Analysis
-
max time kernel
140s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
20/07/2024, 06:37
Static task
static1
Behavioral task
behavioral1
Sample
5f6798f19bcecfba911b776b9e699d0d_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5f6798f19bcecfba911b776b9e699d0d_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
5f6798f19bcecfba911b776b9e699d0d_JaffaCakes118.html
-
Size
37KB
-
MD5
5f6798f19bcecfba911b776b9e699d0d
-
SHA1
28a386dc84c104b3cf334825ec75b233c04948eb
-
SHA256
c1065e516018338c5375cc5262713a959bfb4676a5a3c2dbb8748a995d083cc7
-
SHA512
845142ff47e56ee8d257899e66001bb8edb101279be156d9c9db5df26835877617080b02927b1914b6261d3a3d1c40f9efe41d08b4e9275d4025e78e8228808b
-
SSDEEP
768:FgQtiEq21/tIxJ3fXWPQbKD/my/XwGhuWyd:ZtiEXFEPGYs/myfFIR
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427619335" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{947128B1-4662-11EF-9C22-7A3ECDA2562B} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000dacc86d10810d4b608805355a22625a58e2f8a72f32df9059752a5540c6c82dd000000000e8000000002000020000000c071fe4b289806dd8b3a5bceeba28e43502d58dfb8bfe8d70f3f5cb1c5937cbc90000000602c5693e5a130d28357e00d55d522c6e1d82a8447b24e1cb57324bc70e8e67b00c68955c996d07292742016adeb8a3bfbc424ede3dfa6af5be361835003f64038372815b16bc0f59bb1939898a8a70eac4f76103dc4b6fdd798f88ca96ebb6fe839c9225a92d3a00f185598bf63538aaed80854f8b4852f456506d6de4aec7229c5e64e5917a35eace848bb8461a3c940000000539d52bbebdde3faeded5b0523fad70d7c09a1aa1387f76777cced3c646f5502bc0a230985f21f204de703e1b0c3d659ddde4540215a976907a4fffea639687c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0910f806fdada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000a6bef0948fde31ff84e69af568facb49c862b99f1d4767b0c6a6c86bd37d2aa0000000000e80000000020000200000002d0489bb0fa5857310a3033d07425a565ad41a361bf59a722083a98c9425ff0420000000cad3008f52971cfefc6b9afcb10a6f98c010373accd8b55ae9117c160966ab6540000000e5ead849bbd089d92a80b9bb807a4d48b5b43c448de2502dda6922c2e96dd368c3b3589352b0e324c245012c2607015b3605e5f64460ff0a13f5f8abc689c989 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2176 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2176 iexplore.exe 2176 iexplore.exe 2828 IEXPLORE.EXE 2828 IEXPLORE.EXE 2828 IEXPLORE.EXE 2828 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2176 wrote to memory of 2828 2176 iexplore.exe 31 PID 2176 wrote to memory of 2828 2176 iexplore.exe 31 PID 2176 wrote to memory of 2828 2176 iexplore.exe 31 PID 2176 wrote to memory of 2828 2176 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5f6798f19bcecfba911b776b9e699d0d_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2176 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2828
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e9842f912a4ff5ae8bc95cc05c6c9fe7
SHA1aa61d8d413b61d3478e211a882e9f47ab89a1177
SHA256a5510c619df33ba82a1e6c3a1b81ad4b23e6078f23c705fefb9fbf384b68c50a
SHA512bff0125230e0df25298a1739596f020ad1486dc64b6d3e98507afa2638909120684eddd3b6b602f95a28dd099abc302180a659ed073b0867c88b49cf3179b82e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f5a4e7b3cbc9dff8c74729eec8f38133
SHA104688a89f0466306b84a1e3e809e6a63690dd860
SHA2569258d6a7455150174d4d6eaeb0379d4edb3df2998682e320434a06221f0585a3
SHA512ebbcec66147599b0e0b6936fb5b1fb6db3028af9371ad062ef8bafb9be424565c3824a477eaf32be14ca22337f89cb004fa055125b709af94ff5401f1ad0d98e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53255d8a4229a92c17bf6ebd6b4f4c42f
SHA1976b06a588584a01475f63c1364b19d17bec7ae8
SHA2567e304108f58d2dd14fb1b85605c75b9d5c3ec770db8cb1f7e126f26d947e3620
SHA512c604c62d8e4f62669ed0bbd919ede33320e806fd365ce5f30ea646d6c19bb63820018ba44abd7f8d75d683cba255051c43abc75e51103159c93b7d81ba638a93
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c590a126a59c9d082b95d38387bbc248
SHA1ce5b887c9b56f22b95195a6c8cb3e8095d1a9ecf
SHA256c6a7f96c8559a5740a0cbd4e0c54e8a54d049f38c0c4ca0ef7201c4369ab8570
SHA512e702dd747a01f6ff1deb1788df5d0bd174358dd3398ac5e8bf8c1d599ba08eed3fb86127b3c8e7c903b9330d8e5d3ba0df4f53f1d4a8e4e1081f8f81261d8e6d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5855a12dc0c243dab52032f676166866a
SHA12b91a550a59ea13ff93f4dcabdaf000ed62a9801
SHA2561e399c6714ceb0b6bbdf1e3778de0e62370ea9078f408da8bc43721922e3bc7b
SHA5124ca96efb5460a9cf0bc597cb2aa0e8222db2d19fe1b98c4ba9f25b17ed5ad2629ae3f65c02c1070de10b16fadc567bd595daa07bfb9f99ff5cf3f56fec7d7649
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54ff81de9d663e1aaf220b21c461fd70d
SHA13874d89c83b6dd02e03a289c74de484431c1e88d
SHA256df5d75a3eb8b44ef4c1c1535fbe3a814677b416ba1995837211e76694c4e78b0
SHA51219a0eb35756ea7a8e9190cf8e0995562685049ad038d22645145f03f15df22fc37f49386bd5cf000b9c0c30d86008d64aec3f12fbfe3bb69a345ecc5b908473c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50a22f039d79a86c53bbb63a6f82f7461
SHA1a5980c8aa901ffec05f236fef17e6df262a1d91b
SHA256dabc9229d9325409df4017b97600dc2e31e9d4c3658fe8bd3780f39c1e30c03f
SHA5124a392eec77a2117bbb0cd26b7f3a0e01fe68557bc3796f5dd6966fe74b87f76e292f0ef6d2cfe7374fb0cc758a5eeb5ed8d3b749e04b3e6e97d5dc59b5e2e623
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e798d6d7990f77c129fa5327709d74ed
SHA11b9a728b10fb4708b89b54806b28f961173ce384
SHA256acbb6cefc5314067c20535f53186c4324102d67cd4d7eedb70ec8ccf86dfbd81
SHA512cb0fd71466bb1a3545540c2f90e78624b376201dacddea9527bdbbd4824939c6639bb6618b3d7db9082f1a105bfae1fd1c1db91bf70f58031af49284dd337c7d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c83056f870e1fddd06bad5f02e70315d
SHA1f1bef20bf48f0582443ffe97ed6c01e0911178e0
SHA256cf5dd6df651dc40268a7d124257f7e220a10f33959be6e84e79afaa2fcc74b0a
SHA5123caa09acacb0e3ab8901e539ade2d9738c5aeeaf0ac1c078708f292934ab4481f1a2c2addda4e7e4843888238e3b37cad23331c681eb4c499792faab79c44512
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5328c454ba0123d42315c80a759b930d1
SHA1da3913b397d34f19966ffd45087045c3c1b2fa8d
SHA256cc1236409d792aff7c43973626b09cefb8c067d329d5b775a9ecdedc6955d11e
SHA512fac6ce6094249efcb87def4a6ab251a91dce3745556a53285a41f0dcda68f3d9c46e435c1906835ba3a6eacc127fc48c10b3164680b208ebe993eb05a24ebd60
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54d14c00f59930a437bb63068adeeb202
SHA1fa0e41d22ffd7a29ec986123586cfac7bf358b1f
SHA2568b467e8a7d4ae961c37e2887071d2b4ef25f8b745e6af9d105da743a247f18ea
SHA5126ba4b7a5dc069a79b0eefbee5c3501cbb1c3254a8afd094ec817b1dca273b154235850ba149b310140daa9b296d405a1bc89cbb932bf3aa4f3e0438f4474796e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eefce857c4f195422f18ebeba1eeedc6
SHA1582f035c0adf379e6cb1f1acbb9796df715d2b8c
SHA2561c0a74e86bfa034bb677970a0df75cb515b64a1a034983777540af3cd71ba0cd
SHA51229ac8c14fd8d741ffd252f313f93c5ac084033d351720bda489e8e98c222a23da1d88682c5f72bd6dc72e7ec58d14745f3f5478d019fc91b753a431e191df8b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5957af79186e181e5a586d36d15cc73ba
SHA1d5f514f42ddeba5218c3299bd16ad18ca768e9fb
SHA2567b061165e436a1832d1ea2cdb6e7d227aca1dc63ac39126e8a41dafa09cc83b4
SHA512d49b5e93ddf797a42231f9c2680107170a9dcf64d1108940d04a04329d3a458418b12e772be5e10612bd5e1111f85873940229b5783fc4daade2f9cfe6769371
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5804f82b96a36f3789f5e4b89d76d3e2d
SHA117981e1ea66d6e8d2683902c99cb257cfe1a69b4
SHA256af5ecb67748c3554047b88f775dee47b200ada0070c609f3db208c0310a03423
SHA51258dcac7b348f7e62035915251f6aaeb89cf45e427b8dc72d0cc96a30957140631bc18619ba072001ed69a0737b7dff5c8961f89c92700fddf22b1f60019cb82c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55b4a2689e26f8df8d8799dbb05062eba
SHA17a292568e7b5ffae3f05334762ab1e21db91643e
SHA25682ee78da1237f91eb9c99e96911029460a3aa8a5b7650e88f4c02327e9202acb
SHA5128bb49603cfc4637f7020458011e8f3a190399dc0e3048fce43bb1a77cb66eb5bf8691c9846ba366f05a5f803a24f9639e43292dfde141b57eda748c29f943786
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51061a5bd89b6d3785d48d73bb8f572ba
SHA16df5d04598fb1ad80a05289c76cfeb3be714f923
SHA25675b40334f6270acaf02eb635a8b988c3633585dc7d3da168b8b4f0359de87cf1
SHA51230b393f7e9d927a29c4bcc44e37db70de2b2b2251b8197a2e9d25e997aa14cd0b5a7aa04292a4ac97410f699d1c78e1a7f2ab5f8012f96a9e569bd7d16000e98
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5527bb1de722fc57e333563b2b701d4fd
SHA1a43bd43db6a809fd45157397348dda67f8e25d69
SHA2562388594c59bcb3857fd639de55373dc2a556b291450b02084f933e223b09135d
SHA5123f6e5b4603fbf411603212eb3a6a371be1a61dd0d2661aa47329d90a4aa7d1209c3fdc56c7e658b55810b7477714108bfa53bb62cc226af8574819315ec7cb2a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52f811d7c4b8d803486c7d13dfd7e7fdc
SHA1033706486a81619e355ee7bf4afa5efb03c080e8
SHA256750bbb86f60a910067efea13946ac5c1e04430869004af41e019b9c9198f6e6d
SHA512f34652fb51682173c5222e696de60510ff88dcf81d21506d83a7e463925aa5782f29afcb5885ad62e1c63810bd7ff1215877fbe702bef0eebdbb2994b0e85411
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52b369a7998df1db347aac59d09655537
SHA1f03b6195727e9218c8fcb0bee0d8839f9640f6c0
SHA256ab38ecccbed8e29c1296cd6e88d1c6bb321173757352383d70107691f813c32a
SHA51283328c2e8da31b9fa4a789b068357bab6a1aa4317b2006c9c20c5d1528c952e6d69063d7220711ff473ac30d229c16c743df29db7e2136fd5124611215bcd957
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b