Analysis
-
max time kernel
121s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
22-07-2024 17:45
Static task
static1
Behavioral task
behavioral1
Sample
642922106a3ac72f4923de4b9f40858f_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
642922106a3ac72f4923de4b9f40858f_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
642922106a3ac72f4923de4b9f40858f_JaffaCakes118.html
-
Size
404B
-
MD5
642922106a3ac72f4923de4b9f40858f
-
SHA1
601f1a89f5185a6bd7e43f5c2c49d023e14ab3f4
-
SHA256
67d1ff5bfdcce0e2b994e7e2b7d3eb3ee523c3cc1dd02b446bc8b8c8971c5f70
-
SHA512
9ac27b4b281c282817892219236e4bdfbbf5562328ee21036d4e2ce38f8a554892edee0205ad5e12fd88153670dfff843a1841426fcec188ca81b4cb7cea785e
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a03e3b235fdcda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4E7DDBE1-4852-11EF-AD9E-EE33E2B06AA8} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb780000000002000000000010660000000100002000000095fa515ae458b85488f3883ee151bdf5f965ac91facda6a955feff6763548963000000000e8000000002000020000000c198a35e1f8c724f57ccd7293481cd4ea9fff9d72957c184415d86bc1a24a71e20000000a6b134f320cc2d15242853930c6fc4894be6f094d4c1f3a372d19d7c75300ba640000000647c39504c1c159d55898e5dcc4df31f63bbae92a22ac197d5e1d1362eb0cce82f820c1218b90ab2d15e081f294c9175d1c790b8b304bceb1e3f6a9ef2ee282e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000ac3b5f07f44c7298f2b8afcff8051b005f5cf9450a50e654255bfe08f6a8179d000000000e8000000002000020000000d0c8f3486cd39630df4bce70625b8480c158f23666608d067ac464b86ba8507990000000a8dd67ab6a4cc34488b7c43656cf3e9b8aeb143134a5058c07820f838d7fe3a95144fc6524df3b65a56fb01ca9437dddb69cec5b29b49f278d7129be944185a238910ab20c4a90c4df8bf3abfedbe31b227ee6f4bce8d091b868e01fc0fe92607b677cb448283278af5efb37ad1c9a6323311434beb61d748b7ba8215a3dcc335115b8b1a2f1bdf5a244a3cd4970d6974000000066192604175e7b87ae27e9f15df16fd0da6cd7eb16fb6336f145b011d50693b5a9b3e7091e2183c663187871a80064e4b4128c82e7d83143c366cda47d4302e2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427832250" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1152 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1152 iexplore.exe 1152 iexplore.exe 2800 IEXPLORE.EXE 2800 IEXPLORE.EXE 2800 IEXPLORE.EXE 2800 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1152 wrote to memory of 2800 1152 iexplore.exe 30 PID 1152 wrote to memory of 2800 1152 iexplore.exe 30 PID 1152 wrote to memory of 2800 1152 iexplore.exe 30 PID 1152 wrote to memory of 2800 1152 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\642922106a3ac72f4923de4b9f40858f_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1152 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2800
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD539f5150b92df6343bc389a13725c07b7
SHA121d859249b461943a2fe2ba20c99495148e787f5
SHA25606d819a8ac6fd3917913ac6e795700fedd805d0e85af8839991dbca1f2f196e0
SHA512f4e7e5d3c24073b9f0d9a4038eb79ea4b219672670c4c4085b989c665fbfaab5f02a5d06efc33269d8b2329493347dc3fcd4028b504b00fe4a951158000db63e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aa7ef6d3c743856d6de19ed7bd504764
SHA13cb70035bd7e74021a23b7cead66d2fa0b6c40d7
SHA2569663247e040755040cafec521889f3bf82ce4124ff6b02081bfa9d2ca49e7b61
SHA5128668e030cb95ba59283b45fad7a62ba691896a3e977bf1df4869b205c5d2ba5d7bcb76d30bba50c46e244bcac4b7117dbdec822f883091493dc018a5908ebd4d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59e608d726db332c6e65a3ac9fbbb427e
SHA16098fb71a920654449d4d7ab04441d5f570fb560
SHA2564a31d9bf6fe6b3a065d230448d8665d6976d49cad100aa49fa978ab778ee4d46
SHA5129c69789db3ed540489e57f51408f64afa4c022e946e1ba07c33320a67c5b78aa789db1b5091359cccb76d952673d3f25553bc30c6730a732d37f4647dfec845b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54449ff2c2eb649cddddaff785672a065
SHA1252b9f4adc660396f374a4aae3ab1e0ffa886d92
SHA2566ff41d0fb242b9bf79cde5a341f67892bd2055072bdd51e45e07b98cfc6e72e6
SHA512db106509111f99d6d2224b6f4316320e7881819ee87f5408157e92e3800c7aba6337b2bdd19d10ad0f06d71ba97d0b5b9eb1f8d38e085723497080843cd16d6b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5654566c77bffc95fbbf4fa8c52f9c26b
SHA1ff3cbee6a308fc99fcf554be564568644c1d13ad
SHA2563dcc61774617c8c1f7bef42c9a2c2f97746592f7cd0383168af771b29625c28b
SHA5122cbe8cfaf213b5f88a9272f6f3f4ff9cd8f7a0e5cc4ea0733c39cf2f23a2b73e768a36ccbe1103f4281c898fc0c96d23a7acea164494b4eb940f57c658552a05
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD570027003655ee5ee4c82afa1faa33be1
SHA1096e4cc47d11e6c829f609366503747bdb2215eb
SHA2567bddcc3114659dc7bbfe5cef94cd04c66c451d12f754e6bad0b7b6ac3bc41179
SHA512a758ae85e05c34970332e03cd9e80bed88fd9dcf18e3fd7596241835732d79c57a007f238bcabcb792e82e35520b148555073b423b1bad0b8dd717f33ffe4b75
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD573e9159daff62554704e8d0d8c0215d8
SHA1986473b6f70dbfe44b4926d7b05d7f200f0bf766
SHA256034b042746b1803570df6a2a49866066bbcb1c238fc5fad33c0be4b8ddb2dc00
SHA5124a12974fcfa3d025b5c54787c265a3e545b38a7c0ee9c62fb13ac36052b94a8bcbe93cfd389ec5c1ddcfd627c5f84eb7aeb8b9d13014686d93e272dbef179067
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bba36370fc50a5d73d6c01d12a145ec0
SHA14f1be051cdc62f2aa6994edce4267f340c0b9e97
SHA256e863164388b967bf42912ecafb3a8e216d580a9a97e898477ac330ce520c1839
SHA51257c9cd5be3f51c5f3da5af7840480bb78ee21f6d80fe11d7341cd8e5f957b28a113946a0a2559b228952b5ded095b9a75b1597b568a3b307e5d918eb7703704f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD554a7b1c312b2a75670e252528da00fb3
SHA1b3873a5f58c5ec69624f1cd5b5a4b8304130667d
SHA256763666b945fd3c791c92a8b9c6c8edde94bdcd8285a7cfbd80a4d41cabe6b469
SHA51233b4026b0657b74e6ab5b2948af6b30a873311959b000bc4ff50d0fd1827471d65b984eab8565f70b59f6a5044b27504ba286be047ed4c563652d1d53bafbabb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD509934f7feb8daf1891c3d05499cb2c74
SHA149ea59dc6c84ccf6c9611ede61b70e7e9cfcfd6b
SHA256354269d0d9263a1f80e3ad3e523b5a854240422d9c5bc8079fe99fb5fdea0707
SHA512a64511051dee2f4f48a95504a1a59bbfc4493793307e6f98dc367450907a7b7f6405fe089f9acf87fe435dc0b71178187a3ee0474eb3288148477dede6676148
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a4bd8c50e6f92c07068d25f1c4b387a1
SHA1452dbd3b10c1dd362bdeaaa94e90d2bd501b4b52
SHA256dc5f9173c0fa4e929ef9facd4214e3f968adb10b01ce33dbf507a7afd35a26c1
SHA512e27e0816d92d810feec11d40af2febe6736665aa24ffb05a6f3a25675e0e3f494f9d0e049cbb55c0c1ca0e8781a1d624e4c22fda4214feef7d6e6b53971eed47
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52d2ef0bad405af7e8fa18a7b81c709dd
SHA11624382052d6c775b05d963ad7fb6801c71acc07
SHA25669c3a2063a26734207a23e6d59847bd3bc3cd337a306ba38de5426eb722a1813
SHA512ecd4ebe53067d6ceab5a3ffdb588be247d60000694a22f92eed75bbd2cd963b94788af68b276e136de2f053edf8db51a9002ca37b35a097a08b16f6822e0ae9e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e01a2973648e39e26f56ac232c1a15a8
SHA1d77c0e09437e2dfa6eb4e65a2485d6bc2ef9184f
SHA25678fc1c136a7b5f16f8665fd837e826affd1d1a60c6ede704956d36fc7a06f0bb
SHA512b41d86ce9ee8566f05783f3d2af0a47fec20ced37f6b416a5d3af4c656b270199fe6c363955ef4bea5123f2da37c2c2adc3bb66adb326c59958fbf427cef367c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fb9fa5f881e5c4406d619355b09aa1a9
SHA1aa54b1af3a0026d2f0c68248f90ccbeadb9223aa
SHA25685536d4627ba3f071120ef2dfa008b21f7231f233375b334a53768e356854ad8
SHA512f38803b08868153bd5194b2051a21bc5043c15538a5a7f9d94159434e3b8861fbd3f629a713b050b116ebdc31dc37b194fabf8818c61fb5a79ee509e8c5d66f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52a50d22cb11e2c2e4b7c5586b5b5af36
SHA19685a5ec78e4ff311d92a5152c85683478f78cc5
SHA256c24977b1e357d53644b263f0612131a757e603831690a4ad69325e2f802f372d
SHA5121d24fb13bf4d6509c65312b58ade792a57bb76a3f0ad3fa52b82cfc4cb75b2cfca9899f48c787aa5856f5008445f99ac70d4e5dd427bbadba20523224b6cb818
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD560c993884215fa17429f211161fdd310
SHA101e80804d82038775ece93686a851833732d7ef9
SHA256b59dbc26e71bbb08dc731a11e2a86c2aab28561466396a9ac04a305c8ebd087e
SHA512a1931b3aa125ba2102193699fc48227bd19d3e31d8ec6ebfa51c79efd0cae37a438522da7b7efed5515af35fb35fbbf239782a6e5e432cb004cc9ea7d25945b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59476ed0a228476a49507aa28302088b9
SHA1fe12904253be91f1b89997a8738d9da096ca7b8f
SHA256cf89248b579b9b49128074d79c487c140521873ed849008695f68e9529b89cd5
SHA512461740348b9dfe92ef3e7daa345906786415d28e92e9f29f45c6a8656c41ccd388c69f2323d139ff15b3971a6741880e835af145c879af0995671114abed9bb4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD517bfa3815d0f5cbc06672a7f9a7aeb96
SHA16ac7af38507556a97c721fa05beccf564f8be3e2
SHA25649f51554d81248ba150e9859287290e890c639037ae60de90587d2cdb1673d99
SHA512dd7a4d68b91917506519786793160b74ae9ed9fea8723113e1d00740e63601e454d2456d8c3a06aa617e28d3303764a22682e62f3f174ec1dd6c15b5c958e261
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aac3385dbc0a64a8225ffb3da62a51d2
SHA17e2d2ff6509f687e0ca4f091f9b15b0aa1a6971d
SHA2560154570827d82afebe50ab88f7fd7fb57cd23f64ffaafc54ec3e8a17a2a1db6a
SHA5127c323b52865df1e97c97da8c64aad9a545213d724aaca933eb62670bf661f5fce634d6b464b3909f674d5192f4526cf96f0fc68cc6d5f31094e731d19ab94781
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b