Analysis
-
max time kernel
145s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
23/07/2024, 13:22
Static task
static1
Behavioral task
behavioral1
Sample
67bf9f7a739aff6f40b4a1f57fa96ad9_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
67bf9f7a739aff6f40b4a1f57fa96ad9_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
67bf9f7a739aff6f40b4a1f57fa96ad9_JaffaCakes118.html
-
Size
32KB
-
MD5
67bf9f7a739aff6f40b4a1f57fa96ad9
-
SHA1
78816f2e4c6f8ed5e6d65d7a3e41fc0104348453
-
SHA256
49735d38b2681a0e519bde944a1cd50a6d92fddbd83f581bfc5785d37ba2e7e1
-
SHA512
b8dfc18d77b42143fad7118f3105428ce13d6f3dd9c9d054381d9d517b2254d56cc8160ada681921549f839c87755ee4af81eaedae25f2d6a312898f2c5c2eeb
-
SSDEEP
384:sRlIcytn4PWGTHVWl1NeCI1lm5nakto9IATGJTHlSqIhEX/gc5Bfqnujh5lh0bAP:MNWHrylWnaEJEYghWOAxLZ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427902809" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf7100000000020000000000106600000001000020000000fc299461f566806761151f5aa3d4506fdc15df347478f9f23b3611bd4b887a0b000000000e8000000002000020000000ec12bd74c4775ce6329e7a44c9204baaa6d12439154d7aeb21c86acb2e7e1449900000004e43f3f3af15a69082f07036010a8f07768dc0d65eafd919456a1cf1d0fc606aee2e30abcbd3207581b63258f3830235d531b4dfce24cdd06f11fa8d7a9214cc5d9224cf06d1ef9069c1756b9a0ca39a8b73430f4b16e43e9f4e6ccf13d0eae804a001266abaa2a4011c5a1122b1e180b05d8032213690280480f2feb8a439569315e38ee23653431ccf9182c3511ae540000000b5534abe81fd506f1f52ba4c142c6e5cbff64a9bee483eee03f4af9d6f5a3bdb0cd0bd1f49c454a6154d369b4fdfef6c409b7fdb1da589abda4d681284a6fd81 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf7100000000020000000000106600000001000020000000769b253488342c181116213d0c9b1ca14b5484e5e13af4de3c90fb670d9a113c000000000e800000000200002000000025a40f2fa5d59788050083a689b2146f753c9e8235e9bc584172ecddf43ce0ec2000000088ee6dcc684dbb79a7f6c99ee4830a6408bed0eebe8af358b1cdd3d7714112dc40000000d32b220ad42a8c05966bc14e7ffde7f281734c589b193b9352916b0135a413b9bea151e2ad79372c0a7716bfbf90c79c05df20fe9a2741e2b5a6e88703c165b4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{978A2B01-48F6-11EF-9F10-6A4552514C55} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d05c2a9603ddda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2652 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2652 iexplore.exe 2652 iexplore.exe 2856 IEXPLORE.EXE 2856 IEXPLORE.EXE 2856 IEXPLORE.EXE 2856 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2652 wrote to memory of 2856 2652 iexplore.exe 30 PID 2652 wrote to memory of 2856 2652 iexplore.exe 30 PID 2652 wrote to memory of 2856 2652 iexplore.exe 30 PID 2652 wrote to memory of 2856 2652 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\67bf9f7a739aff6f40b4a1f57fa96ad9_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2652 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2856
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD541bcfe9b5a8369714f23ab7cccba051b
SHA158d58f8be258f83afdf9a420a23939a279197525
SHA25687b74a806e531e9fc9be59bcce8a8b9d0b45d310fbbaa6a8c8efae0e64379f5e
SHA512ceca36d3feafa34982190fb80050601824e1a47b51e3eccab23354510b5f7fb35778ee7cc8978a05a58a10919b87fefe08987d98d45afa1f8353fd63a56745c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD570d1050b187addfb1802a6b0c287be05
SHA1b5045bf200f07ca604dfd649a6ba13d01b606f35
SHA2568c0bb434f73684e4bdaddeb14cf91f49bf9d0990d1f0b102c59c57806aaee1fb
SHA512eb5b5c5a504ab833264e2a38e79d0a2284d1bca94561e1f364ee6ca6f0c6f19506cf1a93359dc655be585678d582bf7cf156102f410a6f6c8a39e0db452082de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5946c7d7f9d84df4c9940b5abb1de21c4
SHA13035d584ab59a9b44c230fcbc6296d0c57ae6dd6
SHA25647e4ee71b7e53b2cebf9574bbddbb1a7bd9ac733caf2d9292996e9d0dde9759a
SHA5126edbdd29fe5199f46438c3cc869003e2df9ff14edc7e9de48dc5aab774759a02ec54c4abf96a0e64807f687086b80455207600308c6e5100404d8dcb666b2aac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5927c591f39a4efb4bb6b7ee6f6558477
SHA15145c2db0c2ae3f8120c04996d7c1a8c7080b9d8
SHA2568c5a786e22f476ed12a57c7b42126e8a1fba66edf76ff8b551640c1ceea810d9
SHA512629f881d5040a15ff0159194d6fffaea4f0e856cfdced00d1ad7d006793c588c632be5b56ae8ccd27660f8de33008bf7f3d798b2450c8c8528d929b8f9714e25
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59ab368311b3345df580477cfdc46fbe3
SHA171c1da8d3e674ecbb81467126a5200d4bf11c11e
SHA256c1c168dd86037b3bd8c0ef7dba34cae1cf927bd70ee9c515d6b5d3ee9e6982b7
SHA512d7e0d94363d03152cfcaca17f655a4b102fc9edb878dbc51a4b1f900aebc802420f01f7b2baf5937eee2fa176af862ea39fbe16b1117b27c7f7a1c434c458461
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51e8a39ff32cf03fde014b63227402de6
SHA1ee366e01e06587baf6f7a772243c87cbbb53c937
SHA2566ea072bf00d3c1827756121a336699fa5948e82f105226ab5dce6ae8fe34f710
SHA5124150530515a23cd2f3fdcff0d95e2827e69ec0b5c83d16cd69ac963e6b973758410081d40b613e2008fbfba0523848f9f951fe45132b93ee9b745618abc7e216
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56db391a29efc356d86f57c02edd7afaf
SHA1d2eeebc17f098fbe5d56bc69489ef02e57246c75
SHA25661438864ea1f9e423174f67a00e99e62b472583be912d299f5bc35d7b02e774c
SHA5123c278efc2a0b3a84959eef2d0e35b8f026412c46736ae5387371c61acd4b9ae13bb07c3e799e7c09e38862c5e048e338fa703c98c40e688e8ee983f144217169
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5701323dcce3246bfa6af81fbcef634a3
SHA1817249b72c1a7c981d9636a6438810c15c769fd3
SHA256ff66ab10b200a36f119e074e0ea9d7b012080dc99c67b9c7c19e1011d0a5648b
SHA5127b6430e18f2dd6a961754d6266eecac06cdd208806601f541aa82fbe9324ff46b2faa0d0d98e51fdae523fcdb528edd8db6c73ae0e76b03154614975ed26f175
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52d2fc6508ec15c12dbeb3a35d19faa78
SHA11153632e7e7e0a4ecbea6b216f0517a8ab46bbd8
SHA25651789acbe567f972751d001d5213f2e21b686be96c7e57480ff5897ce18fc326
SHA5122ba119f79d998dfb66136ad280ccaa6f5164715a944170cdf526fb5d648a32e18a509009f53fd743e2210f853d070b41db8e2a9da672669ada7ab40b5938e531
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5039870896f0087f226d33deb98417d52
SHA1bd6a103f45f1fd383e70ef613bab3a5588971b41
SHA256efd1ba13fa6645526221ea7a6fd3eec583c85e778d3ee4ea2414705b476ffcfb
SHA512b669927de8f9de4ce5c0177d12bb669fc97caf609f7cf5d65ed960801a84753308101a714856bff4e6f7bfc8e1654de42ff0ca88b4adc6220e51e940251c1957
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c275f87e2af28c5bf7397e7bec6f02ce
SHA1a57dbdd87de7e67dc1900593fc5c12fb7eeca86f
SHA2561da6da5a2a6aa5ff7a591f41c903248139440e84c1a76f32bc6924862ba60c9e
SHA5129ff6fe3d8011be3e9f7db1b7b466fcc29352fde90343ca7d31639bb37fc1edc0bbc5688d2eb956b21ea2215ac6a47b03a4fce8f5234f43e33e5918555e7335ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5472a8c999d7597b1a2204309fd3c3dd4
SHA1821ccd1d6f0ec74e0d520f1c205dbc25c4ec3be6
SHA25654af5f80bee368e4e54fbfe638f2a2ff197d461c42c8762b3b82f939d4bf22c5
SHA512925b88e52861cea6ac14a362bece8c69c228fb30e9cda314f8aa929d13c2b3973f9ec7b5624f6b9eb64bdd63eac39d028693f05bc3d047fc4eff6077cc4531bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD512395f7e5c19b4af1358c30f2b52ef56
SHA1376e8139d1dd10b58dd8b19da7f7baf03b7defaa
SHA2569fe08108af6c07647db9d9e550d112780b69fce7c8f957686e7b958d2585c0ac
SHA5126f7841cdf3017013cf986270d657792b7dcb56fced1db647d1e7910cac2b5ca7aa2d1ff8cd700f6d5d3fe02d75e23c641203958fc8ed03eb0a167ee4d0c49354
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD560e2680587970af67c49d3d02acc733c
SHA1364571837b686da0b8cc09ca98b84c4c74a785aa
SHA2560c2589446266dcf6ef26263b20b79cdc6160aa61cd7c7d5dde52041ac955e032
SHA51223834b7f153ecb79939029775633ca002d3ec43dac66fe49354c65ec623ad9753a6d24d88f7fe81b4b9ae6b4de1625247d5264dd90ea226cf011386a41ac4412
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53082b33ddd172248aaef24e1fdbe13de
SHA1c77ab13ce28e05b9ab8a3526a59ed7d58cb86e2e
SHA256cd5a9f52330ffde4d2f18d0efc470d1a59fc33aad9e881e14a446593ace3b1b1
SHA512656a9cd7c2bdeffd6cc64b5dde55f3e51ac6fc4af0c5cbfc1efda349dce7500cc36f8dc92a812b7839036f9d2f213d7545493b68b897ee29f6a6db16a2bb7856
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD516f3a491b4ef912ceb2f9032489ee243
SHA18854527cbff66b70ccac8c6fed007a0199c665cd
SHA2563946af3fd6db68ceffb3dbe46c9fb71dfe4e43a5a2df8d252255c64f0db0751b
SHA512e11c03e640c1e385e9d76c80d86f1587f1751ffb8ccf61a0019de0e533355a352dcc8195ac93dc8f1fba3a7ef293dd09137be8878d5f8623e8296a632e22e18c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD547d8216c8022cac69cff1560cd742a49
SHA1516ec233490b334640a168792d8172c140d2cc99
SHA2564b0aec05fa2362aff4e2f2df1644b1f96b8c585e3c20377cf83095bc6afbf96c
SHA512dcf9fa2f426490435522ae6844921eae91523e2ae0c1051ad16e67425f86d09cdde1cba02d761678f3216c932e6c9c07b5149eee2894fddcbab9dc59748ef440
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5630a51428267c155b1ff531a677ed495
SHA11abacd1582bb5f993c872c44ace96f604b7de47f
SHA2563cab919dd1687be8796256e7980bd9c210cae050e9d60cd15dfd0744bd4ceb6f
SHA5124184ce67816172cfec549da85f1846e6aa9a7a806b79820a1e74ec51c14589954a26c746338f1f3cd3b87ed9b878dc245ab2e1e44cf9c556b892337757c52a3b
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b