Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
22/07/2024, 21:02
Static task
static1
Behavioral task
behavioral1
Sample
64cb023d6706053176c786eaab11ce9c_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
64cb023d6706053176c786eaab11ce9c_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
64cb023d6706053176c786eaab11ce9c_JaffaCakes118.html
-
Size
10KB
-
MD5
64cb023d6706053176c786eaab11ce9c
-
SHA1
436acda49d5d9dc6ccdcb7332b6800d0e54b5727
-
SHA256
a38e18b9f9724714ba3c315f136c0c8ba0ea66fecad7ba36983c9b56294f9777
-
SHA512
4543d073fe1508b6da4b945ed55d262038e6d0116958899f84052a1ff4958c1f25a2da6327e96dde746f4545372d5e19f4520dd39fa14386635e07e6cc74a397
-
SSDEEP
192:SIjlcty9phIwH/3xVyhxI4UFpMKQ3auLNBLrzTfHcP0efBC8h4XvAmTb:SIwy9phIiSuM53pJNrzT8PtfB2f1Tb
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb78000000000200000000001066000000010000200000004cb2e9540fc86570668b324722069af33de9acc2f71ead932f23621f8a2aff82000000000e8000000002000020000000b4318586f83c3aa2946fc974b764c57db103f671631d95ee6dd6c81163f4ed1690000000387dcd8a42c357bf21a3baf24f6c2c2b616b582885de79ce68f04edf6cb2f92c8963df78623727bd48bf2c5cd1ad0de69ee1ed9aa4dd45a30a869291f78a48207c431bfc1968ea511cb82215e94ba2a8424217ab27470651b0e86e575c8cca8a29e64a55de9453e5e7b5655a5b09bffe77026fe02803286d8309774d25ab7cc0d973d7490bcd8e5b2422c08b18217ebf40000000053e1669186c59c30eed4453ffca1178d8dfe22a0309f27cbca9fe80d8ed9098a8e1d7e8d7a790ac38c895a8cddb37cf9e49907e51cff8b1341ea308e242c25a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427846731" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e00488db80dcda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000b158dac1a73b3c58574aa442125205bb076eab75961931fa7832976cbd848af7000000000e800000000200002000000068d39d9008171c5bc4732e140d1980fd6e32d3cdb8c3a3b2ab304dfe8ac8270f200000008298b4160ac92adb0309171819caabfec525fffe27b237d9254e9afd123ef648400000006df295ab0f8894a233844a2a09167b96458fcfac87eb0e4125c31f56f14ad073dc933b5695663262f697eac5d79ef07d9991aab98668d8d954ad7d281308696e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{07103E71-4874-11EF-B903-D22B03723C32} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1596 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1596 iexplore.exe 1596 iexplore.exe 2748 IEXPLORE.EXE 2748 IEXPLORE.EXE 2748 IEXPLORE.EXE 2748 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1596 wrote to memory of 2748 1596 iexplore.exe 30 PID 1596 wrote to memory of 2748 1596 iexplore.exe 30 PID 1596 wrote to memory of 2748 1596 iexplore.exe 30 PID 1596 wrote to memory of 2748 1596 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\64cb023d6706053176c786eaab11ce9c_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1596 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2748
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD551a1a814130d62c13e4488f37089116c
SHA1a1164dd564fe1fd1670de302dfb948e433172d9c
SHA2560b40c8aa27f203b43e3d4351227a2b955ce1d88cb0c02a37c515408ad3205d8b
SHA512ee2abcae88e403cd41ab7ed73431758cb40d4f2c9246a55c2226e06112f292c810b8a828e934e5826bf5d8e6c9445abc9eeeef813a4c17fdd9289a61e9fe2595
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50f80a4bea90fd4e8206b0506a80f23d4
SHA188c9a58ca0421b265595a2f899b9a76c83dd3e5e
SHA25666222f2580524a858b2feacf5d107bde7dfc82177543aa382703345e35d1da4b
SHA5125b3790a0deaaaa361d56e07b60b2fd0b79ac1d6c722a4769206ebe26334b227f131d0d4724597122b835c153a1e080ef4b8ae97d0ed8591ee07d73a883ce1528
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e81f48045a2608f5452c068abbabc1ac
SHA14868beed67de9ecc9f7c7d48b4185eac8c14f954
SHA25667f0b352d130ba644854e21b1f49cc44be80232d2321f46382e52754a5faa212
SHA512239bb0dad11add5b66e1c26f35ac91612993d0bdd64eedaaf279800c84363660b090030a776031405927fc0cf0918fb12f276b7b6eff8de351fdf92d07c55b52
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cbba75cc821cb37a2155bc528989e514
SHA1782c1a3be809fd635f111a216eda950ae0eb32ee
SHA256f2afe0ea75b3aa392b3d297df7e2038674b17b422c0c813ccd1f2f521e5af54e
SHA512438fc1ba2f0933e7b401be4026d0302bf4782996e4756317623daee4845708478adc4f0bc673808da15b3c0e901e32868010ed53d903ebca1c9ca81af1ec754c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD573fa8c6a40cea903a6b7f440a5b602c2
SHA18460642d06bf678d2dca04da18dcddab5508016f
SHA256da35ed80a785b8d2dfe946be5a10c671bdde3dcc9233e916e01222a51820138e
SHA512ce3dd4e2156c77c623736d5852e0e8c495aa4a28c6ac3cef5d4c94aa4e286ca54d481e0ed0df998935eee008921c026722ee13f11db8829bd57ccdfa4eba0e34
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD523b0267e29b2f63d38b1e9a7a6733247
SHA1b4d1fa54d00982ebff15fd8fb2a2d078c41e12b5
SHA256d82fe1755045c42c3b2294dfc374ba08be067e296ffad3a3b62b3eaa91d26811
SHA51223ac3a065da3bbdfe2f476b02ca73e9b521aad60fa6ad8c2ead4b6de0dd05816c4329ee9e3146d3752a6f2cd330babbe080f3aa74e7c9194d942f88adced392e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD533efd9f40fdaebdc2148024cdbce71ba
SHA15d6271cab7661a0f40e2424db22dee7aedf7b4a2
SHA2565430e8682b6ebbcdf05991bd70eab5313e0369c5634f8852ec99f2fa66c0a8b3
SHA512e71307d38b7d79d497125561ecaaac38e97b57d2ebe4d2082368fc84d035dae31b9d6eff655bdb4daf1101140cda189d64acbc71c5c6e3f15a8b7cccdfd1ccbd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f2a5f96a143d9bb638eda230b30dd49d
SHA1130fc585efc3b1801e479b7350d2b82a24b80750
SHA2568f227187ac3d1714892ecf78e553f73937e6fe018061840a60e416908dd9abb8
SHA512878a40b76516ff599800c4200a79ff7d9e4d7289e92bd56a667c0593a90b515497fca84f2ddc80d3edc24eaad2b1689bb274ca4ce6da94a62fb52d2c7cdde607
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52c38d8975bc4750270651a112edca009
SHA1e8ab9beb50fdb99732a5bf04ee71150b7ad794f2
SHA2566e4d55483807242710ff94088d17ec4621603ea2086445e1d9c216bd5d6109c6
SHA5124a111ea54eefea1ad095a34c095bb2381c8cde02292c4072d4e375d55022dcbd0ac3e287a6d9e9766d209a60bbbf9fc201dfc3c737a61f0c2db74d8fd73ae14f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD579fa00d08b92e7359c4366116b3c6da3
SHA14f0425199b59104bccbb4b9204d45612db60e61f
SHA256598e6ffbdd5f980abf4c60fc12e33f5fa443a788317b6409e2538262da835732
SHA51283ca3b6a9f92db7c25ccd7207f2587e624d4393d25faa9f0eaefd8b07c983c0268192a3540c540829054d4da662cccf902134985024ad73f6b28128bd96de6dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5032e234d8478096884bc39c606b85364
SHA1a61803eece82e4af220ddc27509f60f0efbc78eb
SHA25696b60136a81e8193da3250918636d7ff8538fa963bc407ea8f176a96ef7d7283
SHA51204b8821769019fa63b32c1a8c4110382ed2cc56c54632f2b42d49dce488700820f4696fa90894065957f2140b9f61de5d6898a96761f6b4f588c1ca39c119af6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f75761c9171366e1623e0dde689c158f
SHA19dbe1c8108457ffce449550e34a015277a4ced59
SHA256b99487f08d85d47b3c67301bd1bf0a9d7a73b377760a7a24e22ca3a765af0f66
SHA512ca62304ac2010122a048138189a239a74b720b0c7eae24d59db181e581bc4088525dfe6280962a94831e9d8b56be8841137ece9e8164e322cb07d0da54e037af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD567d95af322c6810946d88b4c787cec94
SHA1209ac7b9fc4b616b941e5e9e20358ac1ef3f6542
SHA25688d623fd7d3b33ec173c7a6c36768281653fb32c4869aedf58638b6c3864d434
SHA512145de5bf826e75bd22968e5e502b3440136f8c3a47493a7f75ee15d50ef68f9298a968454ebfa586a1c66b041c889b9dd29571de3d34a762a8f943a0c10defca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57595ebb0c053975878d98bc16b1498e0
SHA15e08829a9f1c7b2fc324d2fff9f8db2a331198c7
SHA256b40c04748f4ec90ea3e86e420fbb95dbbb298f0ad8db9a91c5132b5d8e73c808
SHA51212750e7d94ed57f3c3769db080843bedcd7c0db3795b1f58a08240039e0200eb70df12c9b00eebea54b268770d0997e8e76d4e13b7e614352e4175626943bc9f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cfcbbb1f86c9d86c18f34da63128856d
SHA14bb5b8f7d28199637c797d7c4e6e7d7830dd343e
SHA256fd67029ab07b4db52792982c25fdb8dda06e13a0bee421132a9ab3221c48d70e
SHA5128860228749ebc18125833b00d94ef3f2347238031cd8fac3f2764691e8d461e1111e365b85801aa39e3b50d62ce026e4670d99b0d1e8497f5d968c5d724108a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56e24ee680ac20f9fe4ee1e64db266cd6
SHA12995d3eb5339f83552ec6c21ccc90b85bf183663
SHA2564007194c6fc5d2160e8f2778d0d6aa4f5839328fd063155c8213cdead8ae070d
SHA5124360544ac1cea6be946db131edcbe0e82fa7ae977aca7a80fef5d3a76272a9db3c4a6f889d9da78a94b2ab91f85517039ff42824ee2a009ac3fd3e750470e4b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5661ee502ffecd5f1de76d81a38c99319
SHA1830c7365d0d674c4dd038047e738343ad57462e7
SHA256f9236f74b18ae3c562cf40008d74cfec35a130dcacb069899c2c5dc4b2611d48
SHA51231b68c8b3a1b04598ad2175931396a8e574b4842b600471a6c504ba73ac0e3716e1899d91980ddf55427879e7cce164107baf46f71ddbeb5a41aacd39a3975f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a1da8c4be549dd49a392bbed3e5ef4f0
SHA18f3d069f67c003bfa2a503b1eeadbd357008db73
SHA25682fd60c2fda33fe6e6e60a95dd6a8f0f1bcb8dc969e20810b13c2655dec84829
SHA5128d5b45648c5cc6fac843002695f89cb7cd4c902c590d69215beee09a874042f8ecc059539d3a4ad71c821a30bcd467071408f9e4742ae2aa8569447245226327
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD518a22052c6a5a69df35f7935a1577825
SHA190814c2fc179b1e4e4891bd0cfe76c4a2af5d1c6
SHA2568c17c81edc15bb8d6408bd49f91d350c2d29f7898bc112839ea55433ef46c859
SHA512dae7c008c90d2abb358cd7be2ce4c2c484949f54ac4388cd37d870eb87d1f6df25eb0474798e4d4a0e444ce9dd0aedd771b8e5631b32be70912d9495bed216c9
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b