Analysis
-
max time kernel
137s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
23/07/2024, 09:56
Static task
static1
Behavioral task
behavioral1
Sample
671bb88b3973c38edce3e568af464d1d_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
671bb88b3973c38edce3e568af464d1d_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
671bb88b3973c38edce3e568af464d1d_JaffaCakes118.html
-
Size
14KB
-
MD5
671bb88b3973c38edce3e568af464d1d
-
SHA1
74f3133d64a8885aac795893f32e8eff1402f1b6
-
SHA256
ab884c2a10e4d5e9d58439fb8273846538255c429f5d874e2fb361a233f07e8f
-
SHA512
c0fd0ceb56591c48f039c356b7542501edbda801e56299c63fe55bcba4304b87169c23cb16b0a1670a6ff5f9deb40749e194047210f3bfd527a649a5b9029edc
-
SSDEEP
384:m+uFs3swhmBOTHKQMfOxUIkXDsf5OonRv/VszPX96EsSfHRB2yIntsc560Pv1JHh:Puu3SUTqVfOxUIkXy5OonRv/VszPX96N
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf7100000000020000000000106600000001000020000000d68d16fb45080e6dfb328efc753068e84b1c595e131d9c8432738545d6cf3559000000000e80000000020000200000005e84d16c3f7535a63402e4024932873ed21aec08728c03d416f21fcb320c6379900000003a28a30fe93e7e71296505775597e326fcac93b220075e3b50bb6479b8cd31e5c37dd51fa945e7de74041dfdbe774151b68ded9d1e7c714e9c21afe3265980dff3bc4102c260553be159415e6af6fec0f783b9296081f4589e197a65eadd3d98a1898d0c5dec5785d7b706ee3fcf97591d35a2a1b5b47fe8a5d1b692096f086c5647ee786454993a7cfae58a2c7c835a40000000f12f7e13b0e017eb588980ab941cc6b36584a4ccd0d44ff0767d81dd4cfda4cd65098ea8c539c57cb780aa5099d4160fe59677b6d7888316502fff5772be554e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{226E3961-48DD-11EF-8031-C644C3EA32BD} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 002432f7e9dcda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf7100000000020000000000106600000001000020000000cdd52b13da6462e8aa4047ccbb97a519a97e2d56e5f5e18ce98e78673cb4b8a6000000000e800000000200002000000046329bc9b5f9ea6885a8f878afc120936f467b7c369e7be335832a80615abb9120000000220e4752e000d5d7504e5fa954777393bdd4cedc1818683e2a01df3fb7863f2640000000633b9848ee6a534992d81962eb0e07412f47e3ca0260cf6caf44002145b8d6b3492a18673470903c1c1a84c45e7ba398146e11d116ca33b47e773bb60e4d833f iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427891878" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1732 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1732 iexplore.exe 1732 iexplore.exe 1180 IEXPLORE.EXE 1180 IEXPLORE.EXE 1180 IEXPLORE.EXE 1180 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1732 wrote to memory of 1180 1732 iexplore.exe 29 PID 1732 wrote to memory of 1180 1732 iexplore.exe 29 PID 1732 wrote to memory of 1180 1732 iexplore.exe 29 PID 1732 wrote to memory of 1180 1732 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\671bb88b3973c38edce3e568af464d1d_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1732 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1180
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53ea5add3863e72cdb571e7b5e188b2c8
SHA1d6c0919721c64448da80fc998052fb091ba27a77
SHA2567bb6733ce07a566dfd193fc988a27c83733f5e6838c6844c834ad921c3de3582
SHA5120c2a920badf1587363163b39ddd79dedb3a3cd9766075aafacbdcdcc03ebe20388c304cf03ef772b55f0ccc6ac9b5016723a0b3cdcd7d5cb276ebf53694738b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51bb445057ae856f3c95d7d8fd41c0b38
SHA1f5ae408aa5c18c12096cecfbc84470b8645c3ea3
SHA256b5f3f689dce725e1b613ece90fbc278973c59ae801b1f7db06bb8d792e73d700
SHA512fde70a75e9046f9c37d815fa955a24361f386a23d3b7452d6c326304ba75d68af97b9f7e94685375e2ba99340fe1583c302d6b5ba9d5a4129d4088d4bff25540
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e10cc9db7304be0997adc12b25303a68
SHA136323ea7f9b2f9e36cd9a6df2511876ea6140f7a
SHA25632367bee40d7d79ddfce74d1f442cef9af6dcb5f0863ced52dddb55e6941cf8a
SHA5124f6cb48a08bdec868b166fb0a75008a59e24769c25ecba2f8c0168b4c058f7eef37ea5f8022e781c3afb80c75c2ac34d5e7859c576bec585cf34253f767b043c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5914b624603cf2ead7c64587e353b2852
SHA13a4a442d3557613287333fdf00bc463cb0dd8bcf
SHA25623dd142f599e0a9f8b672e11fd6c62b9a150ba7bfadb9d1c52805fad1f527e10
SHA51212d8fdbb7eaff3dc71569acf33d48672c010df5096592145e2027d8e5f1e91089473c2c472bdcd9ad136c7dfe98b1cda044097f7ff1d4529e47cda3028c632d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5116a96dace25cd0cee065ecb5e933561
SHA1a123ec798a7fed808de70a86858cb2fc1f8ce383
SHA25689e0d3b6a6cb0d96748718cc04151e01c4f56de02dcc620c08e10d8bd07016e4
SHA5120ce5eae2636a4131976b6428aa9c1a76401567452f35b4742f48863e9329785c3ee47a6a2e46ca73820ad2502cc4c356668d0306d79f9b4a722c495ac9bd238b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d6fc1b4c10a592bb9a0fb33133268e7c
SHA1990865fc2238e3e5c21ed378f676c19cc19507dd
SHA256f091edf16fe8148910ea26f0dadc658b29f1e7933e486583fb80393f6f8570ee
SHA512ea903a5b34f21f22ae87522a803252e12ab8cc1e26c1566eba41641a5130a6a6a37a9fc26ef9060d6ea111cdab7bec366070acb89f89b06289f27978187262cc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD511706653140a98a47afec776ba36a93b
SHA180dad1e4203682a58363c1edef90b80bfa8c33c7
SHA25696e7cadc946d0388a35f5858f3e834bbeaab4178f6a37cd701e20dd374fa1441
SHA512293d191ec8b31b2e072e7a4db8db26f3d4cc94f2f22ced4a4e9c506deed62804a3ca2be7e781532ba8ef50b92dcd11ac2895218891890720db4d473d90206127
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cf29f56749503bd80591edc54be2aef2
SHA116fc56131510ef8e45639d33923f999350b9f55d
SHA25646e24ef92273bc18aaadf1ea0f0da019b718b72219998c08bcaaf3c25098017d
SHA512dcc0581042b963ab1adcac549c870d1fb4ef9e1bbb7357542da3d3ab9fda86cebbbe2bebdf9f8346bd7348b4b4eab9682c14af35e2e5bf20a28ba0d797d0d510
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55cf0f58ceea368aeb65be5739a7ed151
SHA1018b45cd11706dd1e2eb35f06943ffe9f0358fe7
SHA25604d47732b96768d2e3540ba91441b9ab83c8d77722feebd794bd0fd1dd8a0f61
SHA5125534dbd3c6e9e9a30694e8d46837e50167e69ac643ba484de9dfa3e596bf2818cf1e8dcd27dea1c66ade381aa3acd698841c5cacc870c3effe4e0b11ce037a54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5890d738be34f747d10b7ebf6f1972b2d
SHA1d6efb554267c8afca42b8be36992befc949418eb
SHA256fe731a1eeb79175b03bdbbf103e5195f0db8d009d16e68c09ea8e7773c5cefc8
SHA512fc50867eb0c2bd41520687323eb3ab9fca6bba4a71fda0f9dc774b4d829856e43dd2d9e91ae7ec85f637686c752fde24baeeb588754d1ce14e47f3ad67759a59
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD522362f9b49104b3f8a6f647d83891957
SHA14c5463ad22bc05085de0942f27adb819405670b4
SHA256102761414525fa5a43934822fb5676cdba57fb68ef31172f97098b9f1e521c65
SHA5121a80b2454aca4b43e1f14c49a34b5157249fa07ac6c344caac3e6a1ffc5e6709d978a08521c4b252de8539820936712552184e677a56f96a43380d1e46ab0923
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD529f31673bc6041aaf4050dd0559411df
SHA10bd1f493a807cf5ef46c3ca41e1eafdc96d72e0c
SHA256fc80817e02692728942455e8d67f70133839032037a13357e64b4597766443e1
SHA512682c0bedff48e0ce0f40060066fa40bfb2d8380c7fc9a37c7f3b8b2b1813702531d9bf9831ed66864ff7035391ec8aed8e30e4e470666c4ef0c565e86d5a26fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ea397f9146fc0f57189ffde618c6df77
SHA19f435814f25fe68f709d5f15ffdc8386882dfc89
SHA25689a0a32cd298be909ff773ad9adab5c078e821920095d585d000819e213417f8
SHA51208076076a21a0c0109c94f9246f6d1b8026d0d07b582fa5dc080045a7c005d8d76ca1d4ec18f3d0f24100b1e8388902798623911118f01dae68fffaa6fd874c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53f555dcf68043a32b97a08629dabbe60
SHA1ebb3b7316a46b20290e71e2a4a5131bdc7df8c7f
SHA2560ee851a81859d0111a2340c1c86e67a6a59b24407578de78fa0f1d0e1693b336
SHA5121117cd9b1d0275edc75e805c00ea934b78fed287e8d97b7c20ee4b911ea90b025cbea07648acd85ae698652ec07d27af45dcfeeecb96a38def4619dc046c6319
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54f0675f158b10946b528cf04e01c468d
SHA1654cb8acf7dd5c58a656ec417f4639214094f115
SHA2563b2216e0df0ad0f901def8026a5856ff8bec3f36cd85465bebff136a19a4cc76
SHA512128a2b61701a3014e36d8e3b76b0c15ea1a51b69a699cca988330603aa933dda698924c6a401e3eeafa882e8e6a7af47a227731b5851dbb1cc126617160a5206
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54ff6aa4cc42e07bf94216d8b5beb6330
SHA1fd9ceb6208d93cd43fb716b2af0af106d58f644e
SHA2566b71876769047fede35c68d9c1b7245e580e37db91de6de50b7991600b0bded3
SHA51217a411c7ca518df4f58c3a5e881b74ec10450fed9311758d079e595a1035f99edb2fc706438096b3990370b1eb78de4e6a660580aefdf35626fa4696b966a9c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52ebd7f3998249da44046f3ba958c25a7
SHA1d48fbc33e4f3e580f729799161bec4b5ff94193e
SHA256adee30d7cf6c453c1adb22caf1d168b4bd21f65bfea4d4f89abd874f52cfa298
SHA512bae6345962c330a34dcc7b4882f017c194ad675d2cd90948707d41dadc18171398af2ca19158011d95b2b6664da8611b1417f4e47dc8592852515040770f1cd4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD560e360a3930fbdcaee4857405934e8ed
SHA12351954eb65a9a30e9084093d78223e2e2c724ce
SHA2565b8c511b49d29ae35472a073fc04361c60c5aade4106a1394d02ad3b3eba2c88
SHA5123bab6d718d3a97a926a09ff8805998bb62ecdbee11075c0941511e0f3b09a70492216fae8210fecc4f43ec46090e1c612edf4ad953f1a661756d911ec769f628
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b