Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
23-07-2024 12:15
Static task
static1
Behavioral task
behavioral1
Sample
678dbe822c6556c5eceb652cc487f243_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
678dbe822c6556c5eceb652cc487f243_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
678dbe822c6556c5eceb652cc487f243_JaffaCakes118.html
-
Size
39KB
-
MD5
678dbe822c6556c5eceb652cc487f243
-
SHA1
8481c02a9c04c7e7640a7c2cde03b24f4c284c3d
-
SHA256
aae775fa0fcab6918e3d6a3f2fd4196b6fd517304e7389f2d084321da98ead59
-
SHA512
3f10de97fcf4e8cacad89cb530ec79b693d242e8923d910129c632610a573b0401b5956a374fcd4beee2a6a418577eb9c7cf02bfe6d3a2e28cf9a95374be5cb6
-
SSDEEP
768:GIRIOITIwIgIlKZgNDfIwIGI5I8J7SYIRIOITIwIgIHKZgNDfIwIGI5IvJ7S87/E:GIRIOITIwIgIlKZgNDfIwIGI5I8J7SYL
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70cb1577fbdcda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f0000000002000000000010660000000100002000000090e3517d5d51c2cfb9380b9f1aff4e34034803a8fb15abc7cf6694f59e87c4c0000000000e800000000200002000000023f1ea86719954ade71bd269997a3946b386f9254084eb46fa0719628cc92dbc2000000014b8332f82c01c64cb0c234d7ec478bbe2e9643eb7d2f9e166fe47fc1188b1c74000000025e01cebcfd61b33a0c214ce2ce84eccf60c7aa00bbd512e6cf1e1209af549c3e14e7efd06a94542e7a3adffb3b74a0bbed5ff906429d2439ed8d44a477791d4 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000987662f75617f9876d4f8bc68c688251b0756844e01c78678bf24c708f8e999c000000000e800000000200002000000066279a435794786db5cfb675e2c0fc964c3baed0bba8e2e45cd8a72344a779ef9000000000572d8c49d0cc4ab8008bac8fa2b566f6df1a7307dcb18fa2b7af22ff9f045ba30c2e8722c9227787127b4b06fcfb9bf24ceb7756e79f23fb99133ead9994f45fe6e5c828890605e458a5e12bf919e40848f1ab4c7d2f7494bcc60289a8f6a2e734fa746f7ca3f64b2072792111e09143f573456aac1df832287a5da4a5cd89cc29e72a4b4465c3ac756a9cb27af2ea4000000096ccf2a593da6f567f42023f96248f657e3330ca9ee4eda7a7a4bdb551898db063e4e3c1835c8e12d31487fbf150af50a6694ff969ea4161c349142cc7e6ca73 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9FDF8141-48EE-11EF-99AF-7ED57E6FAC85} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427899387" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2128 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2128 iexplore.exe 2128 iexplore.exe 2592 IEXPLORE.EXE 2592 IEXPLORE.EXE 2592 IEXPLORE.EXE 2592 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2128 wrote to memory of 2592 2128 iexplore.exe 30 PID 2128 wrote to memory of 2592 2128 iexplore.exe 30 PID 2128 wrote to memory of 2592 2128 iexplore.exe 30 PID 2128 wrote to memory of 2592 2128 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\678dbe822c6556c5eceb652cc487f243_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2128 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2592
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a02ec4534b1787ed66865c1fd4d58582
SHA19b2bfeb6b6a5a0451d1d38e6a45c4f6f8661e5f6
SHA256f702a5d2fd8662af4462af957dd706981771ca53825666a6e00b6340d9fefbd7
SHA5129b34d617090b68f646ea827f1356c6fa8185aa59ca9b8afa8f1ebabb82ee7323398696b39a33981d9f9e91adb8b493f72648da1da2ff8627d588cb12627c1842
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5524d94957445350a28eeba5e0b6aca18
SHA11d550a0386496626c6f8a2fd098119ef41ddbbcc
SHA2568ed2e619adb3cddbbe11d0d3fd00f8ba8103835ef3620a054b311e06e95a823d
SHA5121d6140f726f4d4f4bae8779c0bc1eaad8a7f4508f913f1789df90c27c85d85b13b9fcf10c68aa48cbe7f6ca3926541a0c9103fbbfde77aac6cd42beef8bd65bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD528bd3e738bb6f765d8e2291155133b48
SHA1448bebdfac42783b581617df5f98bb4d49af2c4e
SHA256a01f9fed80583ebc489ac6b49b7d095113d2422367eeb76ed9c9f022311ba82f
SHA512e49a2df5cf1e0c777f260db338c73cd3d303a00ac70329ff40b34b2189529b46ab80da5bc4eb396ccfce295022e2c11a239e36936463f5869b0959d3e92c99c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f20654a6f2abfaa921bdda840bf371b4
SHA1d0e79edde3e22d1c87eebe4dbea4bf0a203bd058
SHA2562339062f97c5d43f2397c096481d005c021eaeb606064ea598faf6d510f65ff1
SHA512c7c2ec9ff3da1f7237ae4b9da6071a4122be47539d78ac5c429b7183be5dbf4c753a879fa28e8b56a386f324fd382bf4b87caab678dd66a7dfcd46522d1a63db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5360d0470d80495bb42fbbde59cde183c
SHA1d91434c5dee3965cf9d2238003184bd90e165d2c
SHA256537d8d7e6408b4ad1f867e8d58c983e2517a59a4b1d1491a6769329288df9a97
SHA51293dc54ed2c8dc8fb1c4bbcccac7774ec8d4c943d5f0e2a66d64217eaa9b02c22961f578fe7a9515a5ec6be7ec14ad603307b03df7c4b967631512538be45a56f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c4bd24439b12497e774e22ca53616b3d
SHA12b368d4d05ac101c37baaebf092db4d844ed3468
SHA256c7658575d6cf8fe5af9c13fe7928b8e8685998228294b07f569dcbd66202046b
SHA5129ada328014aea37e6913b32cab2368f0c45b0322b59269a88ea002e394150603722e6b44451723e9a9fee3030ded790a104720446b8481575a27cbbd990f7106
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ae66e996c42eecea40d452c7ff1901a7
SHA14202ae9befa49b7957d58f409283fb2b5ddeeea8
SHA25643d53d63391cd78bc4bf9c008f43e209096827abafac522950dc2af8e55a28f6
SHA5120e13ec84b54ddcaccaa23f70358934c7aff5f18bf0ad30981a4ef47aeb0034d7555041d0224ccb79f288dac02335035b3af3527c3024d5dfd21ef21a069f67a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5348c742f8f9792f17b9e23af80fbbebf
SHA16c69d298597473fe4d9f9ecc80c9c9b63182063c
SHA25698d26352b97ff6814a12aa1e248e18926705174019b77ffa559ac2c24869616f
SHA5127a494d1b10a0d986f186340f0880c148ea6d0cff89357a5f14435220a33871fcd5a98483fdbafb5144fc225ee0f0a75c5bef967d27dc9c7064f5c0815219e5b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53dd28fc97ca5bb15680f06aa81f166a0
SHA13326ffbd49ec17a8342a65301290d9a0162592b5
SHA256fd26dd4d6eae38a2f5ac023c1a8228ec5a0f3ee4a625d190696e1b787005f73f
SHA5122ef55fd0ddbd00f84d083aa97dd20bfd43a74992ac47ab9c08043628d99928fae548ff168e92a8583a2d5f186a14e41157109e381e786c99938cf2152635bed1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD504e5f1389928413685a4ef0bb1b9f5d1
SHA1e9c403cb3de2d725573fc4b186bfea6861642fe3
SHA2565c40e34bf68a837c8f7c7022a38f2cfffbaff31591a5aca8d5a597dc2c5b5226
SHA512c831994c7521f2d512496e50398b2c8fde660a0d6051602e215242f17fcc6f268d309d91e0e0ab5b5d1c3c0aa54181430e4784e68682c8accf7bc5c727f63563
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54fe45677969f081ae05900a27b509613
SHA1b53813bc13fb1bbf68067d7f3894762da04ee943
SHA2560e57deab6d8bee90114384b1275f70a33ebee63bc127b11db5573d0ff38adf34
SHA51268f0dbc5b0a34ab5d15e0ec5b032de5da475e18069545c549c6075f4c4739244b88b22b35650bcbbd9364bf8cc2eb3c9a46af65820401d0037375170c7175eef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5334f3aeebe571de391850e2e45189185
SHA11401b6e6b99049e453589ee9c5606f9bec9e7035
SHA256362bace7f31ec51e47c96c2b61d9ed01d5f86931c191317883094a5aa28909ed
SHA5120f43c8100837058ba9c3ae2b68d10aba6174bd96c9a6eeeb77fc28570e09e48ccb5304f15414311cca2f285648c4206008692c2932d23e2889ade2244ae4df8b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD522478ec84aceea261678436ebc9c889a
SHA1868dc997f740bd952c1a192e2c372568254143a4
SHA2560ab58a8820e3a0e1915a32423f9dfc578f4bc233c9c74ef7bf9119d3d0dcb361
SHA512aaf8fc1d0dc83dd03b5d7dce27d9b6a66e9aa9177b1a931d9cb4710cb83d0d772589e9cda1523ae236db370849610e81d916b886baedf18b3eecee5db6c3d4b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55dab41c942e17540497353c3a0bfd5e9
SHA19c94fec7838c9538abd81f2d54e1819709199fa2
SHA25681f20d625d741bd9fc657b945340b586b6c45435a63bfb1a7fadd3ccd8a073c9
SHA512fe10a0114daa29a48cb1373ffed1bde31e969b4df04b47e9a1fae36978794f4ddcf9f54c9667e65e6fb5a16d6988a7e3d6153fa485dea9cbc6c38affd4b4221a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD595afb06e47ee34b69666aa78635cc57b
SHA1df7c1bd222fa9d265bf211ca92ce7dd489df37ee
SHA2569c5ecff52e772d9140af746b6de87fe45e3dc664fa61ee2bef2166f0757b0656
SHA51293e074a62c00c93cc2302d487ebfac513b839d0c32c72cdb2d9143b07878c876acab3ea16a3168101a3ca7f0809175534249107e014e181d9671ce0019f32f41
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ede1e6a468914fa87fee4861af5a926c
SHA1d5208e2e15f1a9e9f8930de342dd7b71c825b468
SHA2560083efc042885594a6e7b917997735692412bca2568ee44f084a751fe8c4ed5c
SHA5120957b2d78f8ae8b39374e445e4056d4854e751bd5fcdb6fcfc12488aa2de9011845d67a13c889be9b10cdb9816342715df4a84aad2fd98d8a30cb539d31d057d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53423b13de1ba014a87e5f5bd23da7ad2
SHA163a50ece13a315b893011f54b5df55bf0ecc42eb
SHA25632b9b6023145e8c2a5170f0d4650f0f52ebbe7edaf1051896aa2407b0c4c16fc
SHA5120cfb6fae469b8bfd6c40e6434185d2ebfb160b014c778da09364ab1950e1d55d9cec85697a6d224c5274583f0fb9fb629e571ad90c69ae7ea07fa143e133a818
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57d25c3ee3ab3a75ca3cb1984261e3a25
SHA1939bfa8a084602e6eb569144753ddb1c5da83718
SHA2568b5fb519ec66633e3a5f7c3ce350006a008405976dd395739bf2d656e043556d
SHA5122d2b055391c3498e0a392945d43e1a02560e4054270b58ec18a025ed2ee2a0bb0a835ff654416154c30a33dea7bc535d51d8fc5a1e6ae476f96355f9eca1080a
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b