Analysis
-
max time kernel
117s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
22-07-2024 15:37
Static task
static1
Behavioral task
behavioral1
Sample
63c39ddc666975d0b44c27c50a61a2e9_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
63c39ddc666975d0b44c27c50a61a2e9_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
63c39ddc666975d0b44c27c50a61a2e9_JaffaCakes118.html
-
Size
8KB
-
MD5
63c39ddc666975d0b44c27c50a61a2e9
-
SHA1
fea8f0e5b90f38eb0586744ca2a9ad3b63619d9d
-
SHA256
de0e0da859e8cb8cdf1f5165897557fbe758e42af0afb12be178d6cc0448dc8a
-
SHA512
1d2c5131a650896de572dd41fcf002063cd70bf2e133f4b62c0c99e742ea344335b95bff35aa9a1aa7fcac6b077aceee62dda9ffdd56563714a92ea5eb72ac79
-
SSDEEP
96:uzVs+ux73wXLLY1k9o84d12ef7CSTU3wzfSxG6MURT2/13pX4m6WHXCmCGq8k/lw:csz73oAYS/uDRTg5o3b76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40c63aee4edcda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427825285" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f035510000000002000000000010660000000100002000000016fb8d60ba2112c449bc96322bf1a3bf76c301344e2cc8ee38f262ebcab284db000000000e8000000002000020000000b5bfc445a79c99a66327659d929125df2368f3db62783bacb3b15144ee3ad4299000000060cb04b64a251d320cfa3002c36998d7e8d89491bfcebf076a35c6d899fe80ef59e12c4ac102268d4dcc34890a621654a50b9fd7a01183aba5c46bcd3ba1b3dd5238ea2d91fc400c690428f556c26d6c8a8b016bd3126ec09934f8ff70b05a137fdccccfb367be459223d510d9d85fba6ea8943f4d1ae9f7997326f099e05ffd8f8bd5cf5c968075db353aaf82d7d621400000009a2f7e31d8334776a683e553290c84b536e3c74e6aa170831020e45cf74334776910a753c021494cea1bc3fd613eef97970f58dab4c185c6ca3561263e026d39 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1798F3E1-4842-11EF-9E0F-4E18907FF899} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f03551000000000200000000001066000000010000200000006f282286488398a0dbf7dd96ada55f13262e1b983e0af475d13123fd34ae985c000000000e80000000020000200000007ab0511fafb1a6dc53581e542f3c4b43ffc9e2e2ed263bd0370c851ac946f37a20000000cbb85a812a19b7276670301c4d4c4921159bc28cac78d1ee0a8cfdb38e08b46440000000debb486278e2e554250bb29deb505e4648f897d551778472a71d55d6c6ca558545138e682be1c30f12813326ced452ce9aa5d440d7a13d246e90ae2d8e4f46fe iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1864 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1864 iexplore.exe 1864 iexplore.exe 2300 IEXPLORE.EXE 2300 IEXPLORE.EXE 2300 IEXPLORE.EXE 2300 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1864 wrote to memory of 2300 1864 iexplore.exe 30 PID 1864 wrote to memory of 2300 1864 iexplore.exe 30 PID 1864 wrote to memory of 2300 1864 iexplore.exe 30 PID 1864 wrote to memory of 2300 1864 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\63c39ddc666975d0b44c27c50a61a2e9_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1864 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2300
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5308220b55e2cd5040083ed312a6df988
SHA1ef118d2b9a8d90f3e73234211f0cf468e0ed8566
SHA256e6f7db61c464e87ba389fa455920bf34b1c05eeabda6dec3fe901c3f497bef90
SHA512a94100e6528de92f2c28c0331d556e3fec7c498c47a60f37821e0d8700cacda235cc37a9310a90eea2b6b5b22255cef5fe27bbe4675c114c4bb7fa848d5cbe5d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54ccde38fa0e2f45b4cbec28b68ba2957
SHA13707391a594f78557905ec3f94d0b8e6c2e7f55a
SHA2564e82bc47afece2f9f004899ca9333e4a07eae824bebf4ee08b88a16c359e5643
SHA51260751b59605d3507fe7960fd5eea95dfd14f99b3cd19df02d9b688f53444f29f4ec86e6e2495886a915beb79fe349a227e043871a2114f6748f1fc1c7acf8e81
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ad2c450f8d41132c2b662861bb665f90
SHA1b5b8144a141d6dc003c9ed754157fa428373493f
SHA2565024f89eb2f71b01d1dadc4d82d088c3af2d9480b52109fef29ce6158b3de177
SHA51212b1c44f2a93a35048a58a3183ee2502dc1ddcc850a6cd7948e9c2aca2fe696ccce69d34ffa34e75db8377d2a5ce1ded733a1cbe4100b4b2330c27cbd97effcc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5448cec433afc8ad30ae2d5074feba606
SHA14acfd3901e8a1bce980ff33b7d7cdfffcbb978c7
SHA256f55e7ff7a717f952abd6247a6b3f20855c71927ce6f876ee89963ac068e83c71
SHA5123a5cc79ccd743342f210fe41a03233519acbd92b7e276b14ab99b96659d585e5c448b1af52738269fb9e3b533fcdca47b2d5232f08e40181c98046d66a806474
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b0bbcf80709dd60c3a1bb39634c19197
SHA1f1df081f9ee49e414945bbbb9427619ae259c87b
SHA25649379a06c928abc7a621e5e3f60fa81912670adc1f03fb710de7ac1e4324a5cd
SHA5129793938f9d23ea668ca16d8bd4624fc814b29b5dcc9ff02299769a2f07e5baf1e48d856653354e1ec51488373fe36c14e7d0c5f5341d7bdfab940f3a5621b9ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54b1edf82957a57ef90ac2c34c061ab6f
SHA1f7a932bb1f21d08e228d3e28d0c0604c73008a07
SHA256dd1660086cb6eae16bdf193addf160176fe7decd4290266d265ae56c0074f610
SHA51247fd43dfeb24a173a222205b894055304094da76872c1e5b2c06e7c28c348403b5ab6c5705481843c182473cbe8f2cbdb6521038d7d4781603ff77a06c456a4b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD540b430c2e3abf5836b9515f9e5fb0096
SHA18e2b14842ba169389f0beea6106cc817ad95bb5b
SHA2564d8e06dad5c001fd76ad984e489271d5b8511de24fbb498359b515361ece80ab
SHA51228e3552cdba6176bf77d7a0c654f334ba74c8715648bf71f16ac115ebf923cf0839c23ef6637a7c048e98491c60198e9691c52ea0b4286ff1faf4dcff321f490
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56e5ade2c1ad539f9aecb2da3b5587155
SHA18093981c254351869e5ebc167732e3eeb58bf622
SHA256ff5dc3d320d2ba56a4996fbd5609868033c42fc78676ff0b15ada17e5dddb138
SHA51293b3cfedb55ca4df03bb6da768e56cc815c20b5d9599db3304ea4b9d495f146f9aeddd9ec9362cb1a5d41d68baf5be20ebc8380c75ed75540d906f927a4cf970
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55989d9d5e37d52e0dd41caa83dab2466
SHA18f0b019b3c2e68000a43d484bb191e843184a941
SHA2562090616661a887bddcf18cf53f2bbe82588b68e319d7bd3929f628b23d413e90
SHA5121b573b0370645d54a876148980f64dd272d318c15608974a8db41f1fc3f0c01ec82ac8c03378f1a7a8911cd61a59e2cae798d66d7f9aa15d241ac1607e552358
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58083ee6567e3c5c199705e8205b953aa
SHA14ae0e7c0d53c83f6e3cd7aa0f8d757713c3e972f
SHA25658cdd157cee1b67c983414021a1095bf972a4eb690d272f5ea313f2d21889a04
SHA512f3ceea39a318a2748d77d630b4cae1b47f961f428021e9af747ef7b665721537eaa239f37968263b8a81ce83e77c163495cec333c2617eecf37a2b208ebecc65
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5999af47f12d4631b068db93d60942606
SHA12dd499de910b333726e79f5143670363be6c5655
SHA256b355a77c16f9788beea2bdff66a9503c133737a15ea45cb1839b05ab5185fe45
SHA5120c0b64bc39217068749eb55d563249959c2a44e2d1140260e9632216c7fb4f17c8adc336fdfb8bbd5b23396fb1da0c2ea9b73279bef226d5d076258471092031
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b2e7215c2fe98406ebff852bd8372a6b
SHA1a8caa920e446b3946cb547571c3e70cecf3baa97
SHA2561cf3fc9801f037aa5c0a2476153654c6bd400b2ff0086b2189d2538708c39deb
SHA512c8eb19ed98d5290cf298da6cc8a9fe56817bbd5a1b7258d56d0b6e7c946f1c878f359d1d9bea56f887ca5276b53041f36eab142443d2c5ec96758d8d3ee16572
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD558147e6d9bad2737206dd15554572785
SHA1103ab7e3eaba3216db72a3dda7f0b0c1e54ddefb
SHA256bc55f04cc1a3962279e3dca773c10f0f683850111b02e97958330295e7228b58
SHA5125d0989364e22fdd2e7da2618cef56cd7da845211d76a5e923adf3ebc19530bc05d402e1404fa1a31ae5ba1411b0b1d5f0fc7bedd44e55a02c5a8dda06184cbdd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ed328177e07eb849da040cdd961f533d
SHA1b7472d90e89f1c8444f04ff798dee0f6c9955ad4
SHA2565e08460f449c8358a1fc07fa7d097943d45b7e99e63ba15dc66177f671ab52a9
SHA512d6302fddbf83cf435cae6e95cc958aefaa2dca196a50484f215dc0cb3c04183c9e281b888e94bb0b9008af327540817ac8f8f94a53ea6312859dbd7b9c9c33c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD588b2d07f1cb0fe1acbe01be6b273e435
SHA1cdd9353d84bc18e929f6804d7b260bc4e4acd44b
SHA2561e4e59ba2395615f4d2817c6f057467bb8c9beccf642f83d58ed4e45b459758c
SHA512617167a479a893eb15a2eb9a35b82d8eee46f12234becf60c5adf4a85af073d0290d80ce31a6819cb525fbe236b787b56a8c5e5b131a993c22cf7a5692370428
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5302df31e9ceb5e283725efdaddf88533
SHA1010c1ff30c975111648ac110d6d20898ec2597fc
SHA25639ba325ead53b04a5f86e7f4d77eae25e39fafa2445ff2057b851420fe7fcb12
SHA512e1748a605e560097b8774d6ba93c1971023ded097925ddea6aaa34133fe9ce0ed92eccd6745668af9686898e6d9909e5a623c7580bf05609fedb64c55377956a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d8d7f4621ea8135aa6d8df4e1f7031e7
SHA1557af2b819d4631311cf4bfc8c2c639f4a4e30e5
SHA25657239debc9b71752fb3b2a5717e990310fa8aec4ccc7a4b1096cf2c9a05e6a77
SHA512b56a671df8ddc72eab2da448dc68a577debcf86f4e414bdf0881e25ff268d3eacefbc3e1d526008056d72c729a6b01f1392fdaa6f8caafc087f98e9c8e11f796
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ec4815542f2b1a69f04c09e983ae0a7d
SHA16e12c2f4450c3ef7c76bc989d9faa2b341ee3b3d
SHA256e9f15ce009136d4668eab627b38160fcb2d2e2dcd3d4effcfd1b0485af86eeb5
SHA51221f138f85a05109bd0772fe857486e6a303c156479738a0301c15bc91c02c35b330f37c0d0b027991e4ac43e2d3635e189f6bb410259c7d96e172eedd8df6194
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ffd435d3e343a720647c4ad5a583b1de
SHA163d7b602a82449302f6f286b84209a73476c3aef
SHA256f731c25bb5330c60a141e5e00f4fcf6a28827352d0a2646939643f48735955d0
SHA5129bb5f5acb80f336e6d5af60a827a352fb187b28c700751931a53afe19f82fcfade2d80c02aa78761a6e5d126edcad04e0a302e9139c69a190bcb9b89528d2fc8
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b