Analysis
-
max time kernel
135s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
22/07/2024, 12:56
Static task
static1
Behavioral task
behavioral1
Sample
63430e40ee9e3db01f8fad2b823ea03b_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
63430e40ee9e3db01f8fad2b823ea03b_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
63430e40ee9e3db01f8fad2b823ea03b_JaffaCakes118.html
-
Size
3KB
-
MD5
63430e40ee9e3db01f8fad2b823ea03b
-
SHA1
e333ae46d9ec04e73ab8acaf2a645893faafa11c
-
SHA256
60a40c144826334965fd26df760f090a90cdd291b32c4bce088e38cec7571387
-
SHA512
d33a4f7bd36177becb0b99f145e8d8594969d4d3313ab8f2de43489da50b1686722136192be4a265b5e873bb65b74db75627f840b2ba0d970d73d1660dffc413
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427814885" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f035510000000002000000000010660000000100002000000025ce564f3755da18c7a86f979dd7df33aa15531503246908ba6e127b1eb0c560000000000e80000000020000200000003860a0f6390201d7118d7384406b823c38572e6c7cfd52a92d73babfaf9ed1e320000000379123bef9282be150f66e9a530be247d619ff5621938c1569e5b3f1c039a08c40000000567724c050c190f70a4e3a1d1c6dd1f0675e58302a72db3be813dde32167935cec256d301f874128a7cf2d65569a7cc0373ab425c8b1af6178f4d9984fabde78 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60140fb536dcda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E02A3441-4829-11EF-838F-D692ACB8436A} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000e404a4c56ea3abf0c2eae202526ed9b9f1f79ecfca38f67147f26723a5aa1006000000000e80000000020000200000002f5a91966b2f18b6a77bdbf0506e2ce7dcc23b648d6cb0e7552267971d1404b7900000009886a0c2afc8d845e141649a635b1e49e49b53ed13eb237395b59faed5fc0a153a98d397806aad39d74e7a29da71a1826cf3eb6aad940ea58ccf66cbaede92e912004ac394e9c3a9a353f0cc7755ec51dd166de2ccee16b9a6159cb36687b9903910377a168ffcfce61db1bd5a7deeafcc7500dd396fbb21b5964e1f05e7cd9757b37daa7480e6ca8c61a04ca8cde38b4000000013b97755c5ce399a0064c376383643ca8392f3b219636e86d7a7914cc36de0ced89054a400bcfcd1c94e3793d22de985c2b9666fe5eb5ff97c50d6dae06296aa iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2596 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2596 iexplore.exe 2596 iexplore.exe 2440 IEXPLORE.EXE 2440 IEXPLORE.EXE 2440 IEXPLORE.EXE 2440 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2596 wrote to memory of 2440 2596 iexplore.exe 30 PID 2596 wrote to memory of 2440 2596 iexplore.exe 30 PID 2596 wrote to memory of 2440 2596 iexplore.exe 30 PID 2596 wrote to memory of 2440 2596 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\63430e40ee9e3db01f8fad2b823ea03b_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2596 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2440
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55bc9ca862d551d61e0b461a597d94fcb
SHA193c7e7856092b4fa4061e5ba1e638b9fd87e4548
SHA256a29da8b51d6e0df24c15d0d148d2d84cb7ca80a8e09f8b9357f81272fa98ca64
SHA5122dbd95c687501769a216f79c432100aa6b246cd5db6758a9bbe6746dd049982f5ab78f7d5fca89970108fb54b517e832afb3de902a1e7d00817cfd0c70f67976
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a25fe5b93fae0868919b6b7f328cc714
SHA143ebaa37c3b29334db08a7b2cafb497f43971b29
SHA25652a5ac094554ca81a02336eb4e444f9585d4b6dca6b95c76a18eecdb894385ba
SHA512e01913ca5a07d163222720b9d73cd2c85b774a1c01bd8f1feaa430290ab6e28423aa82f0dcd84812c2f9aaaf24b39d7b67a97d262631d3f8fb41b25a02e94af4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5701224a68dd284e1a7ae201dbcd761e0
SHA1648dceb4fe89e73d906accaa64a3ec567857909f
SHA25670097a79bc174e2cd9c7b2007b769daebcf8a8427c0c43242b6caffe15815d9a
SHA512ebf19f9db2b2c269a2f6de6c1146a5a983606e08c1a25be78c38d2a7dc48f3d4f1b377e84527e29ce2d08106d3bcb54ecfa139a2a53401cfcc371f8a76b43c64
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52474b6f385afc20123d2e4220be2fd1a
SHA139f81dd723264d7d454189a0c62a796a55dba225
SHA25633a8d7a9f499bb25c84992d6316de40538654df7ec452aed147246b2f68c1531
SHA5126f019aaa335dedf5631d06b2ac416359993513cab819047c900b10f2726877ab98cf6d19d8643a8c6bb95b6d67eb4cf989024cfd446de7a56a473e4eb0bdd75b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a0b73dbaac1f4d0e6a836a83f435353c
SHA19dc59918af4200db72a4e0f6ce7a8685ab86cbf8
SHA256932029e12395a2b501245b1e7df1cedfe3c1f04c785ea7d65c78846d7eaa8cc3
SHA51218f404c4dd419a40fca6a76df08d10e4dfa24f4181e58acd1dca13fb997f3de5c2e904485196cf2ab0b8cd373265b5293352c0b4b89ee33ce13421d96dffc595
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD556f6a29fc56e1e3b64724fcebc1fb110
SHA13ab868e7a18d93766da130d3c9d2aa2902fed267
SHA25697e270e60c041536d7e830afebe1719e2598c9a5fc4948f54bbf4fa652523364
SHA51224ce099c4a36cedfebbb1b33ac28abb75b4d4da27d56ec7789ad23963cfd918083df9632fb905d2e3603ca6b1255cbab2702e154f60e7291ad113c1ddab17dfc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c7bedf49325ac1e9f1db765117f60249
SHA1c6e5d188bd34a91d6883dba660e348f6d6e2a344
SHA256ab02fc04de4398ea061b956c89c364f1b764f3b2c641d8e12a204b786a962664
SHA51212ccadc094e2ace1e0b19487dd94fcc055e30f881351f5e9ca50aa407a54b8195f0b9a1b963e49dc9da8260c60f854261df7d97375f2e1a443e2974b162bb33f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52ad6134c1e58d693091880309fe20b3b
SHA11fc3cb811f77e9f0375241e7b94650e83e6f2114
SHA2563fa003b70eacf1ef95d88492a05f7c8fe5725d84040b9f535bd2f660283fd200
SHA51237c191c886a0d1c635d617ae697b8f341051681dce8dec870d2ff1f2e346c4bdd3a592ed8dc9c27663cbdedfef1b37aa9d805778949f634de7ea83d498f1ae5e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5394cf4136fb7d442b7693638cfa6750d
SHA13e6f7e1851aded4b9a7846639e997f9a4fa6a00c
SHA256cdc3ac3b54c0107a92b8750e1d9bdd8aa77d4877528d112dcb812e495a132ae2
SHA5124d7fc0aba5d2a2ac97722160897dd5a4b89677b16f36890ff748a26d87ee9ee7e68d6828dda1d88152b69691ba1342ca3023abf4dfffc63f4bd989fada21dc05
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ae2232d1de04deca0e0618d60295a1ea
SHA1b9c0cb359ed98eaf885f199988e2148e208fc1a6
SHA25692816397eaad2bf5d322dcf14658c86f54a0822262aa34a8d15de2afe744dfca
SHA512e17372419945d7bc126e9dd592af7b9ac73d12115c8813a43fcaf9e0674d1103aece656994c1444bb78f50aa722e3bc8f468a3d6442b0033fd300bcdb3026e80
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54dfecbcc38206aed55c92a3f0b1d2f71
SHA18358587985b18039f2f62d48891e156a8e097d7d
SHA256f1dae2b42f543bfec9724973abec82cda1f5317f47e337e1ffc560cd29e5af55
SHA512c64de785fea44ce43f7bfd94c4024b57f0c942f2e517cba7df2d6aa96f394bd7b397b23449e2f45fe8451624a8c512cca82628fd7f539600ae5096dbb2a6026d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dd4f586084f93ed1c8adc87a169b17f2
SHA15fa43b138696e425828c5afe6a86de66442d0f26
SHA256a8c3fccb54d46e57f788a76985a8ce1892138e17477d8b8673a829f8755a36e1
SHA5127948fc3887606709a139f46abb9895f72570313bb0ae25dde8df5900e0aa8ab0584c31980df57ae8daaaccf45aa6c9a38a3b7520c956113d6f40fe88f49d120b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c4bfbb623b0db25ed2e4d243db63f2fe
SHA1c4aee6d50c6dee14a3f16ca8292fba3cfe14aa01
SHA256ebcd5e08d1befcbf23fba790a9efd2fdb44c6fa1d51ec2ca98dceb7dcab06ec0
SHA512f8e074857b66369edbbf202f678fc3a05c40be6658bc9c58f6d29498438fbf725bb5d9b1bd93ec3ea039931431cf8b86778451dced432c949246837ed6cb7b39
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bacff13ea95188edeeb509070ecc346c
SHA12ece146b21a586f6d9da5266c4b3862f84822073
SHA25635d0150c5ff7961e67ce68aef9428d93d1fd6a2b103a5cf610740f4a6db39b11
SHA51248e4a5d7bbece4cb91e562bb979d4a51c9e3b737cae200e2098041217b97ff3293150cf2d00743b97d690be62d5ad3b8936f30323eaedce78bb2221f740ab409
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56f0c13ec45ee524d363e34910f1985bd
SHA191410ba7fcd5805e678129cf949499469aeed4b8
SHA256eefc62630f37e49f052f308227e3fb1344abd7dbea00cb4f477bb0e406d7bd57
SHA512118e339a2afc0b1a5d6c8d6fa35dfeb76485dd8fab249323a9983b433bec2d6ff353052fea9bcb0e823f738f0fa083878498237d5752754fbf29951ae73b72ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d199ec6791390a119de7d17162f87d63
SHA173f635b546d23b34ea10652f8b1c917fcbbf5c26
SHA25640e0479de6a4b7fe6b134b915b28dc2c785f60b723f524a593e0e61985d82d3d
SHA5124b5cb189abb9b027a8004ab5378993cf9ae88ce95726247f29a2f8c0aa92bbb3ac97eff7136e159b0de3c193d4c886433124f7ea93ffac2d715531d202908fa6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD514574cb39f7feb9a8d3f9e7c40b935bc
SHA196930928bc9718a19fd138339bc665e09ec6ddf0
SHA256caac3dac11ef445577e19c60f657d2d266c797cb19d8ab7d048e0b69180b1e09
SHA51286074f34f11df57cd9b0a57260ab6720a888819d9ed8f92ba95767a16498eacbb59fa0b94de8806cee3fdbd1562115b25364b4569897241257edb155c425dc54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c064a84578f4b0dd19e1cc6cc0381885
SHA1ca6274db3502599919d7078c2d695d3f669a5db9
SHA25662e70e8d6e38b9a939ce842c170268e48dcfe310d0106ef875653e40eb176fad
SHA5128019c9ce834b451ec9df1b52e46d233e53eeab45a1130760cf9dbcc5838929e0c4328a388c0a771662fbc3013cfa4f7e50aa7bff80d0e421347ca8cb99a107ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c642a6aea693ce9895ebef48216aeae2
SHA1184ac69e002a083d9e962f641c46bc121e45d34c
SHA2565726d9060e00354941b36726d13ecc07ff91793b121431db9a47200d9f11d514
SHA51299c01bd3dea53a06027cc5742e87e31263fbd7c024fb593d963695d783cb8c228068af6e6ec399da6446cceba735462c1c41e7e4944b76cef619cdf45ba8c4c3
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b