Analysis
-
max time kernel
117s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
22-07-2024 20:20
Static task
static1
Behavioral task
behavioral1
Sample
64a9430f12ec6e994c09c1bdc7d8c8a4_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
64a9430f12ec6e994c09c1bdc7d8c8a4_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
64a9430f12ec6e994c09c1bdc7d8c8a4_JaffaCakes118.html
-
Size
5KB
-
MD5
64a9430f12ec6e994c09c1bdc7d8c8a4
-
SHA1
6c75bde827b155168020f5bcf50f1f310e92418d
-
SHA256
f55f2d7e2de843cbd20ab46b6b3715c1668675057435a60b4bf2f344d0c8c4a4
-
SHA512
f6bef015aac7555b694445af75c1e9656153d9e78043b808aa3f78156375f1551f56794e42de769bb841acdbe2f0034d4597cc314be25476ded73eeb117ea71d
-
SSDEEP
96:O3gKVMk+c4+cf+nqk+nCd+nc5zbbPy0Uz+d41F/BbchyPVZDeT04njdUzqTFASJ0:O3g0Mk+5+c+qk+u+c50t
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000fbfb2f0047a6dbcfa90c57366b845159fa9e89f331b066567f1869d5c12a8627000000000e8000000002000020000000131f530a6a7f3d4cbcfa091e161958e2bd95484e28c47cb77c92b9df176fbd9920000000ef41e16ee60bdf73a80741b4754641ed9559df9f9b0a343eb57b9d45b20e380340000000bba6a149c75a903befabe5705515697a44d8508d3919f03f51b7db089d6f3811c1821ac6c54cf8e231662193ff8b73e5f884c7c26708642d4a91fb602345d6d4 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427843692" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F3185A31-486C-11EF-93F3-6E739D7B0BBB} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40c6e8c979dcda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000e97d5e77ab360db54566d2328bfb806c8ccb98f554c4cfc9c1ce1dd0c664b25a000000000e8000000002000020000000ec4990c2a24955abe97c6a0b032b5725c8e789ec5e2e0822d88cab1c762f69c090000000dfd2443bd79ae5d3c2cf4eeecbf50b84d2985d013cc571e0ec958ed7503fb8d516dc34c91847ea87c927e9b93a95ba284fcd4d8c1a5d53798ad9599d5b3a5da2969caec18fb46cdc1727f8dbb5c41454370d981435ed1583a0313a8bfec69c8a522a0e4476379f0d30f986232dc04f62f58b2cf29742977e61239d60c4d5650f5c3ec9ef554be94efbbbc0927f7b9d1340000000333fa9285ffca2187953ccd73a1825f7cc0721f7d22afa30a540521f09967e79a5a0156ad9867133a4d0d4c476f2bb6060b685f45bf279ed424462a338034634 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2652 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2652 iexplore.exe 2652 iexplore.exe 868 IEXPLORE.EXE 868 IEXPLORE.EXE 868 IEXPLORE.EXE 868 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2652 wrote to memory of 868 2652 iexplore.exe 31 PID 2652 wrote to memory of 868 2652 iexplore.exe 31 PID 2652 wrote to memory of 868 2652 iexplore.exe 31 PID 2652 wrote to memory of 868 2652 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\64a9430f12ec6e994c09c1bdc7d8c8a4_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2652 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:868
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD516a03d9a08d4cbb5dbbf4d082b8958d9
SHA1f4a7b186e25ac67a69ba78ecc75960f8a5575504
SHA256e0b556952bb7cfdf03aa1321014489ebc6f95a134109233164d7f94b0b9d4829
SHA5123c6bd2a5ec63ec4d3739e715b62282f5c5fbb2b1baedbc1289ca821be854c72b63847de0a4c1878daa782d2b9bd771a1145db6282b3bc40cfcfab25faebc50dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54e129015fbe1469112154f0551a04c22
SHA11b47d3408c9ac1eb95ace49488d2200fcf8f5153
SHA256cf09084f233432b07295ebad241d31b5df7f04778e2bcd9b342e03e858abe70f
SHA512d201bcfdeafdbadaea4b56a40436e3507e4485b82cf3da90997fba86007f58fbad2734ded3ced935bd91faa4ccfa9870b6755dcc9928252f887b6ff2e42818e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51dbed8c00361d7254b6e347d7cb906c1
SHA1f5cf01f90bc7b22c387345de7d43702763134d94
SHA2567d5c5beeb5d568cdb83c43e266bbb6e3d2991df5705e29b205ea11a73d30f82b
SHA512fe95da1470ba3dc35d3d5b0c9d7d73de8d0192855480d6220e1b3eebbc0b9cb6f9c255101daebbe8928f1fa2004a3bd1df615adb3b71400aa70753e83e6c0b73
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5217ecb85a36e16cca5cfdb2efb5263e1
SHA198fb51d3a93ce7656bdc379ac925c77cea0a018c
SHA256c41c91c284083c94d7edc4e9ea4836de9f7ff0adbdb47990d86f8ff568d40b8a
SHA5124686f386071f6763c35f877b56b5da020427c5233ae504300d0b3f6df48cf47f872f5a03eacf8195c805074a28c8e2bddce300be476a1d55296c6d4148c60aa9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a32a6d6e0bf1a820332c5c361f618b3f
SHA11427c9e2f4b07ec045d657c4f4c8c4ec20ec32ad
SHA256b1b7a09be3d406b0e25dc6ae713af1f1ff7c414a46dcdd9044e81c3945aa6ea5
SHA51294bd65eabaebc98d01c1f684c4b0d257dc5493b9d7bbea6074db7ec16718f54d3218730d64549e949ccd559e50f15df29ec86e413e0b87a30b3658dec94bc28e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eb77ee87d1b341493090f426d6dac428
SHA1b24884ce299b486c31a84dbae1c330e86527ba8e
SHA25619005f60bcbdf4aa0f145881a74b9181f7b7998cf7cb3bf3367a44eb6e2d53e5
SHA512b5dd5689202697d5ab8a8c5ba8472876d7e8d3956232fe73c129979cb8b3c996e2d073c8484e384077a3a6f41c59fad9a8cb6d8633ec186e803d88210e07d22b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b866eaf29a9bd0b7ed903d8ca0c4199f
SHA131ccb893dc45df0d8371662bb5705fa19a3c022d
SHA256c5a3d1f50a1aefc2852fc7ea1e53de082c9bb5295d25202e90fe3d895c390991
SHA512eaf3c95463a351029cdc25541b897aef0d965eed205907c4b3fb21c94089c73e534085abb81402adf5fe5fc1a53b3011934b0c957440f10373100e0d4e0a4359
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c7f8a94a878a2e6578840a9529ab4a1d
SHA12000f97140347db06f32806aaf665a75e8a147cb
SHA256aad53fd6e558e05b57d6c3b65c33fae4bb15606c602ed69281c8037b9a9deeb3
SHA512a7d45b44d9d8081325e5e449115588b072781d8128874c8e401b99943cb39b325089e6bb411395571e1f52154fc752ad97f6d048f9c7c45d95b311cf1c4d9001
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59ffbc796a41462a684be60c67bd3f1c9
SHA1344077b6b6dfa78aa0375409c132aa2747033127
SHA2561ac7d6cd6b1905dc0ee3cf5b35553ba36f1dd20a69f52dd24fc14a4df2319a08
SHA512fd4455dedcc96a5b5ca48aac80efc8d37555067c5ebb24efd9dbfcb0a6baef9b41ce14bd34dc004a853ca0886a05517539a4c9c58481f91c992c365fb720661a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d99915e41366ab75a39058744e11bc3f
SHA1a4266207774b8fcd4b017c569417fc806832c953
SHA25615ae22c64a2a678b7aa0b271f5433ff37f277f17b1cc7cf742d887745036ec39
SHA512f816df7f77903802fa013d90ddec606d73ddce9f3910ec119987be0708637a9652ba6fbb91a4706999ca185231be36393bef22a72579d0d4e558d9465960d65e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59bcd8241e4356fec85748ad52858e588
SHA13100e40a8d0dfcc9b4d067d03d045ccea23475a7
SHA2562114a02a1c535ca6eb28b462bc2c8a9b2e5a3075194b2fd661d033e22068e6c1
SHA512b4f4cacfc39663c892d0c3c5b7262cbc2834ce4e7cb8f4d95ab9f67604ad32837e6e7a690cbc25949b91110403d363c9f51013ce3174e3e2b748edef34eac627
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD500622bbdd286f4654379bbc419ab6f3a
SHA1219fe7c0e81bd7e468bdcb7c420ed753ec89b9c7
SHA256f0bc8c6cb96460b79fd82329842be7bc9f1c8d7cad0162b156e20b224ed03492
SHA5126b467e7f79edcf9d741638f63f2f26228860df4d856e1b5475be0b43f52d366bd84a3c590013c5a78e597e5dfe748b772d07511b20adae0d9109d208972961aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD514e598812de1de44291563146bbd7b07
SHA1d236551271e6d944b71f7e756acd79ade62860d2
SHA256f53641b7d44aa824cf291b1f2255b4d65750043775a04b399f85bcd463d49a29
SHA5126e86280458ed68d4ad0530e38214e339bf03cc40ee7977f2b61da8dd0b0dcbfd2688e7fe327fbcb926bb4779373e9559c4f54f555840a54c2ae61559011e1d4e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51a8acaaa078149b16f56ad1c972bdb06
SHA12dcef379b021690b5b4b5c27fe0582b3a97a663e
SHA2569d9080bc549657ba86fed90d2db684a34be8acef6a5d7f16558d03706d0e7904
SHA512bbea2e6fe3caabcd7faed2fdeec5f1a8a8224553df51a3c4ccab81220ecde285c56075120f83a49b648a366065256bf222c932aeaa2366a62896e76214df208d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD521d51c2ea842c6c0d23d7dcc626e54e2
SHA11abee7b2eabebdb71cd0ffe788c395f9c28c4c48
SHA256e9d1f9bbbeaa43a2852fb6a08b0c44c86980db6b5a2a115543ea41608d64e668
SHA5128932f55b7590589941bf63cbc6d0313b517f7288bc33414f8bda39b47ab0b542a54b364cbe0f1392953a242eb2b3daa86161407eacc78e5e4115460aec5c7b72
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52883b84f4f25bfeca2cbba9b7ca960bd
SHA1f59e77c11b2fac226c2855dbde16274c3f650b2d
SHA256d811da321babc4fa5ed6193a68e4444f9de6a833c7ce3310085c7be6bbc6a072
SHA512b339e41122e001c8cef639ac6f3a69f0e3b019e30405fb3c6529c6990437230a41d810f15cf9f7b3c3a29108722840d68d81b7d79574b1ce6569069baeaa4115
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54bdda849b6740eb0b8622e7a90004c81
SHA161d578c440362c3e75e7b07eabbfdf7e80c567eb
SHA256873c0443a01839961125f83aafcb2ef737c8dfca889242717d9f85c0367efbf7
SHA512a62d1b512b479afa9475d29c22e1f6f4c7417757786265bafed5a36aae1572aad649e9b2c540950cae2f25592b25801974e254eefc4d9cf7ec5558a13b31193a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bbb45913e625c3932a84b7745df3143f
SHA158d8c4aa0eb58dcb66b3601e886dadb17d166889
SHA256b437b395f53b6c5852b74d04873867aae7131c07d7c560d98749ad9ad2baad8b
SHA5125dd8c1a777082a3b35afe0d64d6571ae1bc88c58e82c6a181fdf8833f21559dd0293f5bc2d28a1d72ee8c0c92da55b4933b0cf6107069d9455204dc1e4c31300
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b