Analysis
-
max time kernel
137s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
22/07/2024, 10:18
Static task
static1
Behavioral task
behavioral1
Sample
62d53f251f371c6d92d3ca376f7f37ee_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
62d53f251f371c6d92d3ca376f7f37ee_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
62d53f251f371c6d92d3ca376f7f37ee_JaffaCakes118.html
-
Size
7KB
-
MD5
62d53f251f371c6d92d3ca376f7f37ee
-
SHA1
3592aa82ee9afd2e1a623c155d01654d8e348110
-
SHA256
c39261fe60064064ddcc40f41615fe952bc72efea20450b3d91ffafa381284d2
-
SHA512
616e824695c570e0610bd6ee64dee21309f98d3d5f446bb1b58f31057c94eb91fb829fb59cd8a41b8929054e344a470378a7e4df5447661cf3141ca6d1c09f74
-
SSDEEP
96:uzVs+ux72WLLY1k9o84d12ef7CSTUBzfAWRKxcEZ7ru7f:csz72WAYS/nxb76f
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000333d5997aba5cc93b4d4d5aba15362074f6901aa29276876168ea2b523eaa06d000000000e8000000002000020000000dadc85deccf0eefdf4ac246dbb141c2356cde8a01416d9f5d6af6fdcd24442ff200000005543f9dbd7aa1c345528f9bab0772692f1e923249d5acdb6af77db493275a23e40000000f070a0ec6cbe7c329c1cee30788f965b7c3e7d5446f13bc967a4b3420e4ed4273cd89fac877b3ea1963385786bbb5860c994c96f5836295b5517b64c7199ae24 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000294256a81e01c47ec068025ffaa9a2ea39562c8d36b736ea2eea0ccae91436c0000000000e80000000020000200000009b4690226c2bf8474f4673cf62f27bc11a2594de2ac9f00a5b71b893244552a69000000060a6fa6a1d6a0acda2e0897a533948c208419fc795d4b73ecec298bf5261a193c164852ce6e8e1b9a990a3639e0277340aa71a3b76eb30ed59a09b91dea3c94c5b1ca6e259412555d681819ca2d976ebc06050784430067bc17948eac3d98070a2224f5c62076274ee74f4926df928fed4f022f6fac1ee065e32e9a6bb30e9c7dc93de09f0bc9a84b99fd3ac0d723ec4400000003270e99dc7d86f4eb5a6dab83f77a4c0b2456011ac96838419c106e7d726e56da7e54af4aaeb7f3c29440bce6add58aed1022bc0d091714692eb1e12a3222934 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FB86E191-4813-11EF-B6C3-72D3501DAA0F} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 904628d220dcda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427805484" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3048 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3048 iexplore.exe 3048 iexplore.exe 2316 IEXPLORE.EXE 2316 IEXPLORE.EXE 2316 IEXPLORE.EXE 2316 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3048 wrote to memory of 2316 3048 iexplore.exe 31 PID 3048 wrote to memory of 2316 3048 iexplore.exe 31 PID 3048 wrote to memory of 2316 3048 iexplore.exe 31 PID 3048 wrote to memory of 2316 3048 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\62d53f251f371c6d92d3ca376f7f37ee_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3048 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2316
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ab2432a6e4b60f6db99dab95c32655f7
SHA1e7f224bdd00fc880cd77ce715379fc94b04f36f1
SHA25694418afc066d23bb7d1d71f7435cbb63ea898feee993868dde99d8ece43f100f
SHA51297264ae0315d5d5d3a4bc1a674c52059d0ab533f1241dd83bf7af50e50c984bb248ccbecbaad6eb263216867512ba65f0cb5bef5c1403366c3a8069f775e76cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD597e87ee9dd08bc86de4000e5ced63f97
SHA199e094ec65a10216bbd2567c82e446fc0f44333a
SHA256907967c5f81c53837fa0a8b5fd3a6f368ace3acc029f034c7afd33b1f6be68dc
SHA51244d715843e6c5ba0b6f921ef2319187261b6b33f3288fb215ddd47776513f6ebc774f2fb90f71762c5ef410119849747062520cdca99293a9835d198551ebbf5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50b5bc79ac6c696b71841f485fc7bb964
SHA130a62aed31003f2d14c93083d1a4c02ed3f0adf6
SHA25609c996e547352fa6ab69fe7e94688bb456ec2d5fdde2c43ab4f0973f84b57c7a
SHA512fcfa64afa4df61ca7e4a94c2cc544df889deeb4147a06154461809da199bd531b9d99a8fd2a96001b2b9c9b1579008ab68559d7916543363a7d84b296d976434
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56e67709d29f6ee3bb7e9dea9da96713e
SHA1ffee64f2d556a02e9dc51683f0b5777d4ca40aa3
SHA25639fddcac2548c8f841023fba78c7df97b384bae14e8f4f366924d9fc88f77247
SHA512584ff091f1be963c5d52621524c0bffa27c75cc5dfc94b68d3db0d44da9e5b80c2d8f53db369c92c70f1434cc9b9075eb9954cd61074ef4f4fddbe1eed0086c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d9c00052acf689e062bdb62df902ee09
SHA17e7504c4f94073106aafa5439aa828c7705b958a
SHA256b5a92423778920871f85cfb29cf7308b44421b6f74b589c714603a0685545bb5
SHA5124119023d9113b97b92f5e25be822bcabc424aff7b4274febb448a0fdefe5761c0ce4bb3a2d05853dfe8c19931a9c7757a0b830ab4e9b1726ac136b71b99e46ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59ebb0b12c00143e0afbf784e6f56a4e2
SHA1d7d7215f8945c65457e73a18a2f2e21b0048416a
SHA2567e936073b058e089bab885ea688312ebece3327036f554bf9a961d38f29c3642
SHA51253d2ed2a8ea3593404b5d5910c1c4ab46f89d6178a9763ee3e2bb758ad7c2996e17a881f2e3921bf181e4d352d721b848984d693e1bbd602a50544e692d394de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e02b17fd92e8dc1c6e4fcc95c3f6afdd
SHA163f095dc499aa9c5343dc95b91e43acf8319a1ba
SHA25627c81accd411bb4e2e5642ecf7e31faa8d098beac88d124cd0ec8c7486cf0ee7
SHA51265f0e9cb3aae5899b343fb6ca4c99d45f814537c43bd1e33328f7db8b14ace8fb48054786e2abcf3147660bfa5aac3721a27b0fa6628a32502192ffd4613b7b7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5efe23a53dd971792b8d2e74593b77d47
SHA1634705cc924f14c33450412251e382a0c77f2fc4
SHA2568c414219359741bd021ba8fe18cf7b861293b88fccb5bb1ec01b27dc79dcec60
SHA5120c99955eb3b3fd0992e2f05298ee2f12fcc3b01de371d2bd9d8af961bc2ad3ccb8cf7d577e39ef43404d059ef25cec346844b5d2018b4060efa248a3113d69aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f0c9dfdeb6a2e596a312457b00889803
SHA1f49dde8f977329425c3410fdc4b7772b71789f7b
SHA2562a1a123bb1351a9d7481ae7353ee266eece5ff6cf0dd46d9af32492be7c8f494
SHA5122b4aac139f4da3825680b4f5e96b690f44abe613b371a1210ee05db1013ecee0e615b305ef50e77d5d63cd4aca8bcbb06b8028527a418386472a7110ab391a2a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55db90a70deb640a19ddce443111e6f43
SHA1148485c83d2963bd155afe3c6e9178527262d638
SHA25639cc7b39aa273f74951d7825f37777c81ba3fdc43bd1a8dc5f77f0865f878b67
SHA512c9f26ea8ee7f772e9e5a9fcd179f5405f2d9e649d4c490635a834c635c5c6509bc2f714f3f48d74f33bb59b6e8605e2b7a83c903b7e9ff3e59c58fc3f9259656
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD593bb342778c645c1969fb8bc6b7d3ab8
SHA110155e810c7cb7c35f4a7570833baec1253358d5
SHA2560e4e1254d429de797d2af804d0793897dc5c6729bf2395b9d6917ce05935a0a2
SHA51251cbb29ede6cf34e2df97a4124f3247b55d713d72901c1e468a5d22f5a2d3dcd1c4ae6c2381e7494dee62c3791f9682281c56f1a86ae1f9c0bc5d3758b0c8283
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD537fcaeddd5d0b41abf1f858b52de74e3
SHA13873f317a2d81d2c348bf6c55b3fc04a0d3f646d
SHA25685ab097f039f81ed46615080cfd6ae468224150ce034a7630d80a5488c2f4f79
SHA512974bfba5a10a34a9abd0632475c815a77e800a12c3f0f36a3d1bb9700dddaa39d593d3514ff74fc38fa9700ea6f8840e9fa0bb85d8525ff8160b5e496d297f25
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58713ce25b181c1ea4581994dde1045c0
SHA1530581e8891adf10d008d2cbadccfa8c4ae6263c
SHA25618962cbd7815ffd80498818348c7e5238563355cb5a4a710a6bf880860c99e54
SHA512365730936cd2f96be4420cf6ebab5affbfa6d7365c7f1bd970ab63076037f0f24be0f8b66f863dee7c434a3d29ef04f0fbe6af56bb4cacc43ccb7ccbfb963439
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55ee2dd004e2af7c506ac524f23f02dd8
SHA1eff4f8fe0731a9db95ee916f422a9a379a244e99
SHA2563637359ec47ad4cc634bcc2f5d9324463888aae565206d1f0229fbcf57a0b872
SHA5125849140703944d00359cda58c1a12b24a3384ee9e90d7ed66058e930a2099eb77dfa09245d9bccbb04c15dda8859e780a00d2d456a65889dc2b6001f3d748b3b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5712da90acba024edb8bf8d2ebf10067b
SHA19345696b3ba97737d279f440caab82e1f32ef1bc
SHA256be0b1060b4bc9f199ff7fdfea6a958674fc891f9ef8a54dacdd87786ddd14fd5
SHA512a6cae202a867215e1d9183fa4c646acde96b56b7eb931b0494ff1e637ffa5f4f4166ceafd57e2a3833b5e0b9fd7f65086cd023797556769ea875bbde0cdabd81
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b