Analysis
-
max time kernel
135s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
23/07/2024, 01:41
Static task
static1
Behavioral task
behavioral1
Sample
65a78990b5f9d849cd9cca5b444ee898_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
65a78990b5f9d849cd9cca5b444ee898_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
65a78990b5f9d849cd9cca5b444ee898_JaffaCakes118.html
-
Size
44KB
-
MD5
65a78990b5f9d849cd9cca5b444ee898
-
SHA1
89b8ae3aaa5cbce9f8651fabc5b5d20d18ad644e
-
SHA256
49300a28884b893dd58168eda8d9ce0dfc8094cb326853ab7eec2834312d38b4
-
SHA512
5f7dd7c6a02168336f1536749b0206ddf3e6ff6eb3623e3ba1708a87641ce213d057d054e644c1c0c2608d84607f1758ef8ce57bdb177b5dbd230fa47e2cbdf3
-
SSDEEP
768:3hJuDp4ReyjRa4GQ/1NYNRzz2qYSG9+/A:3hRjRas/1NUzz2FSk+Y
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000000fa84fdc083999fb05b6bb6b8bd815a7347c441830aed0c262ca0ea59c02d957000000000e80000000020000200000002cb6456fa1afdd0e00f2423824428c352c3d25cfce6105362e4a3d6543003990900000002640c55ade723ebcb64e12a633b03f7390356ef45ab954f0dd98a55c0a4147ab215004590e1b2530b12be9c38449045a9b0bce1f6645fd3280bb7614ad1bb25b8c5ab527286da187012bab5cfec46a415816860f6d3b13f9ac93e95799324fdacdef6f2ed9c73e54ce6b2091f10d1aacec2b3590b9bee6582121658d7517147e3b94cfc792e73d31571f18dc63d2df3f400000006ea0f430b37bb9abd41191f2b229201274632282be4c3c522c8b699d3021e418916e0c19af7549ad46502ff4c702be4207b92a7c7a81fd101793872b0bf66b4c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000008dd02eaf27ed1043c2c3fec78a6e3199b8238fe3b5fe4a36fe4c4f4a484d7c72000000000e80000000020000200000008f53368e4c1d9ea89341d427c84f09ddf89b5848e64333de86d46ac1c6ee78f820000000617d25ae0ee19d5a84e72ae6fbcca996621ef882d16123849373144aa5b3f0ec4000000046d74b52517e739698e10c7a71781717bdbcb4d24b15b89c022e418bd8fcf24470e2cda0d7792155d276721dad9596d7637feda29ddc9c126d0b6742f09cee9d iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427864969" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 306dca51abdcda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7CCB5DF1-489E-11EF-A69A-C2666C5B6023} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2148 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1952 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1952 iexplore.exe 1952 iexplore.exe 2148 IEXPLORE.EXE 2148 IEXPLORE.EXE 2148 IEXPLORE.EXE 2148 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1952 wrote to memory of 2148 1952 iexplore.exe 30 PID 1952 wrote to memory of 2148 1952 iexplore.exe 30 PID 1952 wrote to memory of 2148 1952 iexplore.exe 30 PID 1952 wrote to memory of 2148 1952 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\65a78990b5f9d849cd9cca5b444ee898_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1952 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2148
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD526bad53c610ad79ba2614372664506ab
SHA1096f681b76ed43ccc396b60357ef1dab8e125706
SHA256a6035aaf0cfe4fcae0aaee70d453d8e97444fec6bb2f8b5dba7c9a4b0170db81
SHA512052d0b07448edbd04485b8c60e0792c20859f5fd099525359c58218782cd40f3791e3fcaaa941ca826609a2bd3bcab1566b031405b058e42fe074fb4af5a0468
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fce250c24dd9edc4ef26ecb080a6d0ff
SHA18a3fdd24b8627157ede80e232367281d53d8312b
SHA2564d86528040b811f215b75fb8c328a4d936dec4f788a6f10cafa2f728a99c7119
SHA512223d42dd21d1fe186195e028867f27e393b52a44d5a02cfc10e02d688635a7b895867d8909835e3b2185eba193f10caa12c8bd909dfee0b44c067acb525b8d94
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a32b9541a376821003446b2bc2970769
SHA1c874de657080b4680ce8435ea5231483ecab6258
SHA256a1e4084350fe4687afffdf7657d287ba403591c9e28608df2558d0a5d7b13522
SHA512760ad0a51c561a7ea36c9ebe0ea8cebe9f0d90463a32a75037be855fe67e1a3ace1db00bf121a3d421eeb80b5180a4e8aca3410ee7582387170105efd2a5a453
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ca02019d4214acfa9d0cde8051fe8ac3
SHA1e56a3d3ba3a7f7cd9aaa637904e58e75682a68b8
SHA25607cb7f3d409a2783bee7016516b98e9bb3b38692db31c096992e201e99453c89
SHA512d1da505a1a6678824d838187b5409fb69129488253ee01c4adea5d3f29635a37bf15cf0525bada0829af26ea69e160e429246bccab8c4f01d29cbed52253882f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57db5d95649ff7895abeb630d6709016f
SHA11b78948f683564e9b5a220b6426eb4da503b478e
SHA2563631686480d4998917deb1cdaff784c66b3286f144a44c4168daf6b22975c638
SHA512144087e2e5b626cef99a59ab0fdf3e7019528af1fdac7a87e0f54b58b59f141e8502b240c88e5dc81c89bac2795538aa7ade663130fe484699995ac1ed1954f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e8ea89c95d0b5d47096e0287f7c04d88
SHA1e65296c35f55e62834e7e838195aaf338bb8144f
SHA256919f089ac0ecf3a62a836b852e476fc721c2a83432f0ce2dfc7acc8143625dc3
SHA5120299c81292c0466343552baaaf09470c3c2165c83509254de362ad90e948aa113c5f4422fe184c978f3cc47107cd0c893ef36a9075618d90e06520d34d36542b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52ea133abc35523ab9ef81db14e1d2b62
SHA19ede82293aa9795f72c92b767936b501b5816c4e
SHA2563525ace49aae09f3d77f45dd6190e485696d27f254f1c6957bcf3b4158f85df4
SHA512b62b884c894030a0392767ab5b956fdbf55e545f36b617ac50dde4ef1e671519b65d53401b97281f37f2c150fc13aaefbcdf6a59dd37fd72624cd86823a3fd77
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5537a26f9bf2ba2968d1184e52d2ea255
SHA19eafaff509750f60e1c6b4356712e695a97ce585
SHA256d373d394685c91610135dfec8eba4b1ee9c3889ccbd57e4ecd2354c863759799
SHA51272b9c3187139bec03a8de1da1043bd294f36536bc04e38e9f1d3f978b0fd6592207efdd271377d6695154d7e5772f34735b9cfd28b2499b18a5f924a95a4e081
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bf8dcd73b27a151007311714fa6169f2
SHA1ea28d51e73898601ac193dc3abd83fb0fc0a9dc0
SHA256ec20820642392abbe7479ce39a1100d25918c230b45c7d9cc92a6c416daa94f1
SHA512f46df17965062b87823bc911cc85d8e23a342003cd010326c93b052343c00484baf2f1ffb337083e7f05509c0d365ce541106a9ae2dbe27c831b873184030c80
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ba4923fcc6cbedb654a22802455e9e74
SHA1c5403aa482dc0f4e3396ecaec0b9f4053b422bdf
SHA256a36b21931b2687ac54b2dfd97388e0861a7e488150f73c4a559eeee403f19b4f
SHA512a06a1bf9968c8513d3b1bc415573f96406eafae4fd623743e4ac5833cea5b8c1445bdb832065e31a2a6f3a06d56ced7f278001fd0a4a1a1d3c54478518dba841
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d753f6ceb5f4a3f8b720ad4c699d7911
SHA12ef002ffe7e948d85ef030427974efef78b2f86f
SHA256c8477f4e132c15d377dbd3839973c4cc30ba84238425f11df59d6e454104f8ee
SHA5125225e92fc24b5aae54473cb7f1f02075bbd2c492050256c54057553b8a022c64076cecded20405f179a2a5a95fac29314e1a1286ca559cee96a75fc402f11808
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5820a7535f8882d740b2098d2f9408861
SHA170e63f41c57981b8c9220fe2e281341d4fe918f3
SHA256afce1fbb9c2f23b5a37d84e27d5b9622d727fa1238b0ff18444d8d8e009f9a33
SHA512444cbb3dcf091077d8c1b10497dd979a76906cd8b0720995d41b14b38aaf5882db479185c9d517f6acb826dbaee25ae310d34d3321d0cc68b7241fd41e489c58
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD532988e31dbaa218fba9fa62e81db633a
SHA18bd4c56da6943c88a638a886e10e23c6d7eaadf8
SHA256ebb538055f177502ea54e661e1c3da21d13ada1d3856a10411094d5ffd4e72d3
SHA5125e3c2b18f2dc465be57c9f5ac7af3331d7afb0458926a9d7067019d6b118a4b1d3334110fc29a92f988c3c374102e19a7f9ad2cd7e278066854cf1c1c6212f4e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a441ef6b268eebd937c554f8e56a1866
SHA1bc0a3389ee6bdf8712943aa5feb8a17ea370d306
SHA256308f87dd044d1a5124b1c6b2c26a5f696207bb7d5b1a37841116ff70e95cff23
SHA512943e4e4c20041620bafba955a93554b372a44e51e82d7659a8529511a012ba98b5a2bc40c82e13c49f60aee4821af2aa705a073f130a3f3b8e40d98bef27c2bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53c9983791af88820009678233555468b
SHA10c49a954928ea130333240e44c0ee231175a23f1
SHA256e0c81299a34b444e86afdf4232953b200f6f2c0df7ed1d90df89386d05fff34b
SHA51264fcd3f3c8bdd2d32afd284c4caf6123a76f992196d3834c8d12d587dbdffbde43ce07b760bf01d57c79d58a894731c2e93b06d354dd32e4b233429c06097adf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ffbe73902c607fb48638f7edde1e3544
SHA1c5f48fb627ecf0cf8ef9b38d2394170fbb6db615
SHA25601c2f1cd9957c46e18ab61d80e4b7549e86e200056e5da83c38544cef0b36360
SHA51280cd1bd3d9b0f5f9605da3e77e2753223bab936024154543ef6b80686d8150518372641b7e55f77ce3ccd1fd92d220a392936946e1efe2bfdb41b026b2566705
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59003e6411e13ef13b4226710935f2e94
SHA137a28e6c69fad90983ce4645bd2ce945150c0fb4
SHA256be8abf436b89dab1a6d94daeee7fddd3249fa28ea60d3808addf4023e9feb873
SHA5124df04f62acd2aa0ceda736d3923c15984eb59c27f2f75951e9640d4575d5b3583dabbaa7bae293485f7aece7d541e2441cf5ae44197ddc5a37fd23db3ad68fa3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD510579257e0dfd18cef98a01ee8ac3d1f
SHA1d8a7103ee07d16ac8b7af319d2a531201976a3ca
SHA256f850432bf96d2d653d09946df0ab57160b718acd008a4df78f8d1018a5731286
SHA512ae5ef11b7bad0db7940de17d1630c47ae599ecbb0a8157869308b02bee5881cab654028bf5a48bb7ec92abba72e7da8651e251fd98bcb6e5dc6b9675b2983d11
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f43db02b5521724481964c2ef748c275
SHA11aaf3ce2f1b90342857f73e83572d850aa9c4a09
SHA2567cad25d128aa9956541f1198997723efa5bdf48b54d99217b1279d36da5ed331
SHA5127351e9801170a9a718233e1acdb88f71d0202cdb0e84ff1071333b4b5ca94c43ef21758350d69ea78a0948cb174089ce18f07695af91bc92bf5bf5f0a74a1987
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b