Analysis
-
max time kernel
121s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
23/07/2024, 10:23
Static task
static1
Behavioral task
behavioral1
Sample
672fbb11f188d06d3a6206a87c6338b0_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
672fbb11f188d06d3a6206a87c6338b0_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
672fbb11f188d06d3a6206a87c6338b0_JaffaCakes118.html
-
Size
55KB
-
MD5
672fbb11f188d06d3a6206a87c6338b0
-
SHA1
d38a98b94c6ee9d3a363a731cc242b6922ef69ce
-
SHA256
0b82b90ef89efac6258c1a2eb22abf985cb8e937eeaa66b5c49f5234cc535eb1
-
SHA512
54872431744d7fa06f44b7d958a37629df5d9615186ac8f1e5257fd66bc19d989e74372039c7967ac5a20dbcd5586b4b88a493398c4ecb1d01f68a32c924ec21
-
SSDEEP
1536:SBk9hncpFm6iAbl8leszQuisSN9dWKw6Z:SAbisSbdWKnZ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000edde01171326720b35a22288a92510ef7ba2b1c4e09d0782ef5426dd13baff54000000000e8000000002000020000000d133a1ab0a5be1ac565d37141704eb70dcffc10eb31011e12d31528d6daf5c8720000000d37eec12a9e410abb67dcea6cdc3ec387e8a263824e122076d2a137bd395945740000000cf04d6d6040cd390dfb56971552e9c1ed07caaa1c7f508d7629dfaffdc1238427283c14a19bb93b27359ca2cbd46bcc19168452d555f53c5c22267c179d74a3a iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000dfe187fc69bf6c3d12955a6ed69a54e3bb60d704a13be5b2c7acd9149996c88d000000000e8000000002000020000000fc7d76aea9fb6918f5879d571dcf58ad76b4d53dbb40e431051461a1f5c767e390000000aa15d119e53063733f3a6d5874cca28b92312557101d4edfc201bd11194e9e69da0614177e2a06fdf0c6bbcede3a14d7c586764edb2685e550cf9baf46cd1b6f631844eb67ef094c0487e9c54731f8ddb9107453ba434b10447e1514493faad645149e77d310f83b4a34e4d1fb9cc4a7f0dc9772d66bdc6ab585d62a6d92f84067e87508a3ca87bd94cc036e3e640c2c40000000dd27d37f07c57c821ca47c7cb47f1ef8880b19c709848f040b6c9faa91932ae73b3004e294ec42b6e45c85467d5e0d71675853e2440e6c9377581ff5e46fad2a iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50fd7c56eedcda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7B4D9C21-48E1-11EF-BD41-DEC97E11E4FF} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427893742" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2332 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2332 iexplore.exe 2332 iexplore.exe 2800 IEXPLORE.EXE 2800 IEXPLORE.EXE 2800 IEXPLORE.EXE 2800 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2332 wrote to memory of 2800 2332 iexplore.exe 30 PID 2332 wrote to memory of 2800 2332 iexplore.exe 30 PID 2332 wrote to memory of 2800 2332 iexplore.exe 30 PID 2332 wrote to memory of 2800 2332 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\672fbb11f188d06d3a6206a87c6338b0_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2332 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2800
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54b867589b3a17e85ca792ae51091fc20
SHA113cabf57a1765a72409fb2af5aef1e44b03a1c37
SHA256ea0ccf5ec7fa3704df89384c1c7326c4787691e996029d911afa5374475d3631
SHA5121b01ffbd99bd31851dd05977fe074740242d6252266f4ae7e210accd2ef2b6bfeccc8954b516c46509e4682a1c8f368502a9a71d1e401881aead2a0a38d3c15b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b335523914a466983f1c1b899b30dc14
SHA17a32d0df5c29e111743a5fd728b04c9717ff3e9d
SHA2563cbf31a59d54848b30760a31edbd8f746228c78aa047055ab7ab9bfb19c49493
SHA5127eba9b9e5d18ee32e6d5742f4afbd95056b89dd3d2cff6ca37d8421ef8792ce0e5bba70137cfd16bf173b37bee7478905fb49ed01ad3932d1c2b86e1ccc7a6a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ec4639e5a0c52621db5b2b10034d6005
SHA17e654ef03b854d3cdd6437a6fb08e90480c32087
SHA256bf7f0e1fe4b065c8755ecfe63dfb926bc690a0b1213d1da27faeea05e7ab669b
SHA512c3fa42c3a9a89fedc5e0a32e6381843b6c3c61941be01c0f419f281c111ab73b1bf33712a0a9d30b8988a8dacd331a4079f438ba72021f551088eeca6e4a9afb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52441af529c38fc5b3f680f80fc9039fc
SHA127e785b8dfd41e088a5bf047f44f968cd310d187
SHA2566931c21805d82d22c9ef23f2b46ec421b3a1162e0ec049f7492bd6f6491f0cbe
SHA512ce654d562eadb4d9385a2fdb9e77f5729dce6e584eb3db05f8d2d81c58808bde25c9bb3a4a4beac920b2d3e3b377995b18057015e498a26207d1736ad38d3233
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fb5e8cd47281694c8bf48c5a5495c5b1
SHA1eb8ebbab75332dc60f3896fcf1ab87d80de27dd5
SHA25601d2ca7789e811d500d8b528257a7c5b814afd6c19036e6ce8cd1395cfe7d21c
SHA51244854cdf8748381d40a9aa0d260172146ea84524b1184cca6fd526a584300d8eb4908a1cadee0f249e49387c4fe78d96bdd1e466ebfcec139b82b5c994e2329b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56f77e0f94656e5eb1f03a35007ea7d25
SHA176044040b5ef33a53518e829bb7f6473caa7bfdf
SHA2561b0909883692dbe4a5af7fc7841fbd9fa1fc9eb893ccde05f99d97e2dd8b4fa9
SHA51234b6d1186a8a459f6c9c59319e460b5f6652ad6f9b926e2da0bf7f509cff272b0f8301357f181f6da710931da08208ec2c852b4354214616d8367701d5b99cac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b53b4536d476d3cc6a4d0d553ad3398d
SHA1d1ad8d3b963bb3c651773ac0b20cbce49108cc2b
SHA256f79489875c6b8f55573a36c0c65b634e8f2d2867e04890186f957a4e4e75039a
SHA512dc0ce52740791accc2c4e1fc04fefce435e70094a923921df1538845688172c27ff86d1d9a1627bfef5536bf997262d9e148201c70f98efa7a91eb840cf3e597
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54e7e176141dc7f3003442c62f435fdc9
SHA1731053e538c23d7632945ce0140631c9ff50bf52
SHA256bce1c4bcc3562f82c245662eaaf3307688981660775bf5b80b7127257b610d87
SHA512fb3fff50100c717039fbfda7cabc20c7489b9346d0226f8efbf00357d5e75a6a09dfbac149ea319d9aee775567e58823ba67c073999a8d4b9839d3b576627e22
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ef9e3f93486029fc0caa3362cc510b69
SHA10a18e42f4b4c7dfa4377f2ea79d14e814e32c3ba
SHA2562ec3a36d1ad1614c78273c7886e208aad5b2910e31fd3d9b5519485919bccf2e
SHA5129b42249fa7c3d4b5e19ee901ef55a8008132304895437ba58ee1a3b708692bda6cb356c7f9860c1d3669422ef5850bef4a5060f463736c0c43291a9dfcfd93b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58ae1e155da312186b4a9091639810f25
SHA1c3b32080a77462b34b8719b254f52d8fc9248948
SHA256112655d245cfb61ec55226028e2ba41d8ad1ea788d00918e22f73b6b1098341c
SHA51215cc23916eeeeda13f1cb69a0b797526e7446258c1aa733012a33d753f8bd5aeffebe51180d4c987eb515003e9a175b26cd72760f0b13b02c54f7df6517d939d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52e194a4216599e54b7e3ea4a4eb290bc
SHA1627d365c2232276b2343ec71ac885b2978efbebc
SHA256e71544eaa67065fd11b4b7a6e90c0e7f1f8cf91a0055bed555da24809dafd9b0
SHA51209c03fc57497ea0987dbe1ff80bb677d6ce686bcf9bac46d7800d7689e9d8fd7cb8708118546ab8a233a176bb262f23a64f9b6394ada6d03ddf34487e281d8f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5019ec3cf8bd7e536e455b36e906c8d8c
SHA1b09788bcfc5c47a68c8fa662cd15a993df31b38f
SHA2569dbf8c10cb97022acc75c9e83d73af2e7813edf68aae9c896bebbb5c7ff5018b
SHA51256c3d0c9e21e57c34e4ad3c74bee5355ce1abace6f8589a1a65daf9ea70bf47fddc8c318936b4e74bdb6c73d5c5ab65d81f49c07dd32384bd072b2138942a151
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5564cdb88f7ffb83ec8f56047d485ef4e
SHA1f6c4c0fbe304c8b382efc737d614ed6a6eae9eef
SHA256da1492064bd8fcbf906861b9d8f82abdabe83edd333951b7e2d54bbdfd58edc3
SHA512a482947443c52b9145ef5135787350c0f87fab959b24a45771f586e81798b309a0866c589da82c46c42acff708f01d2870b6dbcf232418842586fd6b2c819ec8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50c2defae17f3cbe5d0c55421ea6d15a8
SHA1693df0fd4159fcfff80ec35357046520d0eab0d0
SHA256bc2acc0620fb34354d34497eb92fb845601e8db320ddcf4a6d516a4619803924
SHA512b6b272c408f52eca2d64131a000446bab753a1a0e43bc91c5a7bc6111c5a6fcd67b9ca59d2245155f33fe8a11236275ed91a99d6280f1938be33cf002d5920a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53b1664a3f05e944e6e343451e3981a68
SHA1d90e1fa1352793372fb6d17089c7630e7b7b07dd
SHA256706fa6a21f83a24994481b0f6d84c8d9c496609208a850cadd7f9edee0ef7402
SHA51272b77a1603bf3147a769905cefdcb4fc527ae3bad043a6fb53e8877fa91b1e9c5f46784c82e9bbb829901f999c01a80b23bbeace864faf9a0fc18064d1b0a538
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ea3978eec6ffef723774416bd354d147
SHA18737bba0daf3b3e4b42da01ec63bb3260b8bb763
SHA25664a1d65571067ff2f0d468356302a3decfb17a0be7e0badf73fef2ffb3020f1a
SHA512c6f1e7e45e890bfd4bc31348574b660da75a3c714cfc42c199906debdc03ac89d32a449bec3abec5827242e8982d346d99599d254ca2ecef5c0294f9fe57a2ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e301abceb007bf482c994c6f1883fb02
SHA15b8f8a6ff20403753a9cdfef5f82d7d18fd4dddb
SHA25678442f90ac5c08b3153973640a9f3bf579501a58f885e481ac44a85bb4ee8113
SHA512bc664af9ff80653286f234a3f4622413418564db9c45e52b657cb28eb30fc1b1ecd6479c190f7c507deea8f7b0a0e0904af1bd72665f4b49f8db3cbeacfffbeb
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b