a2228ecdd232bd13d6b3613ced47169add90000000ad6b6dd75ad79b5580be59d4d3b3de058bae06780a4698350417642293c2317eb4d8efee62916b1cb6813ec86f76c327c8dbd8db958031e62451745bacf8baef85cec7de7391a69955cb3fa1b9528bfc471a445d2bc45f9e4685b66394508e7486dd1b710de0e97334d27a86c9e2d8ab668b57cb511345c16ba76ce49b6c71d22e0fe8cf16c153ddac4b6f1b99a698c940000000385e0de4e12c5b7775ce123fecca907338b9d1027e994a211e6d5ac5bef6b226f3ed3b96745f22b8cc9b320e45fd24c2203aa449e2f756138e4466bde3c59acc iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b00d8b0e6fdada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427619111" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2064 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2064 iexplore.exe 2064 iexplore.exe 2084 IEXPLORE.EXE 2084 IEXPLORE.EXE 2084 IEXPLORE.EXE 2084 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2064 wrote to memory of 2084 2064 iexplore.exe 30 PID 2064 wrote to memory of 2084 2064 iexplore.exe 30 PID 2064 wrote to memory of 2084 2064 iexplore.exe 30 PID 2064 wrote to memory of 2084 2064 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5f64a16dd928a1176cecf8014733e07c_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2064 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2084
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d83c0c9ca06bf4715e4a17d5e650c264
SHA1bf0d8bd5a78949161a4019dd355421e44f450509
SHA2561b2bb07e7dcc378a07c05c8872ff2991dd7f7ea5987cb83180be410c01eb6892
SHA5122af4088b2bcf016512b0bcd48cf678390e57e6f97bea3c4ab68974bc422f36d64d0bc826f592bf08df06a1df84a01725ffc45269f592bc82ae16d794b9db545e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5351a5438340c1f2522e172d7dca59d78
SHA12b6483e7550023fdabdc343805622b1a973b0934
SHA256fabc1587f5476b79005e94e0ce6270015e8c171ae995eee7674936fd5184daf2
SHA512eade545f4c84ef3cb4c4d585002f0c18b6e34c30d660f50fdd7e3200859b02db75a0ade8ef80d74831a872e3972d33c15963ba0eb83133bf186022d3581eb5a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aa06b0f63fefcbe58f3c85b9d4c8ffaa
SHA184c9a43bcf8393fca598ceaba80a7936eb488243
SHA256127fc139948765e18cffd71e5ffd63564f6fd55d034151d85f411adc62a2663f
SHA5121e6ce87a4b8e1075afcf3fc46838ada03ecae9ba04205eecfa2175d14aa0cffc5f329166c29b3c8b886688813f170fb52e4c5356be22a8de0bd72f03a538e6b7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d9b69e7cb16ec4ea49afe4086ed183d4
SHA146967441a8a784a06b3d57f040b25b8553b6cfcc
SHA25613ec1c05b20e340ec1463443e8f4b23151ec8f5a3ba6beb6ac794eee57e1886b
SHA51298a54fe64b3c8bd9499d10de7dededaef47c7302f6fe516fbbea62d4386efff66f50d39eb1dbffdfe0c723877e3306d9a30696c3ac7d4970fcf8913a525f1b5e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51b7fba1d88c3cf86ee77c08ce0b61453
SHA1781349a9a4aece62a2af93ca18e331bf92285a35
SHA256f6d90963d7874ef0ef2752a8f66b53f0d20434e7d24f68ec49b01c0a7f0f5a04
SHA512d2c6a8f4ebef1d434ddf9dc9389971f9f158ec53693e3329bf2bd390048df32dca16fb4d7e007806ecd6401c503533b7ee2b70471bc04dae956e01e99c198640
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a87c794ef715846724a0ae933dfa08fb
SHA15f67f5dabc845bf4635d38d50814ecfd3f9b2dcd
SHA256502abed9495fd28f37053d6394e024fee3a83c2025e713e26d0c9375a4c4f00f
SHA512c5707574f02f49faa32dca4cc80a86ad8b86424c7cbc284eac63df34ad2c0932df67d46df473e6dd79bc3580380d6659e5cfdff15ae0cccf8dfbb7efd17b1937
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dff21ae9ed4d44597ceb9ef1fd3ea973
SHA1ec94b343168c59b9686eaea0477e467f1c048db7
SHA25679ed110eabcd6328376e7d221027994b4c216be28dddbedf0e7a8fca43c46ac6
SHA512a8f55d2d151947740bd130e7439f25d537b4e5d8b59448f367f297ff9482a93db3601922e1551525a6f3fb1e93433bd3f4e4979e7e7bff6ec9384e6179fc0610
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD596c84dc8bc6f041e38c7af9376823e52
SHA19656a34a01d0148965040f92eaa8b46d4b33bb9c
SHA256c5a97a14c5faa6726d46bfb505fa8a39fcf10de53f4aeb5c78767239efb4ddd9
SHA512d06e78f0d143227bf2a1c451a9cdcf1a8d422d498656a62d98764665a5ae5e89eb4f066b2201fd903c6618f879439d1e4d4515bde2b258cd005c4c296dda2797
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a2d2a1745a25a03805d76ff214dd8bc9
SHA1794355a9b27281dce7775771dd38fcfd9fea9fb0
SHA2568a6f07cff926dbf2d206aaf4cab5beeb547a8e15f7253370f450db827866e9dc
SHA512c29078499a285b1ce308569456b0deddb118c542625ee8d8441c969dc0dfeef542d46e58c7a4a305992de5555c42059f6d31ea238895d5e7fb6c2b0efbec16ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD523ec00ac8add68a0fa24e671b121eea9
SHA1e2a66ac049fc18e94ad5564374e1f5fb1507ce5a
SHA2560911033ae3333a0692cebef716d7502f68f9b34f7f7fb5f8098b38fff68d9cff
SHA51248859bdb5f7952e0d60adb8ac4d6740db7468c0d7297c209f3fe1c21a9ad58ccc2575a9af5917c3f07467745e97c09855de14a0546194db5d2a26411a7390514
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e1055495ec892272076dac902299870b
SHA15d408db3a8c978c155c3e9b5e35b38ee4d414316
SHA256e08825c374dc9a82d83a09d0abe96cbcb3724a6906cb19a8d15a61241702fc39
SHA5123c0962902823d252cef266670a40ef67224d7ec0924e92f81bc323bd707d3644c746b8724e19505b5dced309792407a21bae0c6db4ee5e8321df47f124bd6319
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fc2f466c9eb99ceb5ed067ea6cfe98e6
SHA165e201e465a7c33e720542ce43356ecfaa392ca6
SHA2561c9f738a04bc9065ad9eb3b43badfa6d2ec51bfee264abe10d5cb788ddc47812
SHA51286276ec5bd63efc5ac6b95b5f3d90694beecdc51413ac2ef931c61cfee9493a4ca5102b355e78a1f0c5adc73855a52ae60121e7ac6757825471308e9c8af6f4e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD524582cb6f5fe6b34103a91b0985a2838
SHA16066d71ced5d88cec7c5ae168188b9d5bb69a3aa
SHA256ae83f9f6a26bd8d7fc48fad0c80439868b50ec637845b33e198dfcc6e1f4247e
SHA5122e731eb4e679f783857dc1d9cb3ccd8d71af5d2221a542b128830cf468ae8e47191c16d9702bf8d8db97e03471d60960a0aa052375fb13fa6f02a403a4639ef1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5af24220b9d8e8e55241c376f8da10aa5
SHA160e188cce6c143d89daec6c88a3996f8e6eb0ee6
SHA25633c264e6e8ceae980ace9453b9d19d1396708cb502fa5ef76d9f88451b06e322
SHA5124faed2bd368fc043f63063f88eea42a38d8d79ada780a0c07e74a99ee97799da6365a0b2b5969efcf79d08523ec8a99c4b61e0b19e17147c3e94cba97f2d89db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD556c5d0dd09aaa330f1b39c0b3fd9d78e
SHA18e1956ba9679c84ab580c26502725d08f0f9e69c
SHA256e83bf3a8630a08b52749392d5831ae37e596cb9a57efe0e060465387a0271be5
SHA512254269ca6f753e1d122e0ffe983941285a64c9feb19bc0242ebf9f921111c8c7149c1656a890ca6a5459099ad77a82db3ac1119c676617a00c6ab35794f99525
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c8e9ca3d6497740419fe8dbae6c55e98
SHA1892c3967269bd36561e727ad6fe2e523cf537a3d
SHA2564c5267e451f73714b7ccbfe07c776a1124b842e859368f415739a9872b158022
SHA5128cc5d630f7b8ce14d15d01d3bb50dcdbfe98cbaaf63e87c7b539862d188a9f4e409d5e0b151f9940544961bf2efceb176400d67ae4ed3da105b07c111cd592fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58a4b196f9c30ad2858e52998a26693c4
SHA1854d461a40ca99988749b4e3d8638d6746b76d9f
SHA2566bb1fbdd90b9521e016062b5b5b455970b0b6bedd35acb67876bdd6d30d1f949
SHA51204f2fed9c90b982cbf9eb369c5a0f2b17696f4cddc1b4e98007d015b2c3395684a34dae15a1dffcea6e5057b8030d67cbf458f58a1f55637b33566479f2ce101
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ad30e18cad3b75a84c06c96e3fdf84d0
SHA1e4a7e24295cb14414d5b6958e870a55f0a464f98
SHA2563e9d17bec5df460f24bb9b4552077eae23918016b6b8639bb7dcd4b5fed7d576
SHA5122dbe5f865f06052c80aa646017062bda4ed503c53a5d648f52bf38567f0101b9cc061dfbd82d272badee70da0a2d0c5cdd787b8665d33801e77d074cc47e2164
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59633d71206a2f6345460c933c034b80d
SHA1ce7e914e4fcf73da05d0eeaa0d4ccb53dca86815
SHA256161eff57bb54817f494f5a33a73624e9c3cc5b83f67bd6e84f24a5fb9b91c876
SHA5120d82086475b06536eb9743dcb4360faf8e85f8aa0ec8383af004404df7f991e778b46b940a31234fe23d92ade8123a113ff12a070b78749fd3c12d822209d68a
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b